Skip to content
arrow_back
ISM-1139
search
ISM-1139 policy ASD Information Security Manual (ISM)

Require Latest Version of TLS for Security

Ensure only the latest TLS version is used to secure connections.

Preventative NC OS P ASD Information Security ManualGuidelines for cryptographycryptographysecure communications
record_voice_over

Plain language

This control is about making sure that when information is sent over the internet, it's kept safe and private. We do this by using the latest version of a security protocol called TLS (Transport Layer Security). If we don't, hackers could intercept and access sensitive information like credit card numbers or personal details.

Framework

ASD Information Security Manual (ISM)

Control effect

Preventative

Classifications

NC, OS, P, S, TS

ISM last updated

Feb 2022

Control Stack last updated

19 May 2026

E8 maturity levels

N/A

Guideline

Guidelines for cryptography

Section

Transport Layer Security

Topic

Configuring Transport Layer Security

Official control statement

Only the latest version of TLS is used for TLS connections.
policy ASD Information Security Manual (ISM) ISM-1139
priority_high

Why it matters

Allowing non-latest TLS versions (e.g., TLS 1.0/1.1) can enable downgrade attacks and weaker ciphers, exposing data in transit to compromise.

settings

Operational notes

Verify servers/clients only negotiate the latest TLS version supported; disable TLS 1.0/1.1, restrict cipher suites, and regularly test with TLS scanners.

build

Implementation tips

  • IT team: Update systems to the latest TLS version. For each system on your list that isn't using the latest version, follow the system's documentation to upgrade its TLS version. Ensure you test systems function correctly after upgrading.
  • Procurement: Ensure new software and services support the latest TLS version. When purchasing or subscribing to new digital services, check their specifications to confirm they support the current TLS version.
  • Office manager: Talk to your IT provider about TLS security. If you use an external IT service, ask them if your systems are using the latest TLS version and how they are keeping it up-to-date.
  • Staff: Report any secure connection warnings to IT. If you see warnings about insecure connections or certificates while using business applications, inform IT immediately so they can check the TLS settings.
fact_check

Audit / evidence tips

  • AskA list of systems and their current TLS versions: Request a report from the IT team showing each system and the TLS version it is using GoodAll systems listed with the latest TLS version clearly indicated
  • AskMaintenance records of TLS updates: Request documentation showing when each system was last updated for TLS GoodRecent dates and the latest version of TLS on every system
  • AskTo see purchasing guidelines for software and services: Request the procurement policy or guidelines GoodA clear stipulation that vendors must support the latest TLS version
  • AskTeam members about reports of security warnings: Speak to IT and staff about any security warnings related to TLS issues GoodDocumented reports with follow-ups indicating resolved or harmless status
  • AskAn IT service provider agreement: Request the contract or service agreement with your IT provider GoodThe agreement includes explicit terms about using current TLS versions
link

Cross-framework mappings

How ISM-1139 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.

ISO 27001

Control Notes Details
layers Partially meets (1) expand_less
Annex A 8.24 ISM-1139 requires organisations to only use the latest version of TLS for TLS connections to protect confidentiality and integrity in tra...

These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.

Mapping detail

Mapping

Direction

Controls