ISM-0246 policy ASD Information Security Manual (ISM)

Contact ASD for Emanation Security Assessment

System owners ask for an ASD assessment to ensure their facilities are protected from information leaks.

Proactive S TS ASD Information Security ManualGuidelines for physical security secure facilitiesassessmentMarch 2026 ISM Update

record_voice_over

Plain language

This control involves getting an assessment from the Australian Signals Directorate (ASD) to check if your facilities are secure against leaks of sensitive information. It's important because without this check, confidential data could accidentally be broadcasted or leaked, leading to potential data breaches or other security incidents.

01 — Overview

Framework

ASD Information Security Manual (ISM)

Control effect

Proactive

Classifications

S, TS

ISM last updated

Mar 2026

Control Stack last updated

24 Mar 2026

E8 maturity levels

N/A

Guideline

Guidelines for physical security

Section

Emanation security

Topic

Emanation security risk assessments

Official control statement

When an emanation security risk assessment is required, it is sought as early as possible in a system’s life cycle.

policy ASD Information Security Manual (ISM) ISM-0246

priority_high

Why it matters

Without an ASD assessment, facilities could unknowingly leak sensitive information, leading to security breaches and damage to national interests.

settings

Operational notes

Regularly review and update your system inventory and ensure continuous communication with ASD for timely reassessments.

02 — Implement

build

Implementation tips

System owners need to contact the ASD: As soon as they decide to deploy systems handling sensitive data, they should reach out for advice and assessment. Use the official communication channels listed on the ASD website to initiate contact.
Identify systems needing assessment: System owners must compile a list of all SECRET or TOP SECRET systems in fixed locations. Gather relevant details like where they're housed and what data they handle to provide ASD with necessary context.
Schedule the assessment: Once contact is made, work with the ASD to arrange a convenient time for their experts to conduct the assessment. Ensure all security personnel are available on the agreed day to assist the ASD team.
Prepare relevant documentation: System owners should have all records and documentation about their systems readily available. This includes system diagrams, data flow charts, and security policies to facilitate a thorough and efficient assessment.
Implement ASD recommendations: After receiving the assessment report, the same team should prioritise and implement any changes or enhancements recommended by the ASD. This might involve software updates, physical adjustments, or policy changes.

03 — Audit

fact_check

Audit / evidence tips

Askthe contact record with ASD: Request evidence of communication with ASD, such as emails or meeting minutes Look atdetails on what was discussed and confirmation of assessment scheduling Goodincludes clear communication records outlining the planned assessment dates
Aska list of systems assessed: Check for a documented list of systems that were flagged for requiring an ASD assessment Look atcompleteness and correctness in terms of system classifications and locations Goodlist should cover all SECRET or TOP SECRET systems in fixed facilities
Askassessment reports: Request the reports generated by the ASD after their assessment Look atthe findings and the recommendations provided Goodreport includes a clear description of potential security issues and tailored recommendations
Askimplementation records: Check if the recommendations from the ASD have been implemented Look atlogs or records showing steps taken and completion dates Goodincludes detailed logs indicating who did what and when
Askfollow-up actions: Request evidence of any follow-up actions taken post-assessment, including any subsequent assessments or reviews Look atdocumented plans and outcomes Goodshows ongoing engagement with the ASD and improvement initiatives

04 — Mappings

link

Cross-framework mappings

How ISM-0246 relates to controls across ISO/IEC 27001, Essential Eight, and ASD ISM.

ISO 27001

Control	Notes	Details
layers Partially meets (2) expand_less
Annex A 8.25	ISM-0246 requires that, when an emanation security threat assessment is required, it is sought as early as possible in a system’s life cycle
Annex A 8.26	ISM-0246 requires that an emanation security threat assessment is sought as early as possible in the system lifecycle when required
handshake Supports (1) expand_less
Annex A 8.27	ISM-0246 requires organisations to engage ASD early in the system life cycle when an emanation security risk assessment is required, to a...

These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.