Skip to content
System access
ASD ISMISM-1610

ASD ISM 1610 Document and test emergency system access procedures

What it says

A method of emergency access to systems and their resources is documented and tested at least once when initially implemented and each time fundamental information technology infrastructure changes occur.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Ensure emergency access to IT systems is documented and tested during major IT changes.

This control is about making sure there are clear and tested procedures for getting into your computer systems in an emergency, like if a critical IT system crashes during a big change. It matters because if you can't access your systems when things go wrong, you could face extended downtime, loss of business, or even a compromise of security.

Why it matters

Without documented and tested emergency access, outages during major IT changes can delay recovery and increase risk of unauthorised access or data loss.

How to implement

  1. System owners should work with the IT team to document emergency access procedures.

    Start by listing the systems that need these procedures, what roles require access during emergencies, and how to quickly achieve this access. Put this information in an easy-to-understand document stored in a safe but accessible location.

  2. The IT team should schedule regular tests of these emergency access procedures.

    Conduct a mock drill, where someone tries to follow the procedure to access the system during a simulated crisis. Note any difficulties and refine the procedure as needed.

  3. Managers should ensure staff training includes these emergency procedures.

    Hold a session where the relevant staff are walked through these processes. Allow them to ask questions and practice the steps in a controlled environment.

  4. IT managers should integrate emergency access plans with major system updates.

    Each time there is a significant update, like a new system or software change, review and test the emergency access plan to ensure it still works.

  5. The security team should document when and how the emergency access procedures are tested.

    Use a simple report template that records the date of testing, who conducted it, any issues found, and the actions taken to address them.

Keep it running

Document emergency access steps, roles, approvals and break-glass accounts; test on initial implementation and after fundamental infrastructure changes, recording outcomes and updates.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The documented emergency access procedures: Request to see the document outlining these steps for all critical systems.

    Look at

    Whether each system is covered by the document, including what to do and who is responsible.

    Good evidence

    Includes clear, specific actions and contact details for responsible persons.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Records of emergency access tests: Request documentation on past tests, including dates and participants.

    Look at

    Whether tests have been conducted regularly and include major system changes.

    Good evidence

    Is a log showing consistent and timely testing activities.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Feedback or modifications on emergency procedures: Request any documents showing updates or improvements made from test results.

    Look at

    Whether changes were based on practical feedback from tests.

    Good evidence

    Shows clear, dated updates improving the emergency procedures.

  4. Check 4 of 5What an auditor asks for

    Ask for

    To see staff training records on emergency procedures: Request evidence that relevant staff have been trained.

    Look at

    Attendance records, dates, and training materials used.

    Good evidence

    Is documented evidence of regular, thorough training sessions.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Documentation of system updates related to emergency access: Request records on major changes with related emergency plan updates.

    Look at

    Matching dates between system updates and procedure revisions.

    Good evidence

    Shows consistent alignment of plans to system changes.

Mappings

Closest match in ISO/IEC 27001: A.5.30, ICT readiness for business continuity, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.5.30ICT readiness for business continuityPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.