ASD ISM 0249Request ASD Emanation Security Assessments for Deployed Classified Systems
System owners deploying SECRET or TOP SECRET systems in mobile platforms or as a deployable capability must request an emanation security risk assessment from ASD.
Plain language
This control ensures that highly classified systems taken outside fixed, protected facilities are checked for the risk of leaking information through unintended electronic emissions. When you deploy a SECRET or TOP SECRET system on a mobile platform, such as a vehicle, ship or aircraft, or package it as a deployable capability for use in the field, you must contact the Australian Signals Directorate (ASD) for an emanation security risk assessment. This matters because equipment can give off electromagnetic signals that a nearby adversary could intercept to recover sensitive information, and mobile or field settings rarely provide the shielding that permanent sites do.
Framework
ASD Information Security Manual (ISM)
Control effect
Preventative
Classifications
S, TS
ISM last updated
Mar 2026
Control Stack last updated
10 Aug 2026
E8 maturity levels
N/A
Section
Emanation securityOfficial control statement
System owners deploying SECRET or TOP SECRET systems in mobile platforms, or as a deployable capability, contact ASD for an emanation security risk assessment.
Why it matters
Without an ASD emanation security risk assessment, unintended electromagnetic emissions from deployed SECRET or TOP SECRET systems could be intercepted, exposing highly classified information to adversaries.
Operational notes
Re-engage ASD for a new emanation security risk assessment whenever a deployed system's platform, operating location or classification changes.
Implementation tips
- System owners identify every SECRET or TOP SECRET system that will operate on a mobile platform or be packaged as a deployable capability, and flag each one for emanation security review before deployment begins.
- The system owner contacts ASD through official ASD advisory channels to request an emanation security risk assessment, stating the system's classification, intended platform and deployment environment.
- Give ASD the technical details of the equipment, its physical layout and the operating location so the assessment can account for shielding, separation distances and nearby uncontrolled areas.
- Build the ASD assessment request into the project schedule early, so the assessment and any resulting measures are completed before the system is fielded rather than retrofitted afterwards.
- Record ASD's findings and recommended mitigations in the system's security documentation and implement the specified emanation security measures before the system carries live classified data.
Audit / evidence tips
- AskAsk the system owner to list all SECRET and TOP SECRET systems deployed on mobile platforms or as deployable capabilities.GoodA complete inventory that identifies each highly classified deployed system and links it to an emanation security risk assessment.
- AskAsk for evidence that ASD was contacted to request an emanation security risk assessment for each in-scope deployment.GoodDated records showing ASD was formally engaged before deployment and confirming the assessment was requested.
- AskAsk to see the completed emanation security risk assessment provided by ASD.GoodA current assessment that covers the actual platform, classification and operating environment of the deployed system.
- AskAsk how ASD's recommendations were implemented before the system was fielded.GoodDocumented evidence that each recommended emanation security measure was applied and verified before the system carried classified data.
- AskAsk how the organisation ensures new or changed deployments trigger a fresh emanation security assessment.GoodA defined process that requires an ASD emanation security assessment as a gate before any new mobile or deployable classified deployment.
Cross-framework mappings
How ISM-0249 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
handshakeSupports(1)expand_less | ||
| Annex A 5.5 | ISM-0249 requires system owners deploying SECRET or TOP SECRET systems on mobile platforms or as a deployable capability to contact ASD f... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Communications infrastructure
See all Guidelines for communications infrastructure controls, or browse the full ASD ISM library.