Skip to content
Cryptography
ASD ISMISM-0481

ASD ISM 0481 Ensure use of high assurance cryptographic protocols

What it says

Only AACPs or high assurance cryptographic protocols are used by cryptographic equipment, applications and libraries.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Ensure only approved secure cryptographic protocols are used in equipment and software.

To keep your data safe, you need to make sure that any systems or software you use are using the strongest locks available, known as high assurance cryptographic protocols. These are like super-secure codes that protect information so that only the right people can see it. If you don't use them, it's like having a flimsy lock on your front door, making it easier for hackers to break in and steal sensitive data.

Why it matters

Failure to use high assurance cryptographic protocols can lead to data breaches, exposing sensitive information to unauthorised access.

How to implement

  1. The IT team should check each piece of software and system to ensure they are using approved cryptographic protocols.

    This can be done by reviewing the software documentation or user settings to confirm which protocols are being used.

  2. System owners should meet with IT professionals to identify which cryptographic protocols are approved and ensure these are implemented.

    They should document these protocols and regularly update them as per ASD guidelines.

  3. Managers should organise training sessions for staff, especially those in IT, to help them understand what high assurance cryptographic protocols are and why they're important.

    They can use resources from the Australian Cyber Security Centre (ACSC) to ensure everyone is aware of the latest standards.

  4. Procurement teams should ensure that any new software or hardware purchased can support high assurance cryptographic protocols.

    They should include this requirement in procurement contracts and verify vendor guarantees or specifications.

  5. The cyber security officer should conduct regular reviews to verify compliance with this control.

    This involves auditing systems periodically to ensure only high assurance cryptographic protocols are in use, using tools or trusted third-party reviews if necessary.

Keep it running

Audit systems to ensure only AACPs/high assurance protocols (e.g., TLS 1.2/1.3) are enabled, disable deprecated suites, and validate libraries are configured to enforce them.

Evidence and audit

  1. Check 1 of 4What an auditor asks for

    Ask for

    A list of all cryptographic protocols currently in use on critical systems: Review this list to ensure it aligns with a documented list of approved protocols from ASD.

    Good evidence

    Shows all systems using only protocols specified in the ASD-approved list.

  2. Check 2 of 4What an auditor asks for

    Look at

    Documented requirements that vendors use approved cryptographic protocols in supplied products.

    Good evidence

    Shows clear contract terms and vendor compliance statements.

  3. Check 3 of 4What an auditor asks for

    Good evidence

    Setup has these protocols activated by default and non-approved protocols blocked.

  4. Check 4 of 4What an auditor asks for

    Ask for

    To see reports from security audits or third-party assessments: Verify these reports include checks on cryptographic protocol usage in systems.

    Good evidence

    Report offers clear evidence that current protocols match approved ones and highlight corrective actions if needed.

Mappings

Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.24Effective use of cryptography and key managementPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.