ASD ISM 2107 Restrict personal information viewing online
What it says
Personnel are encouraged to use any available privacy settings to restrict who can view personal information they post on online services.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEncourage personnel to apply the privacy settings available on online services so they control who can view the personal information they post.
This control asks your organisation to encourage staff to lock down the privacy settings on the online services they use personally, so that not just anyone can see the personal details they post. It is an awareness measure, not a hard technical rule: the organisation cannot configure someone's personal social media account, so the goal is to make people aware of the settings and motivate them to use them. The reason it matters is that personal details staff share publicly (job title, employer, location, travel, relationships) are exactly what an attacker harvests to craft a convincing spear-phishing message or impersonation aimed at your organisation.
Free. Save your status, tasks and notes.
Why it matters
If personnel are not encouraged to restrict who sees their posts, they over-share personal details (role, employer, projects, location, schedule, contacts) on public profiles, handing attackers the raw material to research staff and craft targeted social engineering and spear-phishing against the organisation, as well as convincing impersonation of colleagues.
How to implement
Add a section to your cyber security awareness training that encourages personnel to restrict who can view the personal information they post, and tie it directly to how over-sharing fuels spear-phishing of the organisation.
Produce a short, plain-English quick-reference that walks staff through finding and tightening the audience/visibility settings on the platforms they most use (for example LinkedIn, Facebook, Instagram, X), with the exact menu paths.
Give staff a concrete list of details worth keeping private or limited (employer, exact role, work location, travel plans, project names, reporting line, work email and phone) so the encouragement is specific rather than vague.
Send periodic reminders through your normal awareness channels (intranet, newsletter, all-staff email) prompting personnel to review and update who can see their posts.
Refresh the guidance whenever a major platform changes its privacy controls or default visibility, and republish the quick-reference so the steps stay accurate.
Provide tailored, opt-in encouragement for higher-exposure personnel such as executives and public-facing staff, since their personal details are the most valuable to attackers.
Keep it running
Because this is an encouragement control, keep the guidance current and easy to act on rather than treating it as a one-off rule: online services change their privacy controls and default visibility frequently, so refresh the advice when major platforms (for example LinkedIn, Facebook, Instagram, X) alter their settings. Fold the message into existing cyber security awareness activity and reinforce it for higher-risk staff such as executives and those whose roles are publicly identifiable. Frame it around the specific over-sharing that aids attackers (employer, role, work location, travel, who they report to) rather than vague "be careful online" wording. Respect that these are personal accounts, so the organisation guides and reminds but does not mandate or audit individual settings.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request the cyber security awareness material (training content, intranet pages or briefing notes) that covers personal information posted on online services.
Look at
Check whether the material explicitly encourages personnel to use available privacy settings to restrict who can view the personal information they post, and whether it maps to the wording of the control.
Good evidence
The material contains a clear statement encouraging staff to apply privacy settings to limit who can see their personal information online, in terms that match the control.
- Check 2 of 5What an auditor asks for
Ask for
Request the platform-specific guidance for the online services staff commonly use, together with its change log or revision dates.
Look at
Check that the guidance actually shows how to reach and apply the visibility and privacy controls on each service rather than just saying 'use privacy settings', and compare the revision dates against recent privacy-setting changes on major online services.
Good evidence
Step-by-step instructions exist for the common services, and the change log shows the guidance has been updated after those services changed their privacy settings.
- Check 3 of 5What an auditor asks for
Ask for
Request delivery records for the awareness material, such as training completion reports, distribution lists or intranet publication records.
Look at
Check that the records cover the relevant population and show the encouragement has actually reached personnel.
Good evidence
Records show the material was delivered to the intended personnel, with completion or distribution evidence covering the relevant population.
- Check 4 of 5What an auditor asks for
Ask for
Request the messaging used in the awareness material and ask for a walkthrough of how it explains the risk of over-sharing.
Look at
Check that the messaging connects over-sharing of personal details to the organisational risk of social engineering and spear-phishing, so it targets the details attackers exploit.
Good evidence
The messaging explains that personal details posted online can be used for social engineering and spear-phishing, and encourages staff to restrict visibility of those details.
- Check 5 of 5What an auditor asks for
Ask for
Request the policy or procedure that implements this control and ask how the organisation treats staff personal accounts.
Look at
Check that the control is treated as encouragement to use privacy settings on personal accounts and has not been overstated into mandatory enforcement or monitoring of staff personal profiles.
Good evidence
The policy frames the control as encouragement and guidance for personal accounts, with no requirement for enforcement or monitoring of staff personal profiles.
Mappings
Closest match in ISO/IEC 27001: A.6.3, Information security awareness, education and training program, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.6.3.
ISM-2107 encourages personnel to actively configure privacy settings on online services to restrict who can view personal information they post, reducing personal data exposure that can enable social engineering or targeting. ISO/IEC 27001:2022 Annex A 6.3 requires an organisation to run an information security awareness, education and training program that can explicitly include OPSEC/social media safety content (e.g., how to use platform privacy controls, why oversharing increases spear‑phishing risk, and what "public" visibility means). In practice, Annex A 6.3 is the auditable organisational mechanism used to communicate, train, and refresh the specific ISM-2107 behaviour; however, Annex A 6.3 does not itself mandate this particular privacy-setting action, while ISM-2107 does.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.