ASD ISM 0499 Ensure compliance with ASD communication security policies
What it says
Communications security doctrine and policy produced by ASD for the management and operation of HACE is complied with.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishFollow ASD's security rules for operating and managing communication systems safely.
This control is about following specific security guidelines set by the Australian Signals Directorate (ASD) when managing communication systems. It's important because if these rules aren't followed, sensitive information could be intercepted or tampered with, leading to serious privacy breaches and potential financial losses.
Free. Save your status, tasks and notes.
Why it matters
Without complying with ASD HACE communications security policy, interception or compromise of sensitive communications may occur, leading to privacy breaches and legal consequences.
How to implement
The IT manager should ensure all staff managing communications systems are familiar with the ASD's security policies.
This can be done by organising regular training sessions where the staff learn about these policies and their importance.
System administrators should regularly review and update communication systems to ensure they comply with ASD guidelines.
They can do this by conducting monthly checks and logging any changes made to keep systems secure.
The compliance officer should create a checklist based on ASD policies to help the team consistently apply the required rules.
This checklist should be used during system audits and updates to ensure nothing is overlooked.
Managers should encourage their teams to report any issues or uncertainties regarding the security of communication systems promptly.
They can set up a straightforward reporting process, such as an email hotline where staff can ask questions.
Human Resources should include cyber security responsibilities in job descriptions for roles involving communication systems management.
This ensures that new hires understand their role in maintaining security from day one.
Keep it running
Review ASD HACE communications security policies regularly, and update procedures and configurations promptly when ASD doctrine or policy changes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The latest ASD communication security policy documents: Request to see the policies referenced for guidance.
Look at
The issue date and version number of the documents.
Good evidence
Policies that are marked as current and have been reviewed within the last year.
- Check 2 of 5What an auditor asks for
Ask for
A log of system updates and reviews tied to these policies: Request the change logs from the system administrators.
Look at
Regular entries showing updates with reference to specific ASD policy requirements.
Good evidence
A detailed log updated consistently each month.
- Check 3 of 5What an auditor asks for
Ask for
Training records on ASD policy compliance: Request records of attendance at any policy training sessions.
Look at
Which staff attended and when.
Good evidence
Recent training delivered to all relevant staff with attendance documented and up-to-date.
- Check 4 of 5What an auditor asks for
Ask for
The compliance checklist completed during the latest system audit: Request the completed checklist that the compliance officer uses.
Look at
Recent completion dates and signatures indicating who conducted the audit.
Good evidence
A properly filled checklist with no items left unchecked.
- Check 5 of 5What an auditor asks for
Ask for
Communication system incident reports from the last year: Request reports of any security incidents related to communications.
Look at
The type and frequency of incidents reported.
Good evidence
Few incidents and indications that issues were resolved promptly following ASD guidance.
Mappings
Closest match in ISO/IEC 27001: A.5.31, Compliance with information security legal requirements, which this control supports.
ISO/IEC 27001: 1 mapping
This control supports A.5.31.
ISM-0499 requires compliance with ASD communications security doctrine and policy produced for HACE management and operation. ISO/IEC 27001:2022 Annex A 5.31 supports this by requiring identification and maintenance of relevant legal, regulatory and contractual information security requirements, which in Australian Government contexts can include ASD policy obligations and direction. ISM-0499 is a direct compliance requirement for a specific ASD policy area, while Annex A 5.31 is the broader obligation-registering and currency process.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.