ASD ISM 1520 Employment screening for gateway administrators
What it says
System administrators for gateways undergo appropriate employment screening, and where necessary hold an appropriate security clearance, based on the sensitivity or classification of gateways.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure appropriate screening and security clearance for gateway admins based on system sensitivity.
This control is about making sure that people who manage important parts of your computer systems, called gateways, are properly checked out before they're hired. It's crucial because if someone untrustworthy gets access, they could cause serious harm by stealing data, disrupting services, or exposing sensitive information.
Free. Save your status, tasks and notes.
Why it matters
Inadequate screening of gateway administrators can enable unauthorised privileged access, leading to data compromise and disruption of gateway services.
How to implement
HR should ensure robust employment screening: Conduct background checks on potential system administrators to verify their credentials and past employment.
This can be done by contacting previous employers and checking qualifications with issuing institutions.
System owners should determine sensitivity levels: Assess the sensitivity and classification of your gateways to know which admin roles require higher security clearance.
Organise a meeting with IT and security staff to rate each system based on the data it handles.
IT managers should implement security clearance workflows: Establish a clear process for obtaining and verifying security clearances for admin roles.
Work with HR to integrate this process into hiring protocols, ensuring it's not skipped.
HR should educate about clearance importance: Provide training sessions for recruiters and managers to explain why security clearances are needed and how to discern when a role demands one.
Use real-world examples to illustrate potential risks.
System owners and IT leads should maintain a clearance register: Keep an up-to-date record of current gateway administrators and their security clearances.
Use a simple spreadsheet or secure database for tracking and ensure it's regularly reviewed.
Keep it running
Maintain evidence of screening and required clearances for gateway admins; re-screen and reassess clearances when gateway sensitivity/classification or admin duties change.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The employment screening policy: Request documentation that outlines the employment screening practices for gateway administrators.
Look at
The thoroughness of the checks described, like reference and background checks.
Good evidence
Includes a detailed process with clear steps for verifying credentials.
- Check 2 of 5What an auditor asks for
Ask for
To see the list of gateway admins and their clearances: Request the current registry of administrators managing gateways, along with their security clearances. Check for alignment between sensitive gateways and clearance levels.
Good evidence
Is a complete and up-to-date list that links each admin with their respective clearance.
- Check 3 of 5What an auditor asks for
Ask for
About training records for HR personnel: Request documentation of training sessions provided to HR and hiring managers on security clearance importance.
Look at
Records of attendance and training materials.
Good evidence
Includes regular training sessions reflected in meeting minutes or signed attendance sheets.
- Check 4 of 5What an auditor asks for
Ask for
To see incident response records: Request past records of incidents involving unauthorised access to gateways.
Look at
Descriptions of incidents where lack of screening could have been a factor.
Good evidence
Would show no incidents, or steps taken to prevent recurrences are documented.
- Check 5 of 5What an auditor asks for
Ask for
About the clearance renewal process: Request information on how often security clearances are reviewed and renewed.
Look at
A schedule and documented outcomes of reviews.
Good evidence
Includes a defined process with regular intervals for renewal and review outcomes documented.
Mappings
Closest match in ISO/IEC 27001: A.6.1, Personnel background verification, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.6.1.
ISM-1520 requires gateway system administrators to undergo appropriate employment screening and, where necessary, hold an appropriate security clearance based on gateway sensitivity/classification. ISO/IEC 27001:2022 Annex A 6.1 requires background verification for personnel prior to joining (and ongoing), proportional to business requirements and information classification/risk, which directly covers the screening component ISM-1520 relies on. ISM-1520 is more specific to a high-risk role (gateway administrators) and explicitly includes clearance requirements, whereas Annex A 6.1 applies broadly to all personnel and does not explicitly mandate security clearances.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.