ASD ISM 2092 Enforce fine-grained permissions for AI applications
What it says
Access control policies are implemented to enforce fine-grained permissions for AI applications.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishImplement access controls to precisely limit what users can do with AI applications.
This control ensures that only the right people can do specific things with AI applications, preventing misuse or data breaches. It's like having a lock and key system so not everyone can wander into critical areas in your business.
Free. Save your status, tasks and notes.
Why it matters
Without proper permissions, sensitive AI data could be misused or leaked, leading to financial and reputational harm.
How to implement
Managers should identify who needs access to AI systems and for what purposes.
Make a simple list of team members and their roles to define who genuinely requires access to sensitive functions.
IT staff should configure user accounts with specific permissions.
Use software tools to set limitations on who can view, change, or delete information in the AI applications.
HR teams should maintain updated records of user roles and any changes.
Regularly review and update these records as people join, leave, or change roles within the organisation.
The IT team should implement periodic review meetings with department heads.
Schedule these quarterly to reassess who should have access based on any new projects or organisational changes.
Data protection officers should train staff on the importance of these permissions.
Conduct workshops using real-world scenarios to explain why limits are in place and how they protect the business.
Keep it running
Regularly review and update user permissions to reflect changing roles, ensuring data remains secure and accessible only to authorised users.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the current user access lists for each AI application, showing the access settings applied to every user.
Look at
Look at who has access to each AI system and at what level of permission.
Good evidence
Permissions are assigned intentionally and align with each user's job role, with no broad or unexplained access.
- Check 2 of 5What an auditor asks for
Ask for
Request the permission change logs for the AI applications, showing changes made to user permissions over time.
Look at
Check how frequently permissions change and whether a reason is recorded for each change.
Good evidence
The records show a clear history of permission changes, each with a documented justification.
- Check 3 of 5What an auditor asks for
Ask for
Ask for the minutes from access review meetings covering the AI applications.
Look at
Look at the scope of what was discussed and the decisions made about user access.
Good evidence
The minutes include action items and confirm which accesses were kept as necessary and which were revoked.
- Check 4 of 5What an auditor asks for
Ask for
Request training logs showing that staff were trained on the access controls for AI applications.
Look at
Look at the number of participants and the content covered in the training.
Good evidence
The logs show regular, comprehensive training sessions on access controls.
- Check 5 of 5What an auditor asks for
Ask for
Inquire about the monitoring system used to detect access violations in AI applications, and request reports of detected improper access attempts.
Look at
Look at whether improper access attempts are detected and alerted on, and how each one was handled.
Good evidence
There is a working alert mechanism for access violations and records showing how each alert was responded to.
Mappings
Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.15.
ISM-2092 requires organisations to implement access control policies that enforce fine-grained permissions specifically for artificial intelligence applications. ISO/IEC 27001:2022 Annex A 5.15 requires establishing and implementing general rules and procedures for logical and physical access based on business and security requirements. ISM-2092 is effectively a specific, AI-focused instantiation of the broader access control policy requirement in Annex A 5.15.
This control partially meets A.5.18.
ISM-2092 requires fine-grained permissioning for AI applications, ensuring only authorised users can use AI capabilities in line with policy. ISO/IEC 27001:2022 Annex A 5.18 covers the broader lifecycle management of access rights across information assets. ISM-2092 aligns with Annex A 5.18 where those lifecycle processes are applied to AI application permissions but does not itself require the full access-rights lifecycle detail.
This control partially meets A.8.3.
ISM-2092 requires restricting AI application use through fine-grained permissions enforced by access control policies. ISO/IEC 27001:2022 Annex A 8.3 requires restricting access to information and associated assets in accordance with the access control policy. ISM-2092 is a specific case of Annex A 8.3 focused on AI application permission models and enforcement.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.