ASD ISM 1146 Separate personal and work accounts for online services
What it says
Personnel are advised to maintain separate personal user accounts from any work user accounts they use for online services.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishKeep your personal and work user accounts separate when using online services.
Keeping your work and personal accounts separate online means using different usernames and passwords for each. This matters because mixing them up can lead to mishaps like sharing work information by mistake, or security breaches if one account is hacked.
Free. Save your status, tasks and notes.
Why it matters
Mixing personal and work accounts can lead to accidental data leaks or unauthorised access, risking business confidentiality and security.
How to implement
HR should ensure all employees understand the importance of separating personal and work accounts.
They can do this by organising workshops or training sessions explaining the risks and benefits of this separation.
IT teams should create distinct processes for account creation and access control for work accounts.
This can be done by setting up clear procedures and guidelines for employees to follow when accessing work systems.
Managers should encourage their teams to use separate browsers or devices for personal and work activities.
This helps reduce the risk of data leaks by keeping work and personal browsing histories and cookies separate.
System administrators should regularly audit user accounts to ensure no overlap between personal and work accounts exists.
This includes keeping logs of account activity and regularly reviewing these logs.
Security officers should implement policies that clearly define and enforce the separation of personal and work accounts.
They can draft these policies and communicate them effectively through regular updates and email reminders.
Keep it running
Regularly remind employees about the importance of keeping work and personal accounts separate and check compliance with established policies.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the account management policy document. Look whether it includes clear guidelines for maintaining separate personal and work accounts.
Good evidence
detailed policies that outline the need for and methods of separation.
- Check 2 of 5What an auditor asks for
Ask for
to see logs of recent account audits conducted by IT.
Look at
evidence of account segregation reviews.
Good evidence
logs showing regular checks with no findings of overlap.
- Check 3 of 5What an auditor asks for
Look at
attendance records and feedback forms.
Good evidence
comprehensive session records and positive feedback on understanding.
- Check 4 of 5What an auditor asks for
Ask for
a demonstration of account setup procedures.
Look at
distinct processes for work accounts.
Good evidence
a step-by-step process that segregates personal from work account setup.
- Check 5 of 5What an auditor asks for
Look at
documentation on follow-up actions and policies revised.
Good evidence
incident reports with clear corrective action and policy updates.
Mappings
Closest match in ISO/IEC 27001: A.5.10, Acceptable use policies for information and assets, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.10.
ISM-1146 advises personnel to keep separate work and personal online accounts to reduce cross-contamination and account compromise risks. Annex A 5.10 requires the organisation to define and implement acceptable use rules for information and associated assets, which commonly includes requirements about use of personal vs organisational accounts for online services. ISM-1146 is a specific, practical behavioural rule that would typically sit under the broader acceptable use policy framework in Annex A 5.10.
This control partially meets A.6.3.
ISM-1146 advises personnel to maintain separate work and personal online accounts for online services. Annex A 6.3 requires an information security awareness, education and training program to ensure personnel understand and follow security expectations. Training and awareness (Annex A 6.3) is a key mechanism to communicate and reinforce the separation behaviour required by ISM-1146, but it does not itself mandate that specific separation practice.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.