ASD ISM 1369 Ensure TLS connections use AES-GCM encryption
What it says
AES-GCM is used for encryption of TLS connections.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse AES-GCM to securely encrypt information sent over TLS connections.
This control is about making sure the information you send over the internet is hard for others to read, by using a type of encryption called AES-GCM. This matters because if your data isn't properly protected, cybercriminals could intercept and misuse sensitive information, such as customer details or financial data.
Free. Save your status, tasks and notes.
Why it matters
If TLS does not use AES-GCM, weaker ciphers may be negotiated, increasing the risk of traffic decryption or tampering and data exposure.
How to implement
The IT team should review all systems that use Transport Layer Security (TLS) and ensure they are configured to use AES-GCM for encryption.
They should check the configuration settings of each system or application and update them if necessary to support AES-GCM, following guidance from vendor documentation or security best practices.
System administrators should verify that their current TLS certificates support AES-GCM encryption.
They can do this by checking the details of the certificate through server configuration files or using online tools that analyse the security of TLS connections.
IT staff should work with software vendors to ensure that applications are up-to-date and support AES-GCM encryption.
They should consult with vendors to understand the technical requirements and update processes to enable this feature in any third-party applications used by the organisation.
Network administrators should conduct periodic checks to confirm that AES-GCM is actually being used in TLS connections.
They can use network monitoring tools or logging features built into security software to examine TLS traffic and ensure AES-GCM is the encryption method.
The IT manager should organise regular security training sessions for IT staff on the importance of using strong encryption like AES-GCM.
These sessions should cover how encryption protects data and the specific steps staff need to take to ensure compliance with this control.
Keep it running
Regularly review server/client TLS cipher suites to ensure AES-GCM is enabled and preferred; monitor config changes and disable legacy CBC/RC4 suites.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
The network configuration documentation: Review the files that detail TLS setup and encryption methods.
Look at
Mentions of AES-GCM as an enabled encryption protocol.
Good evidence
Is a clear setting showing AES-GCM in use across relevant systems.
- Check 2 of 4What an auditor asks for
Ask for
The network security monitoring reports: These should show recent checks on TLS traffic.
Look at
Logs or reports that demonstrate AES-GCM is actively used in corresponding connections.
Good evidence
Result shows consistent use of AES-GCM over time with no exceptions.
- Check 3 of 4What an auditor asks for
Ask for
Records showing discussions with vendors about enabling AES-GCM.
Look at
Documented confirmations and action items from vendors regarding AES-GCM compatibility. Good evidence includes minutes stating that necessary updates have been implemented.
- Check 4 of 4What an auditor asks for
Ask for
Training records for IT staff: Request evidence of training sessions that cover encryption practices, specifically AES-GCM.
Look at
Attendee lists and training agendas that mention AES-GCM.
Good evidence
Result includes recent training attendance and topics showing AES-GCM as covered content.
Mappings
Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.24.
ISM-1369 requires AES-GCM to be used for encryption of TLS connections, a specific approved cipher mode requirement. It is a concrete instance of the rules for the effective use of cryptography that Annex A 8.24 requires to be defined and implemented, since those rules should specify the approved algorithms and modes for protocols such as TLS. Annex A 8.24 is much broader, covering all cryptographic use and key management, whereas ISM-1369 addresses only the TLS encryption algorithm.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.