What does ASD ISM 1437 require?

policyASD Information Security Manual (ISM)

ASD ISM 1437Utilising Cloud Providers for Hosting Online Services

Official control statement

Cloud service providers are used for hosting online services.

policyASD Information Security Manual (ISM)ISM-1437

Quoted as published. Everything else on this page is written by Control Stack.

In plain English

Online services are hosted using cloud service providers for improved service continuity.

NC OS PASD Information Security ManualGuidelines for networking

Control Stack classificationProactive Cloud security Redundancy and high availability

record_voice_over

What this means in practice

Using cloud service providers to host your online services helps ensure that your business can keep running smoothly, even if something goes wrong with your local IT setup. This matters because if your services are only hosted on-site and your office loses power or internet, your customers won't be able to access what they need, which could hurt your business reputation and bottom line.

01 - Overview

Framework

ASD Information Security Manual (ISM)

Control effect (Control Stack)

Proactive

Classifications

NC, OS, P, S, TS

ISM last updated

Mar 2022

Control Stack last updated

29 Sept 2026

E8 maturity levels

N/A

Guideline

Guidelines for networking

Section

Service continuity for online services

Topic

Cloud-based hosting of online services

priority_high

Why it matters

If cloud hosting isn't used, outages in local IT systems may disrupt services, damaging reputation and incurring financial losses.

settings

Operational notes

Review cloud SLAs, hosting locations and resilience (multi-AZ/region, backups) to meet availability and security needs.

02 - Implement

build

Implementation tips

System owners should collaborate with the IT team to choose a suitable cloud provider for hosting services. Start by listing out necessary features like storage, scalability, and security standards, ensuring that the provider meets the service requirements.
IT teams should set up regular backups for services hosted in the cloud. This can be done by configuring automated backup processes within the cloud platform to ensure data is not lost or disrupted during service outages.
Managers should conduct training sessions for staff on how to manage services in the cloud. This can involve simple workshops that show everyday operations and basic troubleshooting without needing to be an IT expert.
Procurement teams should negotiate a service level agreement (SLA) with the cloud provider. Ensure it covers uptime guarantees, data recovery processes, and support services that meet your organisation's needs.
Security teams should work with the cloud provider to establish clear security controls. This can be achieved by identifying necessary security measures and confirming they align with your organisation's requirements and best practices advised by the Australian Cyber Security Centre.

03 - Audit

fact_check

Audit / evidence tips

AskThe list of cloud providers your organisation usesLook atEach provider's service level agreement (SLA), particularly focusing on uptime guarantees and support termsGoodIncludes SLAs that commit to high availability and prompt support response times
GoodShows backups being done automatically and stored in a secure off-site location
AskTraining materials or a training schedule related to cloud service managementLook atEvidence of regular sessions and participation by relevant staffGoodIncludes recent training records with attendee lists and material covered
Look atThe details on uptime, data recovery, and support aspectsGoodIncludes comprehensive SLAs that match your organisation's needs
AskDocumentation on security controls and risk assessments for cloud servicesLook atClear descriptions of how data is protected and access is managedGoodHas documented policies aligned with best practices like those from the Australian Cyber Security Centre