What does ASD ISM 0481 require?

policyASD Information Security Manual (ISM)

ASD ISM 0481Ensure Use of High Assurance Cryptographic Protocols

Official control statement

Only AACPs or high assurance cryptographic protocols are used by cryptographic equipment, applications and libraries.

policyASD Information Security Manual (ISM)ISM-0481

Quoted as published. Everything else on this page is written by Control Stack.

In plain English

Ensure only approved secure cryptographic protocols are used in equipment and software.

NC OS PASD Information Security ManualGuidelines for cryptography

Control Stack classificationPreventative Cryptography

record_voice_over

What this means in practice

To keep your data safe, you need to make sure that any systems or software you use are using the strongest locks available, known as high assurance cryptographic protocols. These are like super-secure codes that protect information so that only the right people can see it. If you don't use them, it's like having a flimsy lock on your front door, making it easier for hackers to break in and steal sensitive data.

01 - Overview

Framework

ASD Information Security Manual (ISM)

Control effect (Control Stack)

Preventative

Classifications

NC, OS, P, S, TS

ISM last updated

Sept 2025

Control Stack last updated

29 Sept 2026

E8 maturity levels

N/A

Guideline

Guidelines for cryptography

Section

Cryptographic protocols

Topic

Using cryptographic protocols

priority_high

Why it matters

Failure to use high assurance cryptographic protocols can lead to data breaches, exposing sensitive information to unauthorised access.

settings

Operational notes

Audit systems to ensure only AACPs/high assurance protocols (e.g., TLS 1.2/1.3) are enabled, disable deprecated suites, and validate libraries are configured to enforce them.

02 - Implement

build

Implementation tips

The IT team should check each piece of software and system to ensure they are using approved cryptographic protocols. This can be done by reviewing the software documentation or user settings to confirm which protocols are being used.
System owners should meet with IT professionals to identify which cryptographic protocols are approved and ensure these are implemented. They should document these protocols and regularly update them as per ASD guidelines.
Managers should organise training sessions for staff, especially those in IT, to help them understand what high assurance cryptographic protocols are and why they're important. They can use resources from the Australian Cyber Security Centre (ACSC) to ensure everyone is aware of the latest standards.
Procurement teams should ensure that any new software or hardware purchased can support high assurance cryptographic protocols. They should include this requirement in procurement contracts and verify vendor guarantees or specifications.
The cyber security officer should conduct regular reviews to verify compliance with this control. This involves auditing systems periodically to ensure only high assurance cryptographic protocols are in use, using tools or trusted third-party reviews if necessary.

03 - Audit

fact_check

Audit / evidence tips

AskA list of all cryptographic protocols currently in use on critical systems: Review this list to ensure it aligns with a documented list of approved protocols from ASDGoodShows all systems using only protocols specified in the ASD-approved list
Look atDocumented requirements that vendors use approved cryptographic protocols in supplied productsGoodShows clear contract terms and vendor compliance statements
GoodSetup has these protocols activated by default and non-approved protocols blocked
AskTo see reports from security audits or third-party assessments: Verify these reports include checks on cryptographic protocol usage in systemsGoodReport offers clear evidence that current protocols match approved ones and highlight corrective actions if needed