ASD ISM 2105 Advise staff to limit posting work information on unauthorised online services
What it says
Personnel are advised to limit posting information about their work-related duties on unauthorised online services, and to report cases where such information is posted.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishStaff are told to limit posting information about their work duties on unauthorised online services and to report any cases where such information is posted.
This control is about getting your people to be careful what they say about their job on websites, apps and social media that your organisation has not approved (called unauthorised online services). Details about your work, projects or systems can be pieced together by criminals or competitors to target your organisation. So staff should keep work information off these services, and tell someone if they spot work information that has been posted.
Free. Save your status, tasks and notes.
Why it matters
If staff freely post work details on unapproved sites, attackers can harvest those details to impersonate people, craft convincing scams, or target the organisation's systems.
How to implement
The owner or manager writes a short, plain-English rule stating that staff must not post information about their work duties on online services the organisation has not approved, and lists common examples such as social media, forums and personal blogs.
The person running staff induction explains the rule to every new starter and to existing staff at least once a year, using real examples of what is and is not safe to post about their job.
Whoever handles staff communications sets up a simple, well-known way to report posted work information (for example one email address or a contact person) and tells everyone how to use it.
A nominated person keeps a brief record of any reports received, what work information was posted and where, and what was done to have it removed or contained.
The manager periodically reminds staff of the rule, especially before and during high-risk periods such as a major project, a tender, or a public announcement, so the message stays front of mind.
Keep it running
Keep the advice and reporting route fresh by repeating it at least yearly and before high-exposure events, and review reported cases to spot recurring oversharing habits.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
to see the written guidance or policy that advises staff to limit posting work-related information on unauthorised online services.
Look at
whether it clearly names the behaviour expected and gives examples.
Good evidence
is a current, signed-off document that staff can easily find and understand.
- Check 2 of 5What an auditor asks for
Ask for
how and when staff are made aware of this advice.
Look at
induction materials, training slides or intranet notices and their dates.
Good evidence
shows the advice is delivered at onboarding and refreshed regularly, with records of who received it.
- Check 3 of 5What an auditor asks for
Ask for
what the reporting process is when work information is found posted online.
Look at
the named contact, email address or form used to report it.
Good evidence
is a single, simple route that every staff member can describe without hesitation.
- Check 4 of 5What an auditor asks for
Ask for
the log or record of reported cases over the last 12 months.
Look at
whether reports were captured, assessed and acted on.
Good evidence
shows entries with dates, what was posted, and the follow-up action taken (even if the answer is 'no reports', staff can still explain how they would report).
- Check 5 of 5What an auditor asks for
Ask for
staff directly what they would do if they saw a colleague post details about a current project online.
Look at
whether their answer matches the policy.
Good evidence
is that they know not to post such information themselves and know exactly who to tell.
Mappings
Closest match in ISO/IEC 27001: A.5.1, Policies for information security, which this control partially meets.
ISO/IEC 27001: 5 mappings
This control partially meets A.5.1.
ISM-2105 requires a specific piece of personnel guidance about not posting work-duty information on unauthorised services and reporting occurrences. ISO/IEC 27001:2022 Annex A 5.1 requires information security policies (including topic-specific policies) to be defined, communicated and acknowledged. ISM-2105 is a concrete topic-specific policy message that would typically sit under and be communicated via the broader policy framework required by Annex A 5.1.
This control partially meets A.5.4.
ISM-2105 requires that personnel are advised about specific secure behaviour regarding posting work information to unauthorised online services and reporting it. ISO/IEC 27001:2022 Annex A 5.4 requires management to ensure personnel apply information security in accordance with established policies and procedures. ISM-2105 is one specific behaviour expectation that management would enforce under Annex A 5.4, while Annex A 5.4 is broader and not limited to online posting or reporting.
This control partially meets A.5.10.
ISM-2105 requires personnel to limit posting information about their work-related duties on unauthorised online services and to report when it occurs. ISO/IEC 27001:2022 Annex A 5.10 requires acceptable use rules and handling procedures for information and associated assets to be identified, documented and implemented. ISM-2105 is a specific acceptable-use/handling rule focused on public/online posting behaviour, while Annex A 5.10 is broader and would cover many other acceptable-use scenarios and assets.
This control partially meets A.6.3.
ISM-2105 requires personnel to be advised to limit posting work-related duties on unauthorised online services and to report cases where such information is posted. ISO/IEC 27001:2022 Annex A 6.3 requires an organisation-wide security awareness, education and training program that provides role-relevant guidance and updates to personnel. ISM-2105 is a specific awareness message and expected behaviour that would typically be delivered through the broader training and awareness program required by Annex A 6.3.
This control partially overlaps A.6.8.
ISM-2105 requires personnel to report cases where work-related duty information is posted on unauthorised online services. ISO/IEC 27001:2022 Annex A 6.8 requires the organisation to provide mechanisms and defined channels for reporting information security events and suspected weaknesses promptly. They overlap on the reporting expectation (ISM-2105) and the organisational reporting channel capability (Annex A 6.8), but ISM-2105 also focuses on discouraging oversharing online, which Annex A 6.8 does not address.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.