Personnel security

search account_circle

policyASD ISM

Guidelines for personnel security

57 controls in this part of theACSC ISM. Each control links to plain-English guidance, audit tips and cross-framework mappings.

Access to systems and their resources

Australian Supervision of AUSTEO/AGAO Data Systems

Only Australian nationals should control systems handling sensitive Australian data.

Establish and Maintain a Web Usage Policy

Develop and maintain a policy to manage how the web is used and accessed.

Validation for Unprivileged System Access Requests

Requests for basic system access are checked when they are first made.

Maintain Secure User Access Records

Keep a secure record of who accessed the system, who authorised it, and details of their access leve

Restrict Foreign Nationals' Access to Sensitive Data

Foreign nationals can't access certain sensitive data unless security measures prevent it.

Restrict System Access for Foreign Nationals

Foreign nationals need strict controls to access systems handling AGAO data.

Ensure Unique Identification for System Access

People accessing systems must have unique identifiers to ensure accountability.

Strict Control of Shared User Accounts

Ensure shared user accounts are used carefully, with each user clearly identified to maintain securi

Identify Nationality of Foreign Personnel in System

Ensure foreign nationals using the system are identified by their nationality for sensitive data sec

Immediate Suspension of Unneeded System Access

Revoke system access for individuals as soon as it's no longer needed.

Document System Access Requirements in Security Plans

System access rules must be documented in each system's security plan to ensure proper access manage

Ensure Personnel Employment Screening and Security Clearance

Staff need job screening and security clearance for system access.

Pre-Access Briefings for System Resources

Staff must be briefed before accessing system resources.

Ensuring Limited Access for Temporary System Use

When given temporary system access, personnel can only see data needed for their job.

Restrict Temporary Access to Secure Systems

Temporary access is not allowed for systems handling highly sensitive information.

Dedicated Accounts for Privileged User Activities

Privileged users must have separate accounts for administrative tasks to enhance security.

Restrict Privileged Access for Foreign Nationals

Foreign nationals can't access Australian systems with sensitive data privileges.

Restrict Privileged Access for Foreign Nationals

Foreign nationals can't have privileged access to systems handling AGAO data except if seconded.

Access Restrictions for AUSTEO and AGAO Data

AUSTEO and AGAO data is only accessible via government-controlled systems within authorised faciliti

Restrict Privileged Users from Internet Access

Privileged accounts can't access the internet or web services unless explicitly allowed.

Enforce Unique Accounts for Server Administration

Administrators must use unique accounts to manage each server application.

Disabling Inactive User Access After 45 Days

If a user doesn't use their system access for 45 days, it's disabled to keep the system secure.

Ensure Requests for Privileged Access are Verified

Requests for special system access are checked before approval to prevent unauthorized use.

Limit Privileged Access to Essential Duties Only

Only grant system privileges necessary for users to perform their job roles.

Log Privileged Access Events Centrally for Monitoring

Keep records of high-level system access in one place to monitor and respond to potential issues.

Central Logging of Unprivileged System Access

System logs keep track of unprivileged user actions to monitor access and security.

Ensure Contractors are Identified as Users

Ensure contractors are labelled distinctively from other personnel in systems.

Suspend User Access for Malicious Activity

Remove or pause access immediately if someone is found doing harmful activities on the system.

Document and Test Emergency System Access Procedures

Ensure emergency access to IT systems is documented and tested during major IT changes.

Use Break Glass Accounts Only in Emergencies

Break glass accounts should be used only if normal login methods fail.

Restricted Use of Break Glass Accounts for Emergencies

Use special accounts only for approved emergency activities to maintain system security.

Central Logging of Break Glass Account Usage

Logging is used to track and monitor the use of emergency access accounts.

Manage Emergency Account Access Changes

Change break glass account passwords after emergency access.

Testing Break Glass Accounts Post Credential Change

Ensure emergency accounts work properly after changing their passwords.

Disable Privileged Access After 12 Months

Privileged system access is disabled if not revalidated within a year.

Disabling Inactive Privileged Access to Systems

Access with special privileges is disabled if not used for 45 days to enhance system security.

Implement Just-in-Time Administration for System Access

Use just-in-time methods to manage who can access system resources, ensuring enhanced security.

Log Management of Privileged User Activities

Keep track of changes to privileged user accounts by logging them in one central place.

Limit Unprivileged Access to Essential Functions

Users can only access what they need to do their work, nothing extra.

Develop and Enforce a System Usage Policy

Create and regularly update a policy that dictates how systems should be used within the organisatio

Compliance with System Usage Policies for Access

Employees must agree to follow system rules before they can access it.

Restrict Privileged Access to Necessary Service Duties

Only necessary access is allowed for users to perform their duties online.

Access to Systems and Their Resources

Develop and Maintain AI Usage Policy

Organisations must create and update policies for using AI systems.

Cyber security awareness training

Annual Cyber Security Awareness for Personnel

All staff receive yearly training on using and protecting systems, and reporting incidents.

Reporting Suspicious Online Contact Awareness

Staff learn to recognise and report suspicious online contact.

Avoid Using Unauthorised Online File Services

Staff should not use online services for files unless approved to avoid security risks.

Annual Training for Privileged Users

Privileged users receive yearly customised cyber security training.

Develop and Maintain Cyber Security Training Register

Maintain a record of all cyber security awareness training activities within an organisation.

Training on Managing Social Engineering Threats

Staff handling user accounts learn to identify and handle social engineering threats.

Cyber Security Awareness Training

Avoid Posting Work Data on Unauthorised Online Services

Staff should not share work info on unauthorised sites and must report if such info is found online.

Advise on Risks of Posting Personal Information Online

Employees should be aware of the dangers of posting their personal info on the internet.

Separate Personal and Work Accounts for Online Services

Keep your personal and work user accounts separate when using online services.

Manage and Report Business Email Compromise

Employees should know about email fraud in banking and how to manage and report it.

Do Not Post Security Clearance and Briefing Details Online

Staff are told not to post their security clearance or briefing details on unapproved online service

Advise Staff to Limit Posting Work Information on Unauthorised Online Services

Staff are told to limit posting information about their work duties on unauthorised online services

Advise Staff to Limit Posting Work Skills Online

Advise staff to limit posting their work-related skills and experience on unauthorised online servic

Restrict Personal Information Viewing Online

Encourage personnel to apply the privacy settings available on online services so they control who c

Back to the full ASD ISM control list, or browse the complete control library.