ASD ISM 0665CISO Verifies and Authorises Trustworthy Sources for SECRET and TOP SECRET Systems
Official control statement
Trustworthy sources for SECRET and TOP SECRET systems are limited to people and systems that have been verified and authorised as such by the chief information security officer.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Only people and systems the CISO has verified and authorised may be treated as trustworthy sources for SECRET and TOP SECRET systems.
What this means in practice
In the ISM, a "trustworthy source" is a person or system that is permitted to authorise the export of data from a system. This control says that, for SECRET and TOP SECRET systems, the set of those sources is not something a system owner, administrator or project team can decide for themselves. A person or system only becomes a trustworthy source after the chief information security officer (CISO) has verified them and formally authorised them as such. It matters because a trustworthy source is what stands between highly classified data and the outside of the system: exports from SECRET and TOP SECRET systems are only meant to proceed when a trustworthy source has authorised them. If anyone can nominate a source, an attacker or a well-meaning but careless team could introduce a person or system that is not actually vetted, and that source could then approve data leaving the system. Concentrating the decision in the CISO, with verification before authorisation, means everyone and everything able to authorise an export from these systems has been deliberately examined by the one accountable security executive.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Preventative
Classifications
S, TS
ISM last updated
Sept 2026
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Why it matters
If trustworthy sources for SECRET and TOP SECRET systems are not limited to those the CISO has verified and authorised, unvetted people or systems can be treated as trusted and can authorise data leaving the most sensitive systems, leading to unauthorised exports or data spills. This undermines the classification protections the system depends on, can lead to compromise of national security information, and leaves no single accountable decision to point to when the source turns out to be untrustworthy.
Operational notes
Day to day, this control lives in a maintained register of authorised trustworthy sources for each SECRET and TOP SECRET system, owned by the CISO or their office. Requests to add a person or system as a trustworthy source follow a defined path: the requester documents who or what the source is and why trust is needed, the CISO (or the CISO's office on their behalf, with the CISO signing off) verifies the source, and only then is the authorisation recorded and the source enabled as an export authoriser on the system.
Operators and administrators need to know that they cannot treat a new source as trusted just because it is convenient or because another team vouches for it. Changes to the source (new owner, new hosting, change of role for a person) should trigger re-verification, and sources that are no longer needed should be removed. Periodic reviews of the register keep it aligned with what the systems are actually trusting.
Implementation tips
- The CISO formally documents, in the organisation's security policy, that they are the sole authority for verifying and authorising trustworthy sources for SECRET and TOP SECRET systems, and communicates this to system owners and administrators.
- The CISO's office establishes and maintains a register of authorised trustworthy sources (people and systems) per SECRET and TOP SECRET system, recording who or what the source is, the verification performed, the date and the CISO's authorisation.
- System owners submit a written request for each proposed trustworthy source, describing the source, the trust relationship needed and the justification, so the CISO has the information required to verify it before authorising.
- System administrators configure the export authorisation controls on SECRET and TOP SECRET systems (for example the people permitted to approve exports, export or transfer gateways, and workflow approver lists) so that only sources listed in the CISO-authorised register can authorise exports, and remove any source not on the register.
- The CISO's office schedules a periodic review, and re-verification on any change to a source, comparing the register against the sources each system actually accepts as export authorisers and removing or re-authorising as required.
Audit / evidence tips
- AskAsk for the policy or procedure that sets out who may authorise trustworthy sources for SECRET and TOP SECRET systems.Look atCheck that it names the CISO as the authority and requires verification before authorisation.GoodThe document clearly states that only the CISO verifies and authorises trustworthy sources for these systems and no delegation to system owners is permitted.
- AskAsk for the register of authorised trustworthy sources for a sample of SECRET and TOP SECRET systems.Look atLook for each entry to show the source, the verification performed and the CISO's authorisation with a date.GoodEvery listed person and system has a recorded verification and a CISO sign-off, with no entries missing authorisation.
- AskAsk for the actual configuration of who or what may authorise exports from those systems (export approver lists, transfer gateway authoriser settings, workflow approver lists).Look atCompare the configured export authorisers against the register.GoodEvery person and system able to authorise an export from the system appears in the CISO-authorised register and nothing extra is permitted.
- AskAsk for recent requests to add a trustworthy source and their outcomes.Look atTrace one request from submission through verification to the CISO's decision.GoodThe request shows evidence of verification and an explicit CISO authorisation before the source was enabled on the system.
- AskAsk for records of periodic reviews or re-verification of trustworthy sources.Look atCheck that reviews compare the register to live configuration and that changed or unneeded sources were re-verified or removed.GoodReviews occur on a defined schedule, are signed by the CISO, and any discrepancies were corrected.
Cross-framework mappings
How ISM-0665 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 5.15 | ISM-0665 limits trustworthy sources for SECRET/TOP SECRET systems to CISO-verified entities, which is a specific governance rule | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Data transfers
See all Guidelines for data transfers controls, or browse the full ASD ISM library.