ASD ISM 0597 Consult ASD before changing CDS connectivity
What it says
When planning, designing, implementing or introducing additional connectivity to CDSs, ASD is consulted and any directions provided by ASD are complied with.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishConsult ASD when adding connections to cross domain systems and follow their guidance.
Before making any changes to how different computer systems communicate across boundaries, you need to consult with the Australian Signals Directorate (ASD). This is important because cross domain systems handle sensitive information, and improper connections can lead to data breaches or cyber attacks-potentially harming your business or reputation.
Free. Save your status, tasks and notes.
Why it matters
Unconsulted CDS connectivity changes can weaken cross-domain protections, risking classified data spillage and system compromise.
How to implement
System owners should contact the ASD before planning any new connections in cross domain systems.
Reach out directly to ASD to discuss your plans and get their advice on necessary security measures.
IT managers need to document the specific changes they propose and share this documentation with ASD.
Describe what systems are involved, the purpose of the connection, and any existing security controls you have in place.
Top management should assign a responsible person or team to coordinate with ASD.
Ensure this team understands the importance of following ASD's guidance to maintain security and compliance.
Procurement teams should verify that any new technology purchases align with ASD's recommendations.
Ensure all suppliers or service providers understand and support compliance with ASD guidelines.
Security officers must ensure that ASD's guidance is followed by incorporating their recommendations into the organisation's standard operating procedures.
Conduct regular reviews to confirm adherence to these procedures.
Keep it running
Before any CDS connectivity change, consult ASD early, document advice received, and implement all ASD directions before go-live.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Communication records with ASD regarding new connections.
Look at
Emails or meeting notes discussing the plans with ASD.
Good evidence
Detailed records showing ASD was consulted and their feedback was acknowledged.
- Check 2 of 5What an auditor asks for
Look at
Clear descriptions of the systems involved and any planned connections.
Good evidence
Includes specifics such as the systems affected, reasons for changes, and security measures considered.
- Check 3 of 5What an auditor asks for
Look at
An organisational chart or role assignment document. Good is having a clearly defined role with responsibility for liaising with ASD.
- Check 4 of 5What an auditor asks for
Ask for
The procurement guidelines for technology related to cross domain systems.
Look at
Whether these include steps for ASD consultation or approval.
Good evidence
Is procurement processes that clearly incorporate ASD's recommendations.
- Check 5 of 5What an auditor asks for
Look at
Sections that include ASD's guidance on cross domain connections.
Good evidence
Procedures that are regularly updated and reflect the latest ASD advice.
Mappings
Closest match in ISO/IEC 27001: A.5.8, Information security in project management, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.8.
Annex A 5.8 requires information security to be integrated into project management, including planning and design decisions that affect security posture. ISM-0597 relates by requiring ASD consultation when planning, designing, implementing or introducing additional connectivity to CDSs, which is a specific security gate within certain projects. Annex A 5.8 is broader because it applies across all projects, while ISM-0597 is limited to CDS connectivity changes and an external consultation obligation.
This control partially meets A.8.32.
ISM-0597 requires that when an organisation plans, designs, implements or introduces additional connectivity to cross domain systems (CDSs), ASD is consulted and any ASD directions are complied with. Annex A 8.32 requires that changes to information systems are controlled through defined change management procedures, which would govern how CDS connectivity changes are proposed, assessed, approved and implemented. ISM-0597 is a specific, high-assurance escalation/consultation requirement for a particular class of system change, whereas Annex A 8.32 is a general change-control framework for all system changes.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.