ASD ISM 1535 Prevent unsuitable foreign data exports
What it says
Processes, and supporting procedures, are developed, implemented and maintained to prevent AUSTEO, AGAO and REL data in textual and non-textual formats from being exported to unsuitable foreign systems.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure processes are in place to block export of sensitive data to foreign systems.
This control ensures that sensitive Australian data doesn't end up in the wrong hands overseas. If we don't have good processes to stop this, our confidential information could be misused, leading to serious security risks and trust issues both domestically and internationally.
Free. Save your status, tasks and notes.
Why it matters
Exporting AUSTEO, AGAO or REL data to unsuitable foreign systems can expose classified information, harm national security, and damage partner trust.
How to implement
System owners should identify where sensitive data is stored and accessed within their organisation.
They can map out information flows using simple diagrams and mark areas where data might be transferred internationally. This helps pinpoint potential vulnerabilities.
IT teams should set up systems to block unauthorised data exports.
They can configure network settings to prevent data from being sent to select international locations or use secure transfer tools that have built-in restrictions.
Managers need to train staff on data handling policies about foreign transfers.
They can organise regular workshops with clear examples of what's allowed and what isn't, ensuring staff know the importance of compliance.
Procurement teams should vet vendors for their data handling capabilities.
They can ask vendors to commit to Australian data protection standards and check their track record in handling sensitive information.
The organisation's legal advisor should regularly review data transfer policies.
They should ensure these policies align with both Australian laws and the laws of countries where data might be accessed, updating them as needed.
Keep it running
Implement export checks to block AUSTEO/AGAO/REL data from transfer to foreign services not approved; monitor egress and review exceptions regularly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The data export policy document: Request the organisation's documented policy on data transfers to foreign systems.
Look at
The sections detailing restrictions on foreign transfers.
Good evidence
Includes clear instructions on what data cannot be exported and the consequences for non-compliance.
- Check 2 of 5What an auditor asks for
Ask for
Training records: Request records of staff training sessions related to data transfer.
Look at
Attendance lists and training content.
Good evidence
Shows regular, comprehensive training is provided to all relevant staff.
- Check 3 of 5What an auditor asks for
Ask for
System configurations: Request documentation on network or system configurations that prevent unauthorised exports.
Look at
Technical details demonstrating export restrictions.
Good evidence
Shows concrete evidence of systems blocking unwanted data leaks.
- Check 4 of 5What an auditor asks for
Ask for
Vendor agreements: Request contracts or agreements with third-party vendors.
Look at
Clauses related to data handling and export permissions.
Good evidence
Includes vendor agreements explicitly committing to Australian standards.
- Check 5 of 5What an auditor asks for
Ask for
Legal review summaries: Request summaries of legal reviews on data transfer policies.
Look at
The frequency and outcomes of these reviews.
Good evidence
Includes regular reviews resulting in policy updates reflecting current laws and risks.
Mappings
Closest match in ISO/IEC 27001: A.5.14, Information transfer policies and procedures, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.14.
ISM-1535 requires organisations to develop, implement, and maintain processes and procedures to prevent AUSTEO, AGAO, and REL data from being exported to unsuitable foreign systems. Annex A 5.14 requires information transfer rules, procedures, or agreements for all types of transfer facilities within and between organisations and other parties. ISM-1535 is a more specific, higher-sensitivity constraint within the broader transfer-governance expectation of Annex A 5.14, focusing on preventing the foreign export of particular Australian Government data types.
This control partially overlaps A.8.12.
ISM-1535 requires processes and supporting procedures to prevent AUSTEO, AGAO, and REL information (textual and non-textual) from being exported to unsuitable foreign systems. Annex A 8.12 requires data leakage prevention (DLP) measures across systems and networks to stop sensitive information being leaked or exfiltrated. They overlap where DLP rules, such as blocking uploads to foreign SaaS, restricting external sharing, and monitoring egress channels, are practical mechanisms to enforce ISM-1535's export-prevention objective. However, Annex A 8.12 is broader because it also covers non-foreign leakage scenarios, such as internal misuse or domestic unauthorised disclosure.
This control depends on A.5.13.
ISM-1535 requires processes and supporting procedures to prevent AUSTEO, AGAO, and REL data from being exported to unsuitable foreign systems. Annex A 5.13 requires information labelling procedures that are aligned to the organisation's classification scheme. This is a prerequisite for reliably identifying which content must be protected from foreign export. Without consistent labelling or equivalent classification metadata, implementing effective rules and checks for ISM-1535, like DLP policies and transfer approvals, is significantly more error-prone and difficult to enforce.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.