ASD ISM 1864 Develop and enforce a system usage policy
What it says
A system usage policy is developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCreate and regularly update a policy that dictates how systems should be used within the organisation.
Creating and enforcing a system usage policy means setting clear rules about how people in your organisation can use computers and other devices. This matters because without clear guidelines, employees might use systems in ways that lead to security breaches, data loss, or even legal trouble for the organisation.
Free. Save your status, tasks and notes.
Why it matters
Without a system usage policy, users may misuse systems (e.g., unauthorised software or data handling), increasing breach risk and legal exposure.
How to implement
The IT manager should draft the system usage policy outlining acceptable and unacceptable uses of company systems.
They should collaborate with department heads to understand specific needs and address them in the policy.
The HR department should integrate the system usage policy into employee onboarding.
New employees should be briefed on the policy and asked to sign a document confirming their understanding and agreement.
Managers should hold regular training sessions to refresh employees' knowledge about the policy.
This can be done through short presentations and Q&A sessions where common misuse scenarios are discussed.
The compliance officer should schedule an annual review of the system usage policy.
This involves checking whether the policy still aligns with current business operations and technological advancements.
IT staff should monitor system usage to detect violations of the policy.
This can be achieved by implementing and reviewing basic system logs or using monitoring software to flag potential misuse.
Keep it running
Assign policy ownership; publish to all users; require onboarding and annual acknowledgement; review at least annually and after major system or threat changes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The current system usage policy document.
Look at
The revision date and signatures from an authorised person to ensure it is up to date.
Good evidence
Is a recently reviewed policy signed off by a senior manager.
- Check 2 of 5What an auditor asks for
Ask for
Records of employee acknowledgments of the system usage policy.
Look at
Signed or electronically affirmed agreements from all staff.
Good evidence
Is a complete set of acknowledgments from current employees.
- Check 3 of 5What an auditor asks for
Look at
Attendance lists and training materials used.
Good evidence
Includes regular training sessions with comprehensive materials provided to all staff.
- Check 4 of 5What an auditor asks for
Look at
Logs or reports detailing how misuse is identified and addressed.
Good evidence
Includes evidence of regular monitoring and follow-up actions on detected issues.
- Check 5 of 5What an auditor asks for
Ask for
The schedule or documentation of policy reviews.
Look at
Past review dates and any amendments made.
Good evidence
Shows consistent, periodic reviews with updates reflecting changes in technology or business processes.
Mappings
Closest match in ISO/IEC 27001: A.5.10, Acceptable use policies for information and assets, which asks for the same thing.
ISO/IEC 27001: 5 mappings
This control is equivalent to A.5.10.
ISM-1864 requires the organisation to develop, implement, and maintain a system usage policy governing how systems are used. Annex A 5.10 similarly requires documented and implemented rules for acceptable use and handling of information and associated assets. Both controls are centred on establishing and enforcing acceptable-use expectations for users, with only minor differences in phrasing ('system usage' versus 'information and assets').
This control partially meets A.5.1.
ISM-1864 requires a specific topic-level policy for system usage to be developed, implemented, and maintained. Annex A 5.1 is broader, requiring an overarching information security policy framework and topic-specific policies to be defined, approved, communicated, acknowledged, and reviewed. ISM-1864 fits as one such topic-specific policy within the wider governance requirements of Annex A 5.1.
This control supports A.5.4.
ISM-1864 requires the organisation to establish and maintain a system usage policy. Annex A 5.4 supports this by placing responsibility on management to require personnel to apply information security in accordance with established policies and procedures, which is necessary to enforce ISM-1864 in practice. Annex A 5.4 is about managerial enforcement/accountability rather than defining the content of the usage policy itself.
This control depends on A.6.3.
ISM-1864 requires a system usage policy to be created and maintained to define expected system use. Annex A 6.3 supports this by requiring awareness, education, and training so personnel receive updates and understand relevant policies and procedures, including acceptable use expectations. ISM-1864 is primarily about the policy artefact and its enforcement, while Annex A 6.3 is about ensuring people know and can apply it.
This control depends on A.6.4.
Annex A 6.4 requires a formalised and communicated disciplinary process for handling information security policy violations. ISM-1864 establishes and enforces a system usage policy, which defines expected behaviour and creates the basis for determining when a violation has occurred and when Annex A 6.4 should be invoked. ISM-1864 does not require disciplinary actions or procedures, while Annex A 6.4 focuses on consequences and process once a breach is identified.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.