ISM-0499 ASD Information Security Manual (ISM)

Ensure Compliance with ASD Communication Security Policies

Follow ASD's security rules for operating and managing communication systems safely.

Preventative SECRET TOP SECRET Compliance ASD Information Security Manual Governance Policy, rules and standards compliance Policy

🏛️ Framework

ASD Information Security Manual (ISM)

🧭 Control effect

Preventative

🔐 Classifications

S, TS

🗓️ ISM last updated

May 2025

✏️ Control Stack last updated

22 Feb 2026

🎯 E8 maturity levels

N/A

Guideline

Guidelines for cryptography

Section

Cryptographic fundamentals

Topic

Communications Security Doctrine

Official control statement

Communications security doctrine and policy produced by ASD for the management and operation of HACE is complied with.

Source: ASD Information Security Manual (ISM)

Plain language

This control is about following specific security guidelines set by the Australian Signals Directorate (ASD) when managing communication systems. It's important because if these rules aren't followed, sensitive information could be intercepted or tampered with, leading to serious privacy breaches and potential financial losses.

Why it matters

Without complying with ASD HACE communications security policy, interception or compromise of sensitive communications may occur, leading to privacy breaches and legal consequences.

Operational notes

Review ASD HACE communications security policies regularly, and update procedures and configurations promptly when ASD doctrine or policy changes.

Implementation tips

The IT manager should ensure all staff managing communications systems are familiar with the ASD's security policies. This can be done by organising regular training sessions where the staff learn about these policies and their importance.
System administrators should regularly review and update communication systems to ensure they comply with ASD guidelines. They can do this by conducting monthly checks and logging any changes made to keep systems secure.
The compliance officer should create a checklist based on ASD policies to help the team consistently apply the required rules. This checklist should be used during system audits and updates to ensure nothing is overlooked.
Managers should encourage their teams to report any issues or uncertainties regarding the security of communication systems promptly. They can set up a straightforward reporting process, such as an email hotline where staff can ask questions.
Human Resources should include cybersecurity responsibilities in job descriptions for roles involving communication systems management. This ensures that new hires understand their role in maintaining security from day one.

Audit / evidence tips

Ask: the latest ASD communication security policy documents: Request to see the policies referenced for guidance

Good: policies that are marked as current and have been reviewed within the last year
Ask: a log of system updates and reviews tied to these policies: Request the change logs from the system administrators

Good: a detailed log updated consistently each month
Ask: training records on ASD policy compliance: Request records of attendance at any policy training sessions

Good: recent training delivered to all relevant staff with attendance documented and up-to-date
Ask: the compliance checklist completed during the latest system audit: Request the completed checklist that the compliance officer uses

Good: a properly filled checklist with no items left unchecked
Ask: communication system incident reports from the last year: Request reports of any security incidents related to communications

Good: few incidents and indications that issues were resolved promptly following ASD guidance

Cross-framework mappings

How ISM-0499 relates to controls across ISO/IEC 27001, Essential Eight, and ASD ISM.

These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.

ISO 27001

Control	Notes	Details
Supports (4)
Annex A 5.1	ISM-0499 requires compliance with ASD communications security doctrine and policy for the management and operation of HACE
Annex A 5.4	ISM-0499 requires personnel managing and operating HACE to comply with ASD communications security doctrine and policy
Annex A 5.31	ISM-0499 requires compliance with ASD communications security doctrine and policy produced for HACE management and operation
Annex A 5.37	ISM-0499 requires compliance with ASD communications security doctrine and policy for HACE operations
Related (1)
Annex A 5.36	Annex A 5.36 requires organisations to regularly review whether information security policies and standards are being complied with