ASD ISM 1865 Compliance with system usage policies for access
What it says
Personnel agree to abide by system usage policies before being granted access to systems and their resources.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEmployees must agree to follow system rules before they can access it.
This control requires that all employees agree to follow certain rules about how they use their work computer systems before they can log in and start using them. It matters because if people don't understand or follow these rules, they could accidentally or intentionally cause security breaches, leading to data loss or other serious problems for the organisation.
Free. Save your status, tasks and notes.
Why it matters
If users are granted access without agreeing to system usage policies, misuse or policy breaches may go unchallenged, increasing insider risk and incident impact.
How to implement
Managers should ensure all new employees are briefed on system usage policies during their onboarding process.
This can be done by scheduling a dedicated session where the policies are explained clearly, and any questions are answered.
HR should include a system usage agreement as part of the employment contract paperwork.
Employees will need to read and sign this document to confirm they understand and agree to abide by the computer usage rules.
The IT team should set up a process where user accounts are only activated after the signed usage agreement is received.
This involves creating a checklist to ensure this step is completed before granting access.
The compliance officer should perform regular reviews to ensure all employees have a signed system usage agreement on file.
This can be a simple audit to compare user access records with signed agreements once a year.
IT administrators should set up a notification system to remind employees to review the system usage policies periodically.
This could involve an annual email reminder with any updated policies if changes have occurred.
Keep it running
Require policy acknowledgement before initial access and at periodic re‑acceptance (e.g., annually); record acceptance, block access if not accepted, and follow up on breaches.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of system usage agreements from HR: Request the folder or database where signed agreements are stored.
Look at
Whether each employee with system access has a corresponding signed agreement.
Good evidence
Is that all active users have a dated and signed agreement on file.
- Check 2 of 5What an auditor asks for
Ask for
The onboarding checklist: This is used during new employee orientation and should include an entry for system usage policy agreement.
Look at
How this item is checked off and who is responsible for ensuring compliance.
Good evidence
Shows a consistent process with accountability noted.
- Check 3 of 5What an auditor asks for
Ask for
A sample email or memo sent to employees about system usage policies: This demonstrates reminders are sent regularly.
Look at
The frequency and content of these communications to ensure they provide adequate notice.
Good evidence
Audit result reveals comprehensive reminders sent at least annually.
- Check 4 of 5What an auditor asks for
Ask for
A report or log of new account activations: Request documentation showing when new accounts get activated relative to agreement receipt. Verify that activation follows submission and signing of the policy agreement.
Good evidence
Shows no accounts activated without the agreement on file.
- Check 5 of 5What an auditor asks for
Ask for
Random user access records and compare to agreement files: Conduct a spot-check to ensure compliance across a random selection of employees. Verify whether access coincides with having a usage agreement signed.
Good evidence
Result indicates no discrepancies in user access and agreement documentation.
Mappings
Closest match in ISO/IEC 27001: A.5.1, Policies for information security, which this control partially meets.
ISO/IEC 27001: 4 mappings
This control partially meets A.5.1.
ISM-1865 requires personnel to agree to abide by system usage policies before being granted access to systems and resources. Annex A 5.1 requires information security and topic-specific policies to be published, communicated and acknowledged by relevant personnel, which directly underpins obtaining user acknowledgement/acceptance as part of access onboarding. Annex A 5.1 is broader (policy lifecycle and communication), while ISM-1865 is a specific access-gating requirement focused on agreement prior to access.
This control supports A.5.4.
ISM-1865 requires personnel to agree to follow system usage policies before being granted access. Annex A 5.4 places responsibility on management to require all personnel to apply information security in accordance with policies and procedures, reinforcing organisational enforcement expectations once access is provided. Annex A 5.4 is broader and ongoing (management enforcement across the organisation), whereas ISM-1865 is a specific pre-access acknowledgement/condition.
This control supports A.5.15.
ISM-1865 requires a precondition for access: personnel must agree to comply with system usage policies before being granted access. Annex A 5.15 requires rules and procedures to control physical and logical access to information assets, which commonly includes user obligations and prerequisites embedded in access control procedures (e.g., account provisioning conditions). Annex A 5.15 is broader in covering the design and implementation of access control rules, while ISM-1865 is a single procedural control point within that lifecycle.
This control depends on A.5.10.
ISM-1865 requires personnel to agree to abide by system usage policies before they are granted access to systems and resources. Annex A 5.10 requires the organisation to identify, document and implement acceptable use rules and handling procedures, which provides the concrete 'system usage policies' that users must agree to under ISM-1865. Without acceptable use rules in place, ISM-1865 cannot be meaningfully implemented as there is nothing specific to agree to.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-14.1Require role-tailored cyber security awareness training before granting accessPartially overlaps
This control partially overlaps IT.PRO-14.1.
IT.PRO-14.1 requires all personnel to receive role-tailored cyber security awareness training before being granted access; ISM-1865 requires personnel to agree to abide by system usage policies before being granted access, a companion pre-access condition rather than training.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.