Australian Signals Directorate Information Security Manual (ASD ISM) Compliance

Overview

The ASD ISM is the most comprehensive cybersecurity guidance document published by the Australian Government. It contains hundreds of controls organised into chapters covering cybersecurity principles, governance, physical security, personnel security, communications security, and information technology security. Each control specifies the classification level at which it applies.

Controls are prioritised as essential, should, or could. Essential controls must be implemented for all systems. Should controls are recommended and must be implemented unless a risk-based justification for non-implementation is documented and accepted. Could controls provide additional security and are implemented based on available resources and risk appetite.

The ISM is closely integrated with other Australian Government security frameworks. It underpins IRAP assessments, aligns with the Essential Eight mitigation strategies, and supports the Protective Security Policy Framework. Together, these frameworks form a cohesive security ecosystem for government information and systems.

Regular updates ensure the ISM remains relevant to the current threat environment. Each update may add, modify, or remove controls based on ASD's threat intelligence and operational experience. Organisations must monitor these updates and assess their impact on their system security plans.

Key Areas

• Cyber security governance including roles, responsibilities, and risk management
• Personnel security, including security clearances and access management
• Physical security for ICT equipment and facilities
• Communications infrastructure security
• Enterprise mobility and remote access security
• System hardening for operating systems, applications, and databases
• Network security including gateways, firewalls, and segmentation
• Cryptographic controls and key management
• Cross-domain solutions and data transfer controls
• ICT supply chain security

Who It's For

• Australian Government departments and agencies
• Defence industry participants and contractors requiring DISP membership
• Cloud service providers seeking government certification
• Organisations that process, store, or transmit Australian Government information

Core Requirements

Policies and Governance

Organisations must appoint a Chief Information Security Officer (CISO) or equivalent, develop and maintain a cybersecurity policy, and establish a governance framework that aligns security activities with organisational risk. Regular reporting to senior management is required.

Risk Management

A system-specific risk assessment must be conducted for each ICT system, identifying threats, vulnerabilities, and the potential impact of compromise. Risk treatments must be documented in a system security plan, and residual risks must be formally accepted by an authorised authority.

Security Controls

Controls span the full ISM chapter structure and must be implemented based on the classification level of the information being processed. Essential controls are mandatory; should and could controls are implemented based on risk assessment and available resources.

Incident Response

Organisations must establish procedures for detecting, reporting, and responding to cybersecurity incidents. Incidents must be reported to the ACSC in accordance with reporting requirements. Lessons learned must feed back into the control environment.

Evidence and Reporting

System security plans, risk assessments, IRAP assessment reports, and ongoing monitoring records constitute the evidence base. Organisations must maintain documentation that supports ongoing compliance and facilitates periodic reassessment.

Implementation Steps

1. Scope and objectives - Identify the systems and information assets in scope for ISM compliance. Determine the classification level of information being handled and the applicable control set. Establish a system security plan that documents the security architecture and control implementation approach.
2. Gap assessment - Assess current security controls against the applicable ISM controls for the relevant classification level. Identify gaps in governance, technical controls, physical security, personnel security, and operational procedures. Prioritise essential controls.
3. Control implementation - Implement controls to address identified gaps, starting with essential controls. Configure systems in accordance with ISM hardening guidance. Establish operational procedures for access management, patching, monitoring, and incident response.
4. Evidence and documentation - Document the system security plan, risk assessment, control implementation evidence, and operational procedures. Prepare documentation for IRAP assessment if required. Maintain records of security-relevant changes and incidents.
5. Review and continuous improvement - Monitor compliance with implemented controls on an ongoing basis. Review and update the system security plan when the ISM is updated, the threat environment changes, or system modifications are made. Schedule periodic IRAP reassessments.

Frequently Asked Questions

Who must comply with the ASD ISM?

Australian Government agencies and organisations that handle government information are required to comply. Defence industry participants and government cloud service providers must also demonstrate compliance through IRAP assessments.

How often is the ISM updated?

The ISM is typically updated monthly by the ASD to reflect current threat intelligence, emerging technologies, and changes in best practice.

What is an IRAP assessment?

An Information Security Registered Assessors Program (IRAP) assessment is an independent evaluation of an organisation's security posture against the ISM, conducted by an ASD-endorsed assessor.

How does the ISM relate to the Essential Eight?

The Essential Eight is a subset of ISM controls. The ISM provides the comprehensive control set, while the Essential Eight focuses on the eight highest-priority mitigation strategies.

What classification levels does the ISM cover?

The ISM provides controls for OFFICIAL, PROTECTED, SECRET, and TOP SECRET classification levels. Higher classification levels require more stringent controls.

Is ISM compliance sufficient for international requirements?

The ISM is designed for Australian Government requirements. Organisations with international obligations may need to demonstrate compliance with additional frameworks such as ISO 27001 or NIST 800-53.

What are essential controls in the ISM?

Essential controls are the highest-priority controls that must be implemented. They address the most significant security risks and are mandatory for all systems regardless of classification level.

Why It Matters

• The ISM provides the most detailed and authoritative cybersecurity guidance available for Australian Government systems. It translates strategic security policy into actionable technical and procedural controls that organisations can implement to protect classified and sensitive information.
• For organisations that process or store Australian Government information, compliance with the ISM is not optional. Defence industry participants, cloud service providers seeking government certification, and government contractors must demonstrate compliance through IRAP assessments conducted by qualified assessors.
• Beyond government use, the ISM serves as a valuable reference for any organisation seeking comprehensive cybersecurity guidance. Its regular updates ensure that controls reflect current threats, making it a living document that evolves with the landscape.

Common Challenges

• Keeping pace with the frequent update cycle of the ISM, which is typically updated monthly
• Implementing the full control set for higher classification levels, which can be resource-intensive
• Managing legacy systems that cannot meet modern ISM control requirements without significant investment
• Sourcing IRAP assessors for timely assessments, particularly during peak assessment periods
• Balancing security requirements with operational usability, particularly for user-facing controls
• Maintaining compliance evidence across complex multi-system environments
• Coordinating ISM compliance with related frameworks including the Essential Eight and PSPF