Skip to content
Cryptography
ASD ISMISM-0467

ASD ISM 0467 Using HACE for secure communication of data

What it says

HACE is used to protect SECRET and TOP SECRET data when communicated over insufficiently secure networks, outside of appropriately secure areas or via public network infrastructure.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Use HACE to secure SECRET and TOP SECRET data on less secure networks.

Imagine you're sending a super important letter through the post. You wouldn't want just anyone to read it, right? This control makes sure that when you send important digital data, it stays private and only the right people can see it, even if it travels along a less secure or public route. Without these measures, your sensitive information could be intercepted and misused, leading to potential financial or reputational harm.

Why it matters

If HACE is not used, SECRET/TOP SECRET data sent over public or insufficiently secure networks can be intercepted and compromised.

How to implement

  1. The IT team should make sure that they encrypt sensitive data before sending it over public or less secure networks.

    Encryption transforms the data into unreadable code that only the intended receiver can interpret. Use tools recommended by the Australian Cyber Security Centre (ACSC) to ensure effective encryption.

  2. Managers need to train staff on the importance of secure data communication.

    Arrange workshops that explain how to identify sensitive information and the steps needed to protect it using secure methods. Ensure all team members know who to contact if they suspect a breach.

  3. The procurement department should source and implement communication tools that support strong encryption.

    This means choosing software that includes end-to-end encryption capabilities for emails and file transfers. Consult with cyber security experts to vet available software options for compliance with best practices.

  4. Business owners or head decision-makers should create a policy for securely sharing sensitive information.

    Draft a clear policy document that outlines what types of information need securing and the approved methods for transmission. Regularly review and update the policy to include new threats and technologies.

  5. The systems administrator should regularly update encryption protocols and tools.

    Set a schedule to check for and install updates from software vendors that enhance encryption effectiveness. Staying current with updates helps protect against new vulnerabilities.

Keep it running

Confirm HACE is enabled for all SECRET/TOP SECRET communications over public/insufficient networks, and regularly validate keys, configs and compliance.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The list of data types considered sensitive: Request a document that categorises information levels from regular to TOP SECRET.

    Look at

    Whether there's a clear definition of what makes data sensitive.

    Good evidence

    Shows a comprehensive list aligned with business operations and risks.

  2. Check 2 of 5What an auditor asks for

    Look at

    Signed attendance forms or digital records of completed training sessions.

    Good evidence

    Includes consistent training records with confirmation of understanding.

  3. Check 3 of 5What an auditor asks for

    Ask for

    The policy on encryption tools and methods: Request the documented policy that explains when and how encrypted communication must occur.

    Look at

    References to specific tools and how they align with ACSC guidelines.

    Good evidence

    Is a detailed, current policy regularly reviewed and approved by management.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Documentation on how communication tools were evaluated and selected.

    Look at

    Notes on which criteria were used to determine suitability for secure communication.

    Good evidence

    Should show a clear evaluation process in line with cyber security standards.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Records of encryption updates: Request logs or reports detailing when encryption tools and protocols were last updated.

    Look at

    Time-stamped entries that match vendor release dates.

    Good evidence

    Is a consistent record showing timely updates ensuring security.

Mappings

Closest match in ISO/IEC 27001: A.5.14, Information transfer policies and procedures, which this control partially meets.

ISO 27001

ISO/IEC 27001: 4 mappings

  • A.5.14Information transfer policies and proceduresPartially meets
  • A.8.20Network and network devices securityPartially meets
  • A.8.24Effective use of cryptography and key managementPartially meets
  • A.6.7Remote working security measuresSupports

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.