Skip to content
Personnel security
ASD ISMISM-0821

ASD ISM 0821 Advise on risks of posting personal information online

What it says

Personnel are advised of security risks associated with posting personal information on online services.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Employees should be aware of the dangers of posting their personal info on the internet.

Posting your personal details online can make you vulnerable to cyber criminals and identity theft. If this isn't considered, your personal and professional info might be used against you by scammers or hackers.

Why it matters

Failing to manage personal info online risks identity theft and financial loss impacting both individuals and the organisation.

How to implement

  1. HR should educate staff through training sessions on the importance of not posting personal information online.

    This involves creating scenarios where personal info could be misused, and discussing safe online sharing habits.

  2. The IT team should develop easy-to-understand guidelines that outline what kind of personal info should never be shared online.

    Use clear examples that relate to everyday work and personal life.

  3. Managers should review employees' understanding during regular check-ins.

    Encourage them to ask questions on what is considered personal information that should be protected.

  4. Executives should prioritise cyber safety in meetings by discussing online behaviour and sharing real-life stories about the risks of posting personal information online.

    This helps to create a culture of security awareness.

  5. The communications team should regularly remind staff via email or newsletter about the risks and give practical safety tips.

    They can use catchy phrases or stories to make the message memorable.

Keep it running

Regularly update training and guidelines about online safety to reflect new risks, and encourage staff to report suspicious activities.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    the training materials used for personnel security awareness.

    Look at

    content that specifically covers risks of posting personal information online. Good content includes interactive elements and practical examples.

  2. Check 2 of 5What an auditor asks for

    Ask for

    to see the documented guidelines provided to staff. Check that they specifically mention types of personal information that are at risk online. Good guidelines use plain language and relatable scenarios.

  3. Check 3 of 5What an auditor asks for

    Ask for

    management for records of check-ins where personal information safety was discussed.

    Look at

    entries that specifically address online sharing behaviours.

    Good evidence

    record includes names, dates, and key outcomes discussed.

  4. Check 4 of 5What an auditor asks for

    Ask for

    copies of reminders or campaigns about online privacy.

    Look at

    distribution records and the frequency of communications. Good evidence shows regular intervals and creative, engaging content.

  5. Check 5 of 5What an auditor asks for

    Look at

    questions or comments suggesting employees understand the threats of sharing personal information. Positive feedback indicates effective training.

Mappings

Closest match in ISO/IEC 27001: A.6.3, Information security awareness, education and training program, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.6.3Information security awareness, education and training programPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.