ASD ISM 1773 Eligibility criteria for gateway system administrators
What it says
System administrators for gateways that connect to Australian Government Access Only networks are Australian nationals or seconded foreign nationals.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOnly Australian or seconded foreign nationals can manage government-only network gateways in Australia.
This control ensures that only Australian citizens or foreign nationals working under a specific agreement with the Australian Government manage the gateways to government-only networks. This matters because having unauthorised individuals manage these critical gateways could lead to security breaches, putting sensitive government information at risk.
Free. Save your status, tasks and notes.
Why it matters
Allowing non-eligible administrators to manage gateways to Access Only networks increases the risk of unauthorised access and national security compromise.
How to implement
The HR department should verify the citizenship status of all current and prospective system administrators who will manage government network gateways.
This can be done by requesting and storing a copy of each individual's Australian passport or appropriate visa documentation.
The IT manager should maintain a list of authorised system administrators, ensuring only eligible personnel have access to manage the government network gateways.
This can be maintained in a secure digital document with regular updates every six months.
The security officer should conduct orientation sessions for new system administrators, emphasising the importance of maintaining eligibility criteria such as citizenship for managing government network gateways.
This can be a formal meeting or digital briefing.
The compliance team should set up annual reviews to ensure that all system administrators remain eligible under current regulations.
This involves checking their continued status as Australian citizens or their current assignment under a government agreement.
The network manager should implement access controls in the management tools used for the gateways to prevent unauthorised personnel from gaining access.
This includes setting permissions based on current eligibility status and regularly auditing access logs.
Keep it running
Maintain evidence that gateway administrators are Australian nationals or currently seconded foreign nationals; review citizenship/secondment status at onboarding and at least quarterly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of current system administrators managing government network gateways.
Look at
Each individual's listed citizenship or foreign national status.
Good evidence
Includes all administrators having verified Australian citizenship or documented secondment agreements.
- Check 2 of 5What an auditor asks for
Look at
Copies of nationality documentation, like Australian passports or authorised work visas.
Good evidence
Shows a complete and up-to-date file for each administrator.
- Check 3 of 5What an auditor asks for
Ask for
The last six-monthly update of the authorised personnel list from the IT manager.
Look at
How often and accurately it reflects changes in personnel.
Good evidence
Will be a list no more than six months old with detailed, accurate records.
- Check 4 of 5What an auditor asks for
Look at
Signatures or acknowledgements of understanding from each participant.
Good evidence
Shows all personnel participated in such briefings within the last year.
- Check 5 of 5What an auditor asks for
Ask for
Access log records from the network management tools.
Look at
Entries indicating only those eligible access and manage gateways.
Good evidence
Shows restricted and monitored access corresponding with the authorised personnel list.
Mappings
Closest match in ISO/IEC 27001: A.6.1, Personnel background verification, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.6.1.
ISM-1773 mandates that gateway system administrators for Australian Government Access Only networks be Australian nationals or seconded foreign nationals. Annex A 6.1 offers the personnel vetting mechanisms needed to confirm and document those eligibility attributes prior to and during employment. ISM-1773 specifies a key eligibility requirement for a high-trust role, while Annex A 6.1 ensures the verification process is in place, but does not mandate nationality or secondment status.
This control partially overlaps A.5.2.
Annex A 5.2 requires information security roles and responsibilities to be defined and allocated according to organisational needs. ISM-1773 relates by specifying an eligibility requirement (nationality/secondment status) for a particular high-trust role: gateway system administrators for Access Only networks. ISM-1773 is role-specific and focused on personnel eligibility, while Annex A 5.2 is broader and covers defining and allocating all security roles and duties across the organisation.
This control supports A.5.15.
ISM-1773 mandates national eligibility for administering specific gateways. Annex A 5.15 supports this by requiring organisational policy and procedural frameworks that translate these mandates into manageable access control rules that prevent ineligible individuals from gaining the gateway administration rights.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.