ASD ISM 0142 Report cryptographic equipment compromises promptly
What it says
The compromise or suspected compromise of cryptographic equipment or associated keying material is reported to the chief information security officer, or one of their delegates, as soon as possible after it occurs.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishNotify security officers quickly if cryptographic equipment or keys might be compromised.
This control is about reporting immediately if you think the devices or codes that protect your organisation's electronic information might have been compromised. This matters because if a malicious actor gains access to your secure communications or data, they could steal sensitive information, causing significant harm to your business's reputation and operations.
Free. Save your status, tasks and notes.
Why it matters
Failure to promptly report compromised cryptographic equipment or keying material can allow continued exposure of protected data and unauthorised access.
How to implement
Business owners should educate all staff on recognising the signs of compromised cryptographic equipment or keys, such as unexpected malfunctions or unauthorised access alerts.
This can be done through regular training sessions where employees learn what to watch for and how to report it promptly.
The IT manager should establish a clear communication channel that all staff can use to report potential compromises.
This might involve setting up a dedicated email address or phone line and ensuring that all staff know how to use these channels.
The chief information security officer (CISO) or their delegate should ensure that any reported compromise is logged immediately.
This could be done using a standard incident log template that captures essential details like the time of report, nature of the suspected compromise, and any initial actions taken.
Managers should work with their teams to conduct regular reviews of any cryptographic equipment to ensure it is functioning correctly and not showing signs of compromise.
This can involve routine checks and scheduled maintenance tasks that are documented and shared with the CISO.
In the event of a suspected compromise, the CISO should have an action plan that outlines the immediate steps to take.
This plan might include isolating affected equipment, conducting a preliminary assessment, and planning communication to affected parties.
Keep it running
Train staff to recognise crypto equipment/key compromise indicators and report immediately to the CISO (or delegate) using defined incident channels.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The incident log of reported cryptographic compromises: Check to see that the log includes dates, details of the suspected compromise, and actions taken.
Good evidence
Clearly shows regular and prompt entries with specific follow-up actions recorded.
- Check 2 of 5What an auditor asks for
Look at
Emails or phone call logs to ensure employees have used these channels to report compromises.
Good evidence
Is evidence that these records are maintained and demonstrable reports have been made.
- Check 3 of 5What an auditor asks for
Ask for
Them to describe how they handle suspected compromises.
Good evidence
Is a clear and consistent process where staff know whom to contact and the CISO can explain the subsequent steps taken.
- Check 4 of 5What an auditor asks for
Good evidence
Session includes interactive elements and practical examples that help staff understand what to do in real situations.
- Check 5 of 5What an auditor asks for
Good evidence
Is evidence of ongoing maintenance with a record of any identified issues and their resolution.
Mappings
Closest match in ISO/IEC 27001: A.6.8, Mechanisms for reporting security events, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.6.8.
ISM-0142 requires organisations to report compromise or suspected compromise of cryptographic equipment or keying material to the CISO (or delegate) as soon as possible. Annex A 6.8 requires mechanisms and defined channels for personnel and relevant parties to report security events and suspected weaknesses promptly, which would cover cryptographic compromise suspicions among many other reportable events. ISM-0142 is a specific reporting trigger and recipient within the broader ISO reporting-mechanism requirement.
This control partially overlaps A.8.24.
Annex A 8.24 requires rules for cryptography use and key management, including handling events that may impact key/material confidentiality and integrity. ISM-0142 overlaps by mandating prompt reporting of compromise or suspected compromise of cryptographic equipment or associated keying material, which is a key-management incident handling requirement. ISM-0142 is focused on escalation/reporting, whereas Annex A 8.24 is broader and should also cover preventive controls, lifecycle management and governance of cryptographic use.
ASD Essential Eight: 6 mappings
This control partially meets E8-AC-ML2.9.
E8-AC-ML2.9 requires all cyber security incidents to be reported to the CISO (or delegate) as soon as possible. ISM-0142 requires prompt reporting to the CISO (or delegate) specifically for compromise or suspected compromise of cryptographic equipment or keying material. ISM-0142 is a specific incident subtype within the broader reporting obligation described by E8-AC-ML2.9.
- E8-MF-ML2.10Report cyber security incidents to the Chief Information Security Officer promptlyPartially meets
This control partially meets E8-MF-ML2.10.
ISM-0142 requires organisations to report the compromise or suspected compromise of cryptographic equipment or associated keying material to the CISO (or delegate) as soon as possible. E8-MF-ML2.10 similarly mandates prompt reporting of cyber security incidents to the CISO, which would include incidents involving compromised cryptographic devices or keys. The Essential Eight control is broader because it covers all cyber security incidents, not specifically cryptographic compromises.
This control partially meets E8-RA-ML2.11.
ISM-0142 requires organisations to report the compromise or suspected compromise of cryptographic equipment or associated keying material to the CISO (or delegate) as soon as possible. E8-RA-ML2.11 requires prompt reporting of cyber security incidents to the CISO, which would encompass cryptographic compromises when they arise as incidents. ISM-0142 is more specific in scope (crypto equipment/keying material), while the candidate is organisation-wide for incidents generally.
This control partially overlaps E8-AC-ML2.10.
ISM-0142 requires organisations to report compromise or suspected compromise of cryptographic equipment or associated keying material to the CISO (or delegate) as soon as possible. E8-AC-ML2.10 requires reporting cyber security incidents to ASD promptly, which may be triggered by the same crypto-compromise events that ISM-0142 targets. They overlap on prompt incident notification for crypto-related incidents, but differ in recipient (CISO vs ASD) and scope (crypto-specific vs any cyber incident).
This control partially overlaps E8-AH-ML2.16.
E8-AH-ML2.16 requires cyber security incidents to be reported to the CISO (or delegate) as soon as possible after occurrence or discovery. ISM-0142 requires reporting to the CISO (or delegate) as soon as possible, but only for compromise or suspected compromise of cryptographic equipment or keying material. ISM-0142 is narrower in incident type, while E8-AH-ML2.16 is broader across cyber security incidents generally.
This control partially overlaps E8-MF-ML2.11.
E8-MF-ML2.11 requires cyber security incidents to be reported to ASD as soon as possible after they occur or are discovered. ISM-0142 overlaps by mandating rapid reporting of compromises of cryptographic equipment/keying material to the CISO (or delegate), which is a type of incident that may also trigger ASD reporting. ISM-0142 is narrower in incident type and is internal-reporting focused, whereas E8-MF-ML2.11 is external reporting to ASD for incidents more generally.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.