ASD ISM 0854 Access restrictions for AUSTEO and AGAO data
What it says
AUSTEO and AGAO data can only be accessed from systems under the sole control of the Australian Government that are located within facilities authorised by the Australian Government.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAUSTEO and AGAO data is only accessible via government-controlled systems within authorised facilities.
AUSTEO (Australian Eyes Only) and AGAO (Australian Government Access Only) data must be accessed only through government-controlled systems within approved locations. This is crucial because if this sensitive data falls into the wrong hands, it could threaten national security or harm diplomatic relations.
Free. Save your status, tasks and notes.
Why it matters
If AUSTEO and AGAO data is accessed outside authorised systems, it risks exposure to unauthorised entities, undermining national security.
How to implement
IT managers should ensure systems that store or access AUSTEO or AGAO data are physically located within government-approved facilities.
They can do this by conducting regular audits of the data storage locations and verifying if they meet government standards.
System administrators need to set up strict permissions on government systems that handle AUSTEO or AGAO data.
They should use a checklist provided by the Australian Cyber Security Centre (ACSC) to ensure only authorised personnel have access.
Facility managers must confirm that physical security controls, like surveillance and access badges, are in place at locations handling sensitive data.
They should regularly inspect these controls to ensure they are functioning correctly.
Compliance officers should work closely with government agencies to keep updated on authorised facilities.
This involves checking with the Australian Signals Directorate (ASD) for any changes in facility authorisation.
Human Resources should train staff on the importance of using only authorised systems and facilities for AUSTEO and AGAO data.
This can be done through regular workshops and mandatory security training sessions.
Keep it running
Audit access logs to confirm AUSTEO/AGAO data is only accessed from Australian Government-controlled systems in authorised facilities.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of systems authorised to handle AUSTEO/AGAO data: Request documentation from IT showing which systems are used.
Look at
The locations and control measures listed.
Good evidence
All systems are within authorised facilities with government-controlled access permissions.
- Check 2 of 5What an auditor asks for
Ask for
Facility authorisation records: Request proof that facilities storing or accessing the data are approved by the government.
Look at
The dates and signatures of authorisation.
Good evidence
Records are current and signed by the relevant government authority.
- Check 3 of 5What an auditor asks for
Ask for
Access logs for systems used for AUSTEO/AGAO data: Request system logs from IT to see who accessed the data.
Look at
Access times and user IDs.
Good evidence
Only authorised users accessed data, and logs show consistent patterns with no anomalies.
- Check 4 of 5What an auditor asks for
Ask for
Security training records: Request evidence of security training for personnel accessing AUSTEO/AGAO data.
Look at
Attendance records and training content.
Good evidence
Comprehensive training was conducted regularly, and all staff attended.
- Check 5 of 5What an auditor asks for
Ask for
Physical security inspection reports: Request records of physical security checks for facilities with sensitive data.
Look at
Detailed checklists and dates.
Good evidence
Regular inspections were conducted, showing all security measures are in place and functional.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.15.
ISM-0854 sets a strict rule about where and on what systems AUSTEO and AGAO data may be accessed (Australian Government solely controlled systems in authorised facilities). Annex A 5.15 requires organisations to define and implement access control policies and procedures for physical and logical access based on business and security requirements. ISM-0854 can be implemented as a specific access control policy rule under Annex A 5.15, while Annex A 5.15 covers a much wider scope of access control governance and procedures beyond these datasets.
This control partially meets A.8.3.
ISM-0854 requires that access to AUSTEO and AGAO data is restricted to Australian Government solely controlled systems located in authorised facilities. Annex A 8.3 establishes the broader requirement that access to information and associated assets is restricted in line with an access control policy. ISM-0854 is a highly specific access restriction (system ownership/control and physical location) that would sit under, and be one rule within, the wider ISO access restriction regime.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.