Skip to content
Cryptography
ASD ISMISM-1139

ASD ISM 1139 Require latest version of TLS for security

What it says

Only the latest version of TLS is used for TLS connections.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Ensure only the latest TLS version is used to secure connections.

This control is about making sure that when information is sent over the internet, it's kept safe and private. We do this by using the latest version of a security protocol called TLS (Transport Layer Security). If we don't, hackers could intercept and access sensitive information like credit card numbers or personal details.

Why it matters

Allowing non-latest TLS versions (e.g., TLS 1.0/1.1) can enable downgrade attacks and weaker ciphers, exposing data in transit to compromise.

How to implement

  1. IT team: Update systems to the latest TLS version.

    For each system on your list that isn't using the latest version, follow the system's documentation to upgrade its TLS version. Ensure you test systems function correctly after upgrading.

  2. Procurement: Ensure new software and services support the latest TLS version.

    When purchasing or subscribing to new digital services, check their specifications to confirm they support the current TLS version.

  3. Office manager: Talk to your IT provider about TLS security.

    If you use an external IT service, ask them if your systems are using the latest TLS version and how they are keeping it up-to-date.

  4. Staff: Report any secure connection warnings to IT.

    If you see warnings about insecure connections or certificates while using business applications, inform IT immediately so they can check the TLS settings.

Keep it running

Verify servers/clients only negotiate the latest TLS version supported; disable TLS 1.0/1.1, restrict cipher suites, and regularly test with TLS scanners.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    A list of systems and their current TLS versions: Request a report from the IT team showing each system and the TLS version it is using.

    Look at

    Systems not using the latest TLS version.

    Good evidence

    All systems listed with the latest TLS version clearly indicated.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Maintenance records of TLS updates: Request documentation showing when each system was last updated for TLS.

    Look at

    The dates and versions installed.

    Good evidence

    Recent dates and the latest version of TLS on every system.

  3. Check 3 of 5What an auditor asks for

    Ask for

    To see purchasing guidelines for software and services: Request the procurement policy or guidelines.

    Look at

    Mentions of TLS version requirements.

    Good evidence

    A clear stipulation that vendors must support the latest TLS version.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Team members about reports of security warnings: Speak to IT and staff about any security warnings related to TLS issues.

    Look at

    Records of reported warnings and responses.

    Good evidence

    Documented reports with follow-ups indicating resolved or harmless status.

  5. Check 5 of 5What an auditor asks for

    Ask for

    An IT service provider agreement: Request the contract or service agreement with your IT provider.

    Look at

    Clauses that mention maintaining up-to-date TLS versions.

    Good evidence

    The agreement includes explicit terms about using current TLS versions.

Mappings

Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.24Effective use of cryptography and key managementPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.