ASD ISM 0460 Use HACE for encrypting sensitive media

The IT team should identify all media that might contain secret or top secret information.

They can do this by conducting an inventory check of devices and storage media in use across the organisation, focusing on those used for sensitive tasks.

IT managers need to ensure that appropriate encryption software is installed and configured on identified devices.

They should choose government-approved encryption solutions recommended by the Australian Cyber Security Centre (ACSC) for high-assurance needs.

Data handlers, such as employees dealing with sensitive information, must be trained on the importance of encryption.

Provide them with hands-on sessions to show how to use encryption tools correctly to secure files before storing or transmitting them.

System administrators should regularly review and update encryption software to guard against vulnerabilities.

Set up a monthly task to check for and apply updates, ensuring the encryption remains strong and reliable.

The IT security team should set up monitoring to detect any storage devices that do not have encryption enabled.

Implement alerts to notify the team in real-time if unencrypted media is detected, so they can act swiftly to secure it.