ASD ISM 1059 Encrypt all data stored on media using ASD-approved cryptography
What it says
All data stored on media is encrypted using ASD-approved cryptography.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAll data held on storage media must be encrypted using cryptography approved by the Australian Signals Directorate (ASD).
This control means every piece of information saved on your storage media (such as laptop hard drives, USB sticks, external drives, backup tapes and memory cards) must be scrambled using encryption that the Australian Signals Directorate (ASD), the government's cyber security agency, has approved. Encryption turns readable data into a coded form that no one can open without the right key. That way, if a device or drive is lost, stolen or thrown out, the information on it stays unreadable and protected.
Free. Save your status, tasks and notes.
Why it matters
If data stored on media is not encrypted with ASD-approved cryptography, a lost or stolen laptop, USB stick or backup drive exposes readable sensitive information, causing a data breach.
How to implement
The IT team should turn on full-disk encryption (for example BitLocker on Windows or FileVault on macOS) on every laptop, desktop and server, choosing an encryption setting that uses an ASD-approved method such as AES (Advanced Encryption Standard).
The IT team should configure all USB sticks, external drives, backup tapes and memory cards so they are automatically encrypted before any data is written to them, blocking the use of unencrypted removable media.
A manager or IT lead should keep a written list that maps each type of storage media the organisation uses to the specific ASD-approved encryption product or setting protecting it, so nothing is left unencrypted.
The IT team should store and back up the encryption keys and recovery keys in a secure, separate location (such as a key management system or locked safe) so encrypted data can still be recovered if a device fails.
Procurement and IT staff should check the current ASD Information Security Manual and Evaluated Products list before buying or enabling any encryption tool, confirming the cryptographic algorithm is still ASD-approved.
Keep it running
Re-check encryption coverage whenever new media or devices are added, and confirm the chosen cryptographic methods are still listed as ASD-approved as the Information Security Manual is updated.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
a list of all storage media types in use (laptops, servers, USB drives, backup media) and the encryption applied to each.
Look at
whether every entry shows an ASD-approved algorithm such as AES.
Good evidence
accounts for all media with no unencrypted gaps.
- Check 2 of 5What an auditor asks for
Ask for
the IT team to demonstrate encryption on a sample device.
Look at
the device settings or management console showing encryption is active and which algorithm is used.
Good evidence
shows full-disk encryption switched on and confirmed as ASD-approved.
- Check 3 of 5What an auditor asks for
Ask for
which specific cryptographic products or settings are used and how they were confirmed as ASD-approved.
Look at
references to the current ASD Information Security Manual or Evaluated Products list.
Good evidence
cites the exact approved standard, not a vague claim.
- Check 4 of 5What an auditor asks for
Ask for
how removable media like USB sticks and external drives are handled.
Look at
policy and technical controls that force encryption on removable media.
Good evidence
shows unencrypted removable media is blocked or automatically encrypted.
- Check 5 of 5What an auditor asks for
Ask for
how encryption keys are managed and recovered.
Look at
evidence of secure key storage and a recovery process.
Good evidence
shows keys are protected separately and data can be recovered without weakening the encryption.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.7.10.
ISM-1059 mandates encryption of all data stored on media as a fundamental security measure. Annex A 7.10 governs storage media management across its lifecycle, including acquisition, use, transport, and disposal according to classification and handling requirements, where encryption is a critical component for compliance. Annex A 7.10 is broader due to its inclusion of governance and procedure-related controls beyond just encryption.
This control partially meets A.8.1.
Annex A 8.1 requires organisations to protect information stored on, processed by, or accessible via user endpoint devices. ISM-1059 specifically mandates encryption for all data stored on media, which is one important mechanism for protecting endpoint-resident data (e.g., laptop disks, removable media used with endpoints). ISM-1059 is narrower because it focuses on encryption of stored data, while Annex A 8.1 also covers broader endpoint protections (configuration, access controls, malware protection, physical protection, etc.).
This control depends on A.8.24.
ISM-1059 requires encryption for all data on media, implying the need for effective cryptographic key management. Annex A 8.24 establishes guidelines for cryptography and key management, critical for ensuring strong and reliable encryption practices. Without Annex A 8.24, the encryption required by ISM-1059 may not be consistently or effectively implemented.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.