ASD ISM 0824 Avoid using unauthorised online file services
What it says
Personnel are advised not to send or receive files via unauthorised online services.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishStaff should not use online services for files unless approved to avoid security risks.
This control means that everyone in your organisation should avoid using any online file services that haven't been approved. This is important because using unapproved services can expose your organisation's data to cyber threats, such as hacking, data theft, or accidental exposure, which could damage your reputation or lead to financial loss.
Free. Save your status, tasks and notes.
Why it matters
Using unauthorised online file services can expose sensitive data to cyber threats, risking data breaches and reputational damage.
How to implement
Managers should identify and communicate which online file services are approved for use within the organisation.
To do this, compile a list of approved services and share this list with all staff through an easily accessible document or an internal website.
The IT team should regularly review and update the list of approved online services.
They can do this by conducting quarterly assessments of available services to ensure they meet the organisation's security standards and updating the list accordingly.
HR should include training on the approved services as part of the onboarding process for new staff.
This can be done by integrating a short module on file-sharing risks and approved services into the employee induction program.
System owners should ensure that any file sharing features on their systems are configured to use only authorised services.
They can do this by setting system permissions and conducting regular checks to ensure these permissions are enforced.
All staff should be encouraged to report any use of unauthorised services they encounter.
This can be achieved by setting up a clear reporting process, such as a designated email address, and reminding staff through regular communications about the importance of using approved services.
Keep it running
Publish approved file transfer services, block unauthorised file-sharing sites, and train staff not to upload or download files via unapproved platforms.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of approved online file services: Request a copy of the document or internal webpage listing the services.
Look at
Whether it is up-to-date and includes common services used in your industry.
Good evidence
Is a list reviewed in the past six months with clear approval indicators.
- Check 2 of 5What an auditor asks for
Ask for
A recent IT service audit report: Request documents showing the audits conducted for compliance with this control.
Look at
The details of the services reviewed against the list of approved services.
Good evidence
Would show a complete match with no discrepancies.
- Check 3 of 5What an auditor asks for
Ask for
Records of staff training on approved services: Request attendance logs or training completion records.
Look at
Coverage of online service usage policies.
Good evidence
Is evidence of mandatory training for all staff within the last year.
- Check 4 of 5What an auditor asks for
Ask for
About the process for updating approved services: Request documented procedures or policies.
Look at
The steps involved and frequency of updates.
Good evidence
Would include a well-defined review cycle and approval process.
- Check 5 of 5What an auditor asks for
Ask for
Records of any incidents involving unauthorised services: Request logs or reports of any such security issues.
Look at
The nature and resolution of each incident.
Good evidence
Would show proactive measures taken and improvements in the process.
Mappings
Closest match in ISO/IEC 27001: A.5.10, Acceptable use policies for information and assets, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.10.
ISM-0824 advises personnel not to send or receive files via unauthorised online file services to reduce security risk. Annex A 5.10 requires the organisation to define, document and implement acceptable use rules and handling procedures for information and associated assets, under which prohibiting unapproved file-sharing services would typically sit. ISM-0824 is a specific acceptable-use rule about a particular class of services, whereas Annex A 5.10 is broader and covers many acceptable-use and handling topics beyond online file services.
This control partially meets A.6.3.
ISM-0824 advises personnel not to send or receive files via unauthorised online file services. Annex A 6.3 requires an information security awareness, education and training program so personnel understand and follow security policies and procedures. Training and awareness directly supports effective implementation of ISM-0824 by ensuring staff recognise what services are unauthorised and the risks of using them, but Annex A 6.3 does not itself define the prohibition.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.