ASD ISM 0469 Use approved cryptographic protocols when encrypting data in transit
What it says
An AACP or high assurance cryptographic protocol is used when encrypting data in transit.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishWhen data moves across networks, encrypt it using an approved (AACP) or high assurance cryptographic protocol so it cannot be read in transit.
When your business sends information across a network (for example, over the internet or between offices), that data should be scrambled using a trusted, government-approved method so outsiders cannot read it on the way. This control says you must use an AACP (ASD-Approved Cryptographic Protocol: a protocol the Australian Signals Directorate has vetted) or, for very sensitive material, a "high assurance" protocol that meets an even stronger standard. Using the right protocol means that even if someone intercepts the traffic, all they see is unreadable gibberish.
Free. Save your status, tasks and notes.
Why it matters
If data in transit is not protected with an approved protocol, attackers can intercept and read sensitive information such as logins, customer records or financial details as it crosses the network.
How to implement
The IT manager or IT provider should make an inventory of every place data travels across a network (websites, email, file transfers, remote access, links between offices) and confirm each one uses an ASD-Approved Cryptographic Protocol (AACP) such as a current version of TLS (Transport Layer Security, the technology behind the padlock in a browser).
The person managing your servers and websites should disable old, weak protocols (for example, older SSL and early TLS versions) and configure systems to only accept current approved versions, then test the configuration with a free protocol-checking tool.
For any information that is highly classified or especially sensitive, the security officer should identify whether a high assurance cryptographic protocol is required and arrange the specific ASD-evaluated product needed, rather than relying on a standard commercial protocol.
The IT team should set up automatic certificate renewal and protocol updates so encryption does not silently lapse, and keep a dated record of which protocol version each system is running.
The business owner should add a clause to contracts with cloud and IT suppliers requiring that data in transit is protected using an AACP or high assurance protocol, and ask each supplier to confirm this in writing.
Keep it running
Approved protocol lists and supported versions change over time, so review enabled protocols and cipher settings periodically and retire any that the ASD no longer approves.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
a list of all network connections that carry business data and the protocol used for each.
Look at
whether each entry names an ASD-Approved Cryptographic Protocol (such as a supported TLS version) rather than a generic 'encrypted' label.
Good evidence
is a complete, current inventory mapping every data-in-transit path to a named approved protocol.
- Check 2 of 5What an auditor asks for
Ask for
to see the configuration or a scan report for a public-facing website or service.
Look at
evidence that weak protocols (older SSL, early TLS) are disabled and only current approved versions are enabled.
Good evidence
is a recent third-party or tool-generated scan showing only approved protocols accepted.
- Check 3 of 5What an auditor asks for
Ask for
how the organisation decides when a high assurance cryptographic protocol is needed instead of a standard approved one.
Look at
a documented link between data sensitivity or classification and the protocol chosen.
Good evidence
references the data's classification and names the specific high assurance product used.
- Check 4 of 5What an auditor asks for
Ask for
records of how encryption certificates and protocol versions are kept current.
Look at
renewal logs, automated update settings, and dates of the last review.
Good evidence
shows certificates that have not expired and a routine process for keeping protocols up to date.
- Check 5 of 5What an auditor asks for
Ask for
suppliers and cloud providers to confirm what protocol protects data in transit to and from their service.
Look at
written confirmation or contract clauses naming an AACP or high assurance protocol.
Good evidence
is a signed statement or contract term specifying the approved protocol in use.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.20.
ISM-0469 requires that an ASD-Approved Cryptographic Protocol (or high assurance cryptographic protocol) is used to protect data when it is communicated over network infrastructure. This relates to Annex A 8.20 because securing and controlling networks and network devices commonly includes enforcing strong, approved cryptographic protocols (e.g., TLS/IPsec) for data-in-transit protection. Annex A 8.20 is broader, covering many other network security controls (segmentation, device hardening, monitoring) beyond cryptographic protocol selection.
This control partially overlaps A.8.24.
ISM-0469 requires the use of ASD-Approved Cryptographic Protocols (or high assurance cryptographic protocols) to protect data communicated over network infrastructure. This overlaps with Annex A 8.24 because implementing cryptography effectively in practice for communications typically involves governance of algorithm/protocol choices and key management to ensure confidentiality and integrity. Annex A 8.24 is broader and includes cryptography for other purposes (e.g., data-at-rest, digital signatures) and explicit key lifecycle management, while ISM-0469 is specifically focused on data-in-transit protocol use.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.