Skip to content
Data transfers
ASD ISMISM-0665

ASD ISM 0665 CISO verifies and authorises trustworthy sources for SECRET and TOP SECRET systems

What it says

Trustworthy sources for SECRET and TOP SECRET systems are limited to people and systems that have been verified and authorised as such by the chief information security officer.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Only people and systems the CISO has verified and authorised may be treated as trustworthy sources for SECRET and TOP SECRET systems.

In the ISM, a "trustworthy source" is a person or system that is permitted to authorise the export of data from a system. This control says that, for SECRET and TOP SECRET systems, the set of those sources is not something a system owner, administrator or project team can decide for themselves. A person or system only becomes a trustworthy source after the chief information security officer (CISO) has verified them and formally authorised them as such. It matters because a trustworthy source is what stands between highly classified data and the outside of the system: exports from SECRET and TOP SECRET systems are only meant to proceed when a trustworthy source has authorised them. If anyone can nominate a source, an attacker or a well-meaning but careless team could introduce a person or system that is not actually vetted, and that source could then approve data leaving the system. Concentrating the decision in the CISO, with verification before authorisation, means everyone and everything able to authorise an export from these systems has been deliberately examined by the one accountable security executive.

Why it matters

If trustworthy sources for SECRET and TOP SECRET systems are not limited to those the CISO has verified and authorised, unvetted people or systems can be treated as trusted and can authorise data leaving the most sensitive systems, leading to unauthorised exports or data spills. This undermines the classification protections the system depends on, can lead to compromise of national security information, and leaves no single accountable decision to point to when the source turns out to be untrustworthy.

How to implement

  1. The CISO formally documents, in the organisation's security policy, that they are the sole authority for verifying and authorising trustworthy sources for SECRET and TOP SECRET systems, and communicates this to system owners and administrators.

  2. The CISO's office establishes and maintains a register of authorised trustworthy sources (people and systems) per SECRET and TOP SECRET system, recording who or what the source is, the verification performed, the date and the CISO's authorisation.

  3. System owners submit a written request for each proposed trustworthy source, describing the source, the trust relationship needed and the justification, so the CISO has the information required to verify it before authorising.

  4. System administrators configure the export authorisation controls on SECRET and TOP SECRET systems (for example the people permitted to approve exports, export or transfer gateways, and workflow approver lists) so that only sources listed in the CISO-authorised register can authorise exports, and remove any source not on the register.

  5. The CISO's office schedules a periodic review, and re-verification on any change to a source, comparing the register against the sources each system actually accepts as export authorisers and removing or re-authorising as required.

Keep it running

Day to day, this control lives in a maintained register of authorised trustworthy sources for each SECRET and TOP SECRET system, owned by the CISO or their office. Requests to add a person or system as a trustworthy source follow a defined path: the requester documents who or what the source is and why trust is needed, the CISO (or the CISO's office on their behalf, with the CISO signing off) verifies the source, and only then is the authorisation recorded and the source enabled as an export authoriser on the system.

Operators and administrators need to know that they cannot treat a new source as trusted just because it is convenient or because another team vouches for it. Changes to the source (new owner, new hosting, change of role for a person) should trigger re-verification, and sources that are no longer needed should be removed. Periodic reviews of the register keep it aligned with what the systems are actually trusting.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    Ask for the policy or procedure that sets out who may authorise trustworthy sources for SECRET and TOP SECRET systems.

    Look at

    Check that it names the CISO as the authority and requires verification before authorisation.

    Good evidence

    The document clearly states that only the CISO verifies and authorises trustworthy sources for these systems and no delegation to system owners is permitted.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Ask for the register of authorised trustworthy sources for a sample of SECRET and TOP SECRET systems.

    Look at

    Look for each entry to show the source, the verification performed and the CISO's authorisation with a date.

    Good evidence

    Every listed person and system has a recorded verification and a CISO sign-off, with no entries missing authorisation.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Ask for the actual configuration of who or what may authorise exports from those systems (export approver lists, transfer gateway authoriser settings, workflow approver lists).

    Look at

    Compare the configured export authorisers against the register.

    Good evidence

    Every person and system able to authorise an export from the system appears in the CISO-authorised register and nothing extra is permitted.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Ask for recent requests to add a trustworthy source and their outcomes.

    Look at

    Trace one request from submission through verification to the CISO's decision.

    Good evidence

    The request shows evidence of verification and an explicit CISO authorisation before the source was enabled on the system.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Ask for records of periodic reviews or re-verification of trustworthy sources.

    Look at

    Check that reviews compare the register to live configuration and that changed or unneeded sources were re-verified or removed.

    Good evidence

    Reviews occur on a defined schedule, are signed by the CISO, and any discrepancies were corrected.

Mappings

Closest match in ISO/IEC 27001: A.5.15, Access control policies and procedures, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.5.15Access control policies and proceduresPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.