ASD ISM 2104 Do not post security clearance and briefing details online
What it says
Personnel are advised not to post information about their security clearance and briefings on unauthorised online services, and to report cases where such information is posted.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishStaff are told not to post their security clearance or briefing details on unapproved online services and to report it when such information appears.
This control is about keeping details of your security clearance and any security briefings off websites, apps and social media that your organisation has not approved. If someone reveals what level of clearance they hold or what they were briefed on, it can tell outsiders who to target and what secrets your organisation holds. Staff also need to speak up and report it whenever they notice this kind of information has been posted, whether by themselves or someone else.
Free. Save your status, tasks and notes.
Why it matters
If staff post their security clearance or briefing details on unapproved sites, attackers learn who holds sensitive access and what secrets exist, making them prime targets for social engineering or espionage.
How to implement
The security manager should write a short, plain-English rule that states personnel must not post their security clearance level or details of any security briefings on unauthorised online services, and should include this rule in the staff handbook and induction pack.
The awareness training team should add a specific module showing real examples of what counts as a security clearance or briefing detail (for example posting 'just got my Secret clearance' on a public profile) so staff recognise what they must not share.
The IT or security team should set up a simple, well-publicised reporting channel (such as a dedicated email address or an item on the helpdesk form) so anyone who spots clearance or briefing information posted online can report it quickly.
Line managers should remind their teams before and after any security briefing that the content of that briefing must not be discussed or posted on unapproved websites, apps or social media.
The HR team should have new starters who hold a clearance sign an acknowledgement that they understand they must not post clearance or briefing details online and that they will report any cases they see.
Keep it running
Reinforce the rule whenever briefings are held and review reported cases periodically to confirm postings are removed and lessons are fed back into awareness training.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the written policy or staff guidance that tells personnel not to post security clearance and briefing details on unauthorised online services.
Look at
whether it names clearance level and briefing content specifically and whether it is easy for staff to find.
Good evidence
is a current, approved document that clearly states the rule and where it lives.
- Check 2 of 5What an auditor asks for
Ask for
how staff are made aware of this rule.
Look at
induction materials, awareness training slides and any signed acknowledgements.
Good evidence
shows the rule is taught with concrete examples and that staff have confirmed they understand it.
- Check 3 of 5What an auditor asks for
Ask for
how someone reports a case where clearance or briefing information has been posted online.
Look at
the reporting channel (email address, form or hotline) and whether staff actually know it exists.
Good evidence
is a named, monitored channel that staff can describe without hesitation.
- Check 4 of 5What an auditor asks for
Ask for
to see records of any reports that have been made and what happened next.
Look at
the log of reported postings and the actions taken to get them removed or escalated.
Good evidence
shows reports are captured, acted on promptly and closed out.
- Check 5 of 5What an auditor asks for
Ask for
how the organisation defines an 'unauthorised' online service versus an approved one.
Look at
any list of approved platforms or guidance distinguishing the two.
Good evidence
makes the boundary clear enough that staff know what is and is not allowed.
Mappings
Closest match in ISO/IEC 27001: A.6.3, Information security awareness, education and training program, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.6.3.
ISM-2104 provides a specific piece of security guidance: do not post security clearance and briefing details online and report if it occurs. ISO/IEC 27001:2022 Annex A 6.3 requires a broader information security awareness, education and training program, under which ISM-2104 would typically be delivered as a topic-specific rule (e.g. OPSEC and acceptable online conduct). ISM-2104 is therefore a specific training/awareness requirement within the wider Annex A 6.3 program scope.
This control partially overlaps A.5.10.
ISM-2104 requires personnel not to post security clearance and briefing details on unauthorised online services and to report when this occurs. ISO/IEC 27001:2022 Annex A 5.10 requires acceptable use rules and handling procedures for information and associated assets, which would commonly include restrictions on publishing sensitive organisational/personnel information to public or unauthorised platforms. ISM-2104 is narrower and explicitly about security clearance/briefing details, while Annex A 5.10 is broader across many information types and asset-handling situations.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.