ASD ISM 0675 Ensure data exports are digitally signed
What it says
Data authorised for export from SECRET and TOP SECRET systems is digitally signed by a trustworthy source.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishData from SECRET and TOP SECRET systems must be signed by a trusted source before export.
When sensitive data needs to be moved from secure systems, it's crucial that this data is 'signed' by a trusted source to confirm it hasn't been tampered with. This is like getting a stamped seal of authenticity, ensuring that what you send is exactly what you meant to, and helps prevent leaks and misuse of sensitive information.
Free. Save your status, tasks and notes.
Why it matters
If SECRET/TOP SECRET exports are not digitally signed, recipients cannot verify integrity or source, enabling tampering and potentially compromising national security.
How to implement
The IT manager should select a trusted software tool that can digitally sign data.
This tool should be easy to use and compatible with the secret and top-secret systems you are using.
IT staff should set up a process where data scheduled for export is automatically signed before it leaves the secure system.
This means setting up scripts or workflows in the tool to ensure signing happens every time.
Managers should train staff who handle data exports on how to use the digital signing tool.
This includes showing them how to initiate a signing process and verify the signature.
The security officer should design a procedure to periodically check that all data exports are indeed being signed.
This could involve reviewing logs or output reports from the signing tool.
The finance or procurement team should ensure that the chosen digital signing tool is updated regularly.
This can be achieved by setting reminders to check for updates or renew licences.
Keep it running
Digitally sign all SECRET/TOP SECRET exports with trusted keys; validate signatures on receipt and manage certificate/keys to maintain a trustworthy signing source.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The digital signing procedure document: Request the documented process for signing data before export.
Look at
How clear the steps are and whether all types of data exports are covered.
Good evidence
A thorough document outlining each step and the responsible person.
- Check 2 of 5What an auditor asks for
Ask for
Logs showing recent data exports: These logs should record each data export and confirm if they were signed.
Look at
Entries that include date, time, person, and signature status.
Good evidence
All entries showing 'signed' status with no exceptions.
- Check 3 of 5What an auditor asks for
Ask for
To see the list of approved software tools for digital signing: Verify that the list includes tools currently in use and approved by a security officer.
Good evidence
An updated list signed by relevant authority with software details like version and approval date.
- Check 4 of 5What an auditor asks for
Ask for
Reports on training sessions conducted for staff: Check that all relevant employees have been trained on the digital signing process.
Good evidence
Complete training records with dates, attendees, and topics covered.
- Check 5 of 5What an auditor asks for
Ask for
Evidence of system checks or audits: Request records of periodic reviews of the digital signing process.
Look at
Checklists or follow-up actions in case of any issues found.
Good evidence
Detailed audit reports with no unresolved issues.
Mappings
Closest match in ISO/IEC 27001: A.5.14, Information transfer policies and procedures, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.14.
ISM-0675 requires that data authorised for export from SECRET and TOP SECRET systems is digitally signed by a trustworthy source to preserve authenticity and integrity during export. Annex A 5.14 requires organisations to define and implement rules and procedures for information transfer, which can include integrity and authenticity requirements such as digital signatures for sensitive transfers. ISM-0675 is a specific, high-assurance implementation for classified system exports, whereas Annex A 5.14 covers all transfer mechanisms, parties and transfer rules beyond signing.
This control depends on A.8.24.
ISM-0675 requires exported data from SECRET and TOP SECRET systems to be digitally signed by a trustworthy source, which relies on correct cryptographic implementation and key handling. Annex A 8.24 establishes rules for effective cryptography use and cryptographic key management, which underpins the trustworthiness, protection, issuance and verification of signing keys and certificates used for export signing. Without the cryptography and key management practices in Annex A 8.24, signatures required by ISM-0675 can be undermined through weak algorithms, compromised keys or poor certificate management.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.