ASD ISM 0457 Use evaluated crypto for sensitive data encryption
What it says
Cryptographic equipment, applications or libraries that have completed a Common Criteria evaluation against an ASD-endorsed Protection Profile are used when encrypting media that contains OFFICIAL: Sensitive or PROTECTED data.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse approved cryptographic tools to encrypt sensitive or protected data to ensure security.
This control is about making sure that when we lock up sensitive or important information with digital 'locks', we use only trusted and approved methods. If these methods aren't followed, there's a risk your confidential information could be unlocked and accessed by people who shouldn't have it, leading to privacy breaches or financial loss.
Free. Save your status, tasks and notes.
Why it matters
Without Common Criteria-evaluated crypto, OFFICIAL:Sensitive/PROTECTED media may be decrypted by attackers, causing breaches and loss.
How to implement
System owners should identify the types of sensitive data they handle.
They can do this by creating a list of data categories that are considered sensitive or protected, like customer information or financial details. This helps in understanding what needs to be encrypted at all times.
The IT team should select cryptographic tools that are evaluated and approved by the appropriate Australian authorities, specifically those that adhere to the Common Criteria standards.
This involves researching tools already evaluated against an ASD-endorsed Protection Profile to ensure compliance.
Procurement staff should collaborate with the IT team during the purchase of new encryption tools and ensure that only those which have been officially endorsed and evaluated are procured.
This can be done by checking suppliers' documentation against the approved list of products.
Managers should arrange for regular training sessions for their staff about the importance of using recommended cryptographic solutions.
This includes practical demonstrations and simple real-world analogies to make sure everyone understands the importance of following the rule.
The compliance officer should regularly review the organisation's encryption practices and ensure that policies are up to date and align with the latest government standards.
This can be done by setting scheduled policy reviews and updating documentation as needed when standards change.
Keep it running
Maintain an approved list of Common Criteria-evaluated crypto (ASD-endorsed Protection Profiles) and revalidate versions before use.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Documentation of selected cryptographic tools: Request an inventory of cryptographic solutions used in the organisation.
Look at
Whether these tools align with the ASD's endorsed protection profiles.
Good evidence
Shows all tools used are listed and are approved according to government standards.
- Check 2 of 5What an auditor asks for
Ask for
The procurement records: Check the records that show how cryptographic tools were selected and purchased.
Look at
Evidence of evaluation against government-endorsed criteria.
Good evidence
Finding includes records showing approval and alignment with Common Criteria standards.
- Check 3 of 5What an auditor asks for
Ask for
Training records: Obtain the schedule and content of recent training sessions on cryptographic practices.
Look at
Whether staff were informed about using evaluated tools.
Good evidence
Shows documented training with attendee lists and feedback.
- Check 4 of 5What an auditor asks for
Ask for
Encryption policy documents: Request copies of current encryption policies.
Look at
Sections that specify using evaluated tools for sensitive data encryption.
Good evidence
Document will clearly list approved methods and align with recent standards.
- Check 5 of 5What an auditor asks for
Ask for
Review meeting notes: Check notes from any strategic meetings regarding encryption practices.
Look at
Documentation discussing the importance and choice of evaluated cryptographic tools.
Good evidence
Will include detailed minutes and action items aligned with policy.
Mappings
Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.24.
ISM-0457 mandates the use of cryptographic equipment, applications or libraries that have completed a Common Criteria evaluation against an ASD-endorsed Protection Profile for encrypting media with official, sensitive or protected data. Annex A 8.24 requires organisations to define and implement comprehensive cryptography rules, which often includes the selection of assured cryptographic solutions. ISM-0457 specifies a unique assurance-based requirement (Common Criteria + ASD-endorsed Protection Profile) not entirely covered by general governance under Annex A 8.24.
This control partially overlaps A.7.9.
Annex A 7.9 requires organisations to safeguard assets taken off-site. ISM-0457 mandates the use of ASD-endorsed cryptographic products for encrypting media with sensitive data, reducing confidentiality risks if off-site media is lost or stolen. ISM-0457 focuses on cryptographic assurance for specific data classes while Annex A 7.9 also includes physical protection and broader asset coverage.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.