Skip to content
Personnel security
ASD ISMISM-0820

ASD ISM 0820 Avoid posting work data on unauthorised online services

What it says

Personnel are advised not to post work-related information on unauthorised online services, and to report cases where such information is posted.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Staff should not share work info on unauthorised sites and must report if such info is found online.

This control is about keeping your organisation's information safe by not letting employees share work-related data on unauthorised online platforms. Imagine if sensitive projects or client details end up where they shouldn't; this could damage your reputation, cause financial loss, or even legal trouble.

Why it matters

If work data ends up on unauthorised sites, it can cause major losses like reputational damage, financial hits, and legal issues for your organisation.

How to implement

  1. Managers should create a clear list of authorised online services that staff can use for work-related purposes.

    Hold a team meeting to explain this list and ensure everyone understands what's allowed.

  2. HR should include a section on appropriate online sharing in the employee handbook.

    Provide examples of authorised vs unauthorised services, and update this information regularly.

  3. IT teams should monitor internet traffic to help identify if work data is being shared on unauthorised services.

    Use simple tools that flag unusual data sharing patterns, and investigate promptly.

  4. Supervisors should routinely discuss safe online behaviours during team meetings.

    Encourage staff to ask if they're unsure about which services are safe for work data.

  5. Business owners should encourage a culture where employees feel comfortable reporting accidental data sharing.

    Set up an anonymous reporting system if necessary, and reward proactive behaviour.

Keep it running

Regularly update your authorised online services list and keep the conversation open about data safety to prevent mishaps.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    Ask for the employee handbook or equivalent policy that tells personnel which online services are authorised for work-related information.

    Look at

    Check for a section that details authorised online services and advises personnel not to post work-related information elsewhere. Look at the clarity and currency of the information.

    Good evidence

    A good handbook has a specific list of authorised services, clear advice not to post work-related information on other services, and a recent review date.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Request logs or reports from internet traffic monitoring covering personnel activity on online services.

    Look at

    Examine any flags raised for unauthorised data sharing and verify whether there are documented follow-ups on those flags.

    Good evidence

    Correct implementation shows regular checks and evidence that flagged issues were investigated and resolved.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Ask to see the training records for personnel.

    Look at

    Look for sessions covering online service usage and the procedure for reporting work-related information posted on unauthorised services. Check attendance and content coverage.

    Good evidence

    Good records show regular training with high staff participation and content that covers both the advice and the reporting requirement.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Review incident reports relating to unauthorised sharing of work-related information.

    Look at

    Look at examples of identified cases of work-related information posted on unauthorised online services. Check for documentation of how each incident was handled and resolved.

    Good evidence

    Thorough documentation of handling and resolution indicates proper adherence to the policy.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Ask for records of incidents reported by personnel about work-related information posted on unauthorised online services.

    Look at

    Look for anonymised documentation of employee-reported issues and the actions taken in response to each report.

    Good evidence

    Good documentation shows that reports from personnel are accepted and acted upon, demonstrating the reporting requirement works in practice.

Mappings

Closest match in ISO/IEC 27001: A.6.8, Mechanisms for reporting security events, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.6.8Mechanisms for reporting security eventsPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.