Foreign nationals, including seconded foreign nationals, do not have access to systems that process, store or communicate AUSTEO or REL data unless effective controls are in place to ensure such data is not accessible to them.
Topic
Unprivileged access to systems by foreign nationals
Applicable to
Secret, Top Secret
History
Priority
must not
Jun 2022
Foreign nationals, including seconded foreign nationals, do not have access to systems that process, store or communicate AUSTEO or REL data unless effective controls are in place to ensure such data is not accessible to them.
Miscellaneous changes were made to rationale and recommendations throughout the publication to clarify content. This included the adoption of ‘control’ terminology, in preference to ‘security control’ terminology, to allow for the capture of other types of controls in the future, such as privacy controls, in addition to security controls.
In addition, formatting changes were made to the system security plan annex template and the cloud controls matrix template in order to increase their alignment, such as the inclusion of an ‘implementation status’ column within the system security plan annex template. Furthermore, a new ‘responsible entity’ column was added to both templates in order to capture information on the responsible system (in the case of inherited controls) or responsible vendor (in the case of multi-vendor systems) that are responsible for the implementation of controls. Note, this column can also be used to capture information on teams or individuals that are responsible for the implementation of controls if desired.
Sep 2020
Foreign nationals, including seconded foreign nationals, do not have access to systems that process, store or communicate AUSTEO or REL information unless effective security controls are in place to ensure such information is not accessible to them.
Security control 0409 was amended to include REL information.
Aug 2020
Foreign nationals, including seconded foreign nationals, do not have access to systems that process, store or communicate AUSTEO information unless effective security controls are in place to ensure such information is not accessible to them.
Aug 2019
Foreign nationals, including seconded foreign nationals, do not have access to systems that process, store or communicate AUSTEO information unless effective security controls are in place to ensure such information is not accessible to them.
Security control 0409 was modified to ensure consistency with similar controls that focus on effective security controls being in place.
Jul 2019
Foreign nationals, including seconded foreign nationals, do not have access to systems that process, store or communicate AUSTEO information unless effective controls and procedures are in place to ensure such information is not accessible to them.
2015
Foreign nationals, including seconded foreign nationals, must not have access to systems thatprocess, store or communicate AUSTEO information unless effective controls and proceduresare in place to ensure AUSTEO information is not accessible to them.
2010
Agencies must not allow foreign nationals, including seconded foreign nationals, to have access to systemsthat process, store or communicate AUSTEO information unless effective controls and procedures are inplace to ensure AUSTEO information is not passed to, or made accessible by, foreign nationals, includingseconded foreign nationals.
2008
Agencies must not allow foreign nationals to have access to systems that process, store or communicate unprotected Australian Eyes Only (AUSTEO) information.