ASD ISM 0471 Use only high assurance cryptographic algorithms
What it says
Only AACAs or high assurance cryptographic algorithms are used by cryptographic equipment, applications and libraries.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure cryptographic tools use only ASD-approved or high-assurance algorithms for security.
This control is about making sure that any tools or programs your business uses to secure information only rely on the most trusted and high-quality methods approved by the Australian Signals Directorate (ASD). This is important because using weak or outdated security can leave your information exposed to hackers and cybercriminals, which could lead to data breaches and potential financial and reputational damage.
Free. Save your status, tasks and notes.
Why it matters
Using non-high assurance or deprecated cryptography can let attackers decrypt protected data, causing confidentiality loss, breaches, and financial and reputational damage.
How to implement
IT teams should review current software and applications to confirm they use high-assurance cryptography.
This involves checking the documentation or configuration settings where cryptographic methods are described.
Managers responsible for procurement should include a requirement for ASD-approved cryptographic algorithms in contracts with software vendors.
Clearly specify this requirement in the 'Security Requirements' section of any new software procurement agreements.
HR should train staff on the importance of using software that complies with these high standards.
Organise regular awareness sessions to remind staff why we only trust ASD-approved methods for handling sensitive data.
System administrators should regularly update software to ensure they are using the latest cryptographic standards.
Set reminders for routine checks and software updates to maintain up-to-date security protocols.
Keep it running
Regularly verify crypto libraries and configurations use only ASD-approved/AACA algorithms and approved key sizes; remove deprecated ciphers and protocols from builds.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The cryptographic policy document: Request the organisation's policy on using ASD-approved cryptographic algorithms.
Look at
The policy to ensure it lists ASD standards and describes how they are applied.
Good evidence
Policy will include clear guidelines on approved tools and practices.
- Check 2 of 5What an auditor asks for
Ask for
Vendor compliance reports: Request reports or statements from software vendors verifying the use of ASD-approved algorithms. Check these documents for specifics on the cryptographic methods used. Good reports will mention compliance specifically with ASD criteria.
- Check 3 of 5What an auditor asks for
Ask for
Training records: Review records of staff training sessions on cyber security and cryptographic awareness.
Look at
Attendance lists and training content that covers ASD-approved algorithms. Good records will show regular sessions with clear educational material.
- Check 4 of 5What an auditor asks for
Ask for
Software audit logs: Request logs or reports that show which cryptographic algorithms are in use. Examine these logs for consistency and adherence to approved algorithms. Good logs will show only ASD-approved methods being used consistently.
- Check 5 of 5What an auditor asks for
Ask for
Approval records: Request evidence of authorisation for the use of cryptographic tools.
Look at
Sign-off documents showing that high-assurance algorithms were chosen deliberately. Good documents will show decision-making aligned with mandatory standards.
Mappings
Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.24.
ISM-0471 requires that only AACAs or other high assurance cryptographic algorithms are used by cryptographic equipment, applications and libraries. This is a specific subset of Annex A 8.24, which requires organisations to define and implement rules for effective use of cryptography and cryptographic key management across the organisation. Annex A 8.24 covers broader governance (algorithm selection, key lifecycle, roles, usage rules), while ISM-0471 focuses narrowly on the assurance level of the algorithms permitted.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.