ASD ISM 1817 Secure API access with authentication and authorisation
What it says
Authentication and authorisation of clients is performed when clients call network APIs that facilitate access to data not authorised for release into the public domain and are accessible over the internet.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure only authorised clients can access sensitive data via network APIs over the internet.
This control ensures that only people who are supposed to access certain sensitive information through internet-based systems can do so. It's like having a bouncer at the door of a club, checking IDs to make sure only the right people get in. If this isn't done, unauthorised access could lead to data leaks or breaches, damaging a business's reputation and finances.
Free. Save your status, tasks and notes.
Why it matters
If API clients are not authenticated and authorised, internet-exposed APIs may leak non-public data to unauthorised users, causing breaches and loss of trust.
How to implement
System owners should identify critical data accessed through their network APIs.
They can do this by reviewing what data is handled by each system and determining what needs special protection.
The IT team should implement authentication measures that verify the identity of users before they can access sensitive data.
This can include setting up usernames and passwords or using tools that send a code to a user's phone for additional security.
Managers should ensure that there are clear policies about who is authorised to access sensitive data.
They can work with HR to define roles and responsibilities, so only certain job positions have access to certain information.
IT personnel should routinely check logs of who accesses sensitive data to ensure only authorised users have gained access.
This can be done by setting up alerts for any unusual access patterns.
The office manager should organise regular training sessions for all staff about the importance of protecting sensitive data accessed over the internet.
This can involve inviting a cyber security expert to explain the basics in simple terms.
Keep it running
Implement strong client authentication and authorisation (e.g., OAuth2/OIDC, JWT validation). Review scopes/claims, rotate keys, and monitor internet-facing API access.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of users who have access to the system's sensitive data: Examine the list to ensure it matches authorised user roles.
Good evidence
Is a list that aligns with documented roles and permissions.
- Check 2 of 5What an auditor asks for
Look at
These policies to check how the system ensures only authorised users can access data.
Good evidence
Would be a comprehensive policy that includes username/password requirements and multifactor authentication for added security.
- Check 3 of 5What an auditor asks for
Ask for
Logs or records of access requests to sensitive data: Review these logs to see if any unauthorised access attempts were stopped.
Good evidence
Is a log showing all access attempts and how unauthorised ones were denied or challenged.
- Check 4 of 5What an auditor asks for
Good evidence
Includes documented attendance of key staff roles, especially those dealing with sensitive data.
- Check 5 of 5What an auditor asks for
Ask for
System testing reports or security assessments on network APIs: Check these reports to ensure tests are conducted regularly and cover potential vulnerabilities.
Good evidence
Is a detailed and dated report showing recent security tests and their outcomes.
Mappings
Closest match in ISO/IEC 27001: A.8.3, Restrict access to information and assets, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.3.
ISM-1817 requires that API clients are authenticated and authorised when calling internet-accessible APIs that expose non-public data. Annex A 8.3 requires restricting access to information and associated assets in accordance with an access control policy, regardless of whether access occurs via an API, UI, or other channel. ISM-1817 is a specific implementation of Annex A 8.3 for the internet API access path, emphasising both authentication and authorisation at the API boundary.
This control partially meets A.8.5.
ISM-1817 requires authentication and authorisation of clients when they call internet-accessible APIs that provide access to non-public data. Annex A 8.5 requires implementing secure authentication technologies and procedures based on access restrictions, which applies across systems and interfaces, including APIs. ISM-1817 is a specific application of Annex A 8.5 to the API context and additionally calls out authorisation decisions for API clients.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.