ASD ISM 2106 Advise staff to limit posting work skills online
What it says
Personnel are advised to limit posting information about their work-related skills and experience on unauthorised online services, and to report cases where such information is posted.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAdvise staff to limit posting their work-related skills and experience on unauthorised online services, and to report cases where such information is posted.
This control is about telling your staff not to share too much about their work-related skills and experience on online services your organisation has not approved, such as personal social media or job-listing sites. The concern is that attackers study these posts to work out who does what in your organisation and then target them with scams or social engineering. Staff should also let someone know if they spot this kind of information already posted online.
Free. Save your status, tasks and notes.
Why it matters
Over-shared work details on public online services let attackers identify key staff and craft targeted scams or social engineering, increasing the chance of a successful breach.
How to implement
The person responsible for security awareness should add a clear rule to the staff handbook or acceptable use policy stating that personnel must limit how much work-related skill and experience detail they post on online services the organisation has not authorised.
Managers should explain to their teams, in plain terms, why this matters: attackers read public profiles and posts to identify who holds sensitive roles and then craft targeted scams, so over-sharing job details creates a real risk.
Whoever runs staff onboarding should cover this advice when new starters join, giving practical examples such as keeping detailed descriptions of internal systems, projects, or security tools out of public profiles and posts.
The security or IT contact should set up a simple, well-publicised way for staff to report when they find work-related information posted on unauthorised online services, for example an email address or a line in the incident reporting form.
The security awareness lead should reinforce the message periodically through reminders, posters, or short refresher sessions, rather than relying on a single one-off briefing that staff soon forget.
Keep it running
Repeat this advice regularly through onboarding and refreshers, and keep the reporting channel simple and visible so staff actually use it when they spot exposed information.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
to see the policy or guidance that advises personnel to limit posting work-related skills and experience on unauthorised online services.
Look at
whether it is written down and accessible to staff.
Good evidence
is a current policy or handbook section that states this advice clearly and explains why.
- Check 2 of 5What an auditor asks for
Ask for
how staff are made aware of this advice.
Look at
onboarding materials, awareness training content, or reminder communications.
Good evidence
shows the advice is delivered to everyone and repeated over time, not buried in a document no one reads.
- Check 3 of 5What an auditor asks for
Ask for
what process exists for staff to report cases where such information has been posted online.
Look at
the reporting channel, such as an email address, form, or helpdesk option.
Good evidence
is a simple, known route that staff can actually use and point to.
- Check 4 of 5What an auditor asks for
Ask for
examples of reports that have been received and what happened next.
Look at
records showing the report was logged and acted on.
Good evidence
demonstrates the reporting channel is genuinely used and followed up, not just theoretical.
- Check 5 of 5What an auditor asks for
Ask for
how the organisation checks that staff understand the advice.
Look at
training completion records, quiz results, or acknowledgement sign-offs.
Good evidence
shows measurable evidence that personnel have received and accepted the guidance.
Mappings
Closest match in ISO/IEC 27001: A.5.10, Acceptable use policies for information and assets, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.10.
ISM-2106 requires advising staff not to disclose work skills/experience on unauthorised online services and to report when it occurs. ISO/IEC 27001:2022 Annex A 5.10 requires documented and implemented acceptable use rules for handling information and associated assets, which can include rules about what staff may publish externally about their roles. ISM-2106 is a specific acceptable-use/OPSEC behaviour expectation, while Annex A 5.10 is broader and covers acceptable use across many information and asset handling scenarios.
This control partially meets A.6.3.
ISM-2106 requires personnel to be advised to limit posting work-related skills and experience on unauthorised online services and to report instances where such information is posted. ISO/IEC 27001:2022 Annex A 6.3 requires an organisation-wide security awareness, education and training program that would include guidance on safe online behaviour and reporting expectations. ISM-2106 is a specific awareness message focused on online professional/profile disclosure, whereas Annex A 6.3 is broader and covers ongoing awareness across many topics.
This control partially overlaps A.5.26.
ISM-2106 requires staff to report cases where work-related skills and experience are posted on unauthorised online services. ISO/IEC 27001:2022 Annex A 5.26 requires incidents to be responded to in accordance with documented procedures. They overlap where the unauthorised posting is treated as a security incident (or precursor) that must be reported and then handled via incident response, but ISM-2106 is focused on staff behaviour/reporting while Annex A 5.26 is focused on organisational response processes.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.