Skip to content
System access
ASD ISMISM-1583

ASD ISM 1583 Ensure contractors are identified as users

What it says

Personnel who are contractors are identified as such.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Ensure contractors are labelled distinctively from other personnel in systems.

In your organisation's system, it's important to clearly label contractors separately from permanent staff. This matters because if contractors aren't easily identified, there might be confusion over what they can access, and they might unintentionally gain access to sensitive information they shouldn't see.

Why it matters

If contractors aren't identified as such, access reviews and offboarding can miss them, increasing risk of lingering access, data exposure and audit noncompliance.

How to implement

  1. HR should identify all current contractors in the organisation's records.

    This means going through employment records and marking who is a contractor. Be sure to update this list regularly.

  2. The IT team needs to clearly label contractor accounts within all systems.

    This can be done by adding 'CON' to their username or using a separate user group for contractors. This helps in easily separating them from permanent staff.

  3. Managers should inform contractors of their specific access levels.

    Set up a short meeting to explain what systems they can access and why certain restrictions are essential. Record what is discussed and agreed upon.

  4. The IT department should regularly review access logs to ensure contractors are only accessing appropriate systems.

    Use a simple checklist to compare contractor actions against their permitted access.

  5. Procurement teams, when hiring new contractors, should inform the IT team immediately.

    Provide the necessary details like duration of their contract and systems they need access to so the IT team can set up proper accounts.

Keep it running

Tag contractor accounts in the identity system (e.g., user type/attribute) and verify this label during joiner/mover/leaver reviews and periodic access recertification.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The list of current contractors from HR: Request the document or database that indicates all current contractors.

    Look at

    How contractors are differentiated, such as a specific tag or indicator.

    Good evidence

    Includes a comprehensive, up-to-date list with clear markings of contractor status.

  2. Check 2 of 5What an auditor asks for

    Ask for

    To see the account naming convention policy from IT: Request the documentation outlining how contractor accounts are set up.

    Look at

    Specific rules on naming conventions or group classifications.

    Good evidence

    Would show explicit guidelines that separate contractors from regular staff.

  3. Check 3 of 5What an auditor asks for

    Ask for

    System access logs from the IT team: Request recent system access logs showing higher-level access attempts by user accounts.

    Look at

    Entries showing access by contractor IDs and check if access is within their rights.

    Good evidence

    Confirms that all access aligns with authorised permissions tied to contractor roles.

  4. Check 4 of 5What an auditor asks for

    Ask for

    To see access permissions: Request details of the permissions given to contractor accounts in the system. Check for restricted permissions in comparison to permanent employees.

    Good evidence

    Highlights that contractors have access only to the systems they need, with limited access rights.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Managers for documentation of communicated access limitations: Request notes or emails showing what access information was communicated to contractors.

    Look at

    Clear explanations regarding access levels and system restrictions.

    Good evidence

    Is documentation that reflects clear communication tailored to individual contractor roles.

Mappings

Closest match in ISO/IEC 27001: A.5.16, Identity life cycle management, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.5.16Identity life cycle managementPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.