ISM control lookup / Topic

Guidelines for personnel security

17 controls · September 2026 edition

• ISM-0252 · Providing cyber security awareness training

  Cyber security awareness training is undertaken annually by all personnel and covers:

• ISM-0258 · Web usage policy

  A web usage policy is developed, implemented and maintained.

• ISM-0817 · Reporting suspicious contact via online services

  Personnel are advised of what suspicious contact via online services is and how to report it.

• ISM-0820 · Posting work-related information on online services

  Personnel are advised not to post work-related information on unauthorised online services, and to report cases where such information is posted.

• ISM-0821 · Posting personal information on online services

  Personnel are advised of security risks associated with posting personal information on online services.

• ISM-0824 · Sending and receiving files via online services

  Personnel are advised not to send or receive files via unauthorised online services.

• ISM-1146 · Posting personal information on online services

  Personnel are advised to maintain separate personal user accounts from any work user accounts they use for online services.

• ISM-1565 · Providing cyber security awareness training

  Tailored privileged user training is undertaken annually by all personnel with privileged access to systems and their resources.

• ISM-1740 · Managing requests to change banking details or transfer funds

  Personnel dealing with banking details and payment requests are advised of what business email compromise is and how to manage and report it.

• ISM-2022 · Providing cyber security awareness training

  A cyber security awareness training register is developed, implemented and maintained.

• ISM-2071 · Managing requests to modify user accounts

  Personnel dealing with user account details are advised of what social engineering attacks are, how to manage such situations and how to report them.

• ISM-2074 · General-purpose artificial intelligence usage policy

  A general-purpose AI usage policy is developed, implemented and maintained.

• ISM-2104 · Posting work-related information on online services

  Personnel are advised not to post information about their security clearance and briefings on unauthorised online services, and to report cases where such information is posted.

• ISM-2105 · Posting work-related information on online services

  Personnel are advised to limit posting information about their work-related duties on unauthorised online services, and to report cases where such information is posted.

• ISM-2106 · Posting work-related information on online services

  Personnel are advised to limit posting information about their work-related skills and experience on unauthorised online services, and to report cases where such information is posted.

• ISM-2107 · Posting personal information on online services

  Personnel are encouraged to use any available privacy settings to restrict who can view personal information they post on online services.

• ISM-2126 · Synthetic impersonation

  Personnel positively identify requestors using a pre-established authentication method or independent trusted communication channel before actioning requests to modify user account details, modify banking details or conduct financial transactions.