ASD ISM 1865Compliance with System Usage Policies for Access
Official control statement
Personnel agree to abide by system usage policies before being granted access to systems and their resources.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Employees must agree to follow system rules before they can access it.
What this means in practice
This control requires that all employees agree to follow certain rules about how they use their work computer systems before they can log in and start using them. It matters because if people don't understand or follow these rules, they could accidentally or intentionally cause security breaches, leading to data loss or other serious problems for the organisation.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
June 2025
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Guideline
Guidelines for system accessTopic
System access requirements
Why it matters
If users are granted access without agreeing to system usage policies, misuse or policy breaches may go unchallenged, increasing insider risk and incident impact.
Operational notes
Require policy acknowledgement before initial access and at periodic re‑acceptance (e.g., annually); record acceptance, block access if not accepted, and follow up on breaches.
Implementation tips
- Managers should ensure all new employees are briefed on system usage policies during their onboarding process. This can be done by scheduling a dedicated session where the policies are explained clearly, and any questions are answered.
- HR should include a system usage agreement as part of the employment contract paperwork. Employees will need to read and sign this document to confirm they understand and agree to abide by the computer usage rules.
- The IT team should set up a process where user accounts are only activated after the signed usage agreement is received. This involves creating a checklist to ensure this step is completed before granting access.
- The compliance officer should perform regular reviews to ensure all employees have a signed system usage agreement on file. This can be a simple audit to compare user access records with signed agreements once a year.
- IT administrators should set up a notification system to remind employees to review the system usage policies periodically. This could involve an annual email reminder with any updated policies if changes have occurred.
Audit / evidence tips
- AskThe list of system usage agreements from HR: Request the folder or database where signed agreements are storedLook atWhether each employee with system access has a corresponding signed agreementGoodIs that all active users have a dated and signed agreement on file
- AskThe onboarding checklist: This is used during new employee orientation and should include an entry for system usage policy agreementLook atHow this item is checked off and who is responsible for ensuring complianceGoodShows a consistent process with accountability noted
- AskA sample email or memo sent to employees about system usage policies: This demonstrates reminders are sent regularlyLook atThe frequency and content of these communications to ensure they provide adequate noticeGoodAudit result reveals comprehensive reminders sent at least annually
- AskA report or log of new account activations: Request documentation showing when new accounts get activated relative to agreement receipt. Verify that activation follows submission and signing of the policy agreementGoodShows no accounts activated without the agreement on file
- AskRandom user access records and compare to agreement files: Conduct a spot-check to ensure compliance across a random selection of employees. Verify whether access coincides with having a usage agreement signedGoodResult indicates no discrepancies in user access and agreement documentation
Cross-framework mappings
How ISM-1865 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 5.1 | ISM-1865 requires personnel to agree to abide by system usage policies before being granted access to systems and resources | |
handshakeSupports(2)expand_less | ||
| Annex A 5.4 | ISM-1865 requires personnel to agree to follow system usage policies before being granted access | |
| Annex A 5.15 | ISM-1865 requires a precondition for access: personnel must agree to comply with system usage policies before being granted access | |
extensionDepends on(1)expand_less | ||
| Annex A 5.10 | ISM-1865 requires personnel to agree to abide by system usage policies before they are granted access to systems and resources | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in System access
See all Guidelines for system access controls, or browse the full ASD ISM library.