ASD ISM 0465 Use evaluated cryptographic tools for sensitive data
What it says
Cryptographic equipment, applications or libraries that have completed a Common Criteria evaluation against an ASD-endorsed Protection Profile are used to protect OFFICIAL: Sensitive or PROTECTED data when communicated over insufficiently secure networks, outside of appropriately secure areas or via public network infrastructure.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse evaluated cryptographic tools to protect sensitive data on insecure or public networks.
When you're sending important info like personal details or business data over the internet or on potentially unsafe networks, you want to make sure no one else can see it. This control is about using special tools that have been tested and approved to keep your data safe when it travels through these risky areas. Without it, sensitive information could be intercepted by someone with bad intentions, leading to identity theft, financial loss, or damage to your reputation.
Free. Save your status, tasks and notes.
Why it matters
Without Common Criteria-evaluated crypto, OFFICIAL: Sensitive/PROTECTED data sent over public or untrusted networks may be intercepted or altered, causing compromise and reportable breaches.
How to implement
IT teams should check that existing applications meet the evaluated criteria for cryptographic tools.
They can do this by reviewing vendor information or acquiring a list of evaluated products from the Common Criteria portal or the ACSC website.
Procurement officers need to specify in purchase agreements that cryptographic tools must be evaluated against an endorsed Protection Profile.
This can be done by including it as a requirement in tender documents or purchasing guidelines.
System administrators should set up systems to automatically use these approved cryptographic tools when transmitting sensitive data.
This means configuring software settings to always opt for encrypted communication options by default.
Managers should educate staff about the importance of using secure communication tools.
They can run short training sessions explaining why certain applications are used for sending sensitive data and how to verify if a tool is approved.
Keep it running
Use only Common Criteria-evaluated crypto against ASD-endorsed Protection Profiles for OFFICIAL: Sensitive/PROTECTED data over public/untrusted networks; verify certificates and approved versions periodically.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
A list of cryptographic tools currently in use: Ensure each tool on the list has gone through Common Criteria evaluation.
Look at
The evaluation certificates or ASD endorsement statements attached to each tool.
Good evidence
Is a complete list where each tool has documentation proving its evaluated status.
- Check 2 of 3What an auditor asks for
Look at
Content explaining tool selection based on its evaluated status and trained competencies. Evidence of good practice is well-documented and regularly updated training sessions.
- Check 3 of 3What an auditor asks for
Ask for
Configuration documentation from the IT department: Examine how cryptographic tool settings are configured to default to secure communications.
Good evidence
Includes screenshots or settings logs showing encrypted communication as the default.
Mappings
Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.24.
ISM-0465 requires the use of Common Criteria evaluated cryptographic equipment, applications or libraries (against an ASD-endorsed Protection Profile) to protect OFFICIAL: Sensitive or PROTECTED data when traversing insufficiently secure/public networks or outside secure areas. Annex A 8.24 requires the organisation to define and implement rules for the effective use of cryptography and cryptographic key management. ISM-0465 is a specific, assurance-focused instance of cryptography use (evaluated products for certain classifications and scenarios), whereas Annex A 8.24 is broader and does not require ASD/Common Criteria evaluation.
This control partially overlaps A.7.9.
Annex A 7.9 involves protecting assets outside organisational premises. ISM-0465 requires cryptographic protection of sensitive data when communicated over insecure networks, which is common off-site. ISM-0465 addresses secure communications while Annex A 7.9 covers preventing physical loss/theft and device protection.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.