← VCE Cyber Security

ISM guideline: network access controls

A rule that tells organisations to only give people access to the parts of the network they actually need, after checking who they are.

Part of: VCE Applied Computing - U2O2 - Cyber Security — Module 60, 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 22, ACARA Digital Technologies Years 9–10 — Networked Systems and Access Control — Module 131, WA Computer Science ATAR Year 11 — Network Communications — Module 134, WA Computer Science ATAR Year 11 — Cyber Security — Module 115

Understanding ISM guideline: network access controls in VCE Cyber Security

What it does: Starting from denied by default means access must be deliberately approved rather than assumed. Regular reviews help spot access that should have been removed already. Giving only necessary access limits what an attacker could reach if an account was compromised. Checking identity first helps stop unauthorised users from connecting. A rule that tells organisations to only give people access to the parts of the network they actually need, after checking who they are.

Common mistakes: Line 1 says to give access to everything, but access should only be given to what someone actually needs. Line 2 says to never check who is connecting, but the guideline requires checking who is trying to connect.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add ISM guideline: network access controls to a class →

This module's key terms are also in a printable crossword (Modules 51–60) and word search (Modules 41–74).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Should access only be given to what someone actually needs?
YesNo
Matches
Allowing everyone full access to everything
↓
This breaks the guideline - access should be based on need
Applying
Meanings
Term
ISM access controls guideline
Meaning
A rule that tells organisations to only give people access to the parts of the network they actually need, after checking who they are.
Practice
identity_checked = True
Testing
Gaps
Only give access to what is .
Check Answer
Spots
1Give access to everything
2Give access to what is needed

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Ostrich' badge — Full Sprint, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Should access only be given to what someone actually needs?
A. Yes ✓
B. No
Giving only necessary access limits what an attacker could reach if an account was compromised.
2. Should the network check who is trying to connect before letting them in?
A. Yes ✓
B. No
Checking identity first helps stop unauthorised users from connecting.
3. Should access be allowed by default unless it's denied?
A. Yes
B. No ✓
Access should be denied by default, only allowed once it's specifically approved.
4. Should access be reviewed regularly?
A. Yes ✓
B. No
Regular reviews catch outdated or unnecessary access before it becomes a risk.
5. Should access be removed once someone no longer needs it?
A. No
B. Yes ✓
Removing unused access reduces the number of ways an attacker could get in.

Match the Pairs

Check who is trying to connect → Confirms someone's identity before granting access
Give access based on need → Limits what someone can reach on the network
Access should be denied by default → Nothing is allowed unless it's specifically approved
Access should be reviewed regularly → Catches outdated or unnecessary access over time
Allowing everyone full access to everything → This breaks the guideline - access should be based on need
Never removing access once granted → This leaves unnecessary risk - unused access should be removed

Key Term

ISM access controls guideline
A rule that tells organisations to only give people access to the parts of the network they actually need, after checking who they are.

Fill in the Blanks

1. Only give access to what is needed.
Hint: Type the word for how much access someone should be given - just what they actually require.
2. Always check who is trying to connect.
Hint: Type the word for confirming someone's identity before letting them connect.
3. Access should be denied by default unless approved.
Hint: Type the word for the automatic starting state before any access is approved.
4. Access should be reviewed regularly.
Hint: Type the word for how often access should be checked over time.
5. Access should be removed when no longer needed.
Hint: Type the word for what should happen to access once someone no longer needs it.

Spot the Error

Question 1
A Give access to everything
B Give access to what is needed
C Check who is connecting
Line A — Line 1 says to give access to everything, but access should only be given to what someone actually needs.
Question 2
A Check who is connecting
B Never check who is connecting
C Give access based on need
Line B — Line 2 says to never check who is connecting, but the guideline requires checking who is trying to connect.
Question 3
A Approve access individually
B Deny access by default
C Allow access by default
Line C — Line 3 says to allow access by default, but access should be denied by default unless it's approved.
Question 4
A Review access regularly
B Never review access again
C Check who is connecting
Line B — Line 2 says to never review access again, but access should be reviewed regularly.
Question 5
A Remove access when not needed
B Keep unused access forever
C Give access based on need
Line B — Line 2 says to keep unused access forever, but access should be removed when it's no longer needed.

Student with a class code? Join your class →