ASD ISM 1552 Secure web content with HTTPS only
What it says
All web application content is offered exclusively using HTTPS.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure all web content is delivered over a secure HTTPS connection.
This control means that any content from your website must be delivered through a secure connection, specifically HTTPS, which protects data as it moves between your website and its visitors. Using HTTPS is important because it keeps sensitive information, like personal details and payment data, safe from hackers; if not done, your customers could be at risk of identity theft or fraud.
Free. Save your status, tasks and notes.
Why it matters
Without HTTPS, credentials and session cookies can be intercepted or altered in transit, leading to account compromise, data breaches and reputational damage.
How to implement
Business owners should ensure their website is set up to use HTTPS.
This can be done by purchasing an SSL (Secure Sockets Layer) certificate from a trusted provider and installing it on your server to encrypt data.
The IT team should monitor the website to ensure HTTPS is consistently applied.
This involves checking that all pages automatically redirect from HTTP to HTTPS, which can usually be done through server settings or using a plugin for your website platform.
Managers should ensure staff are informed about why using HTTPS is important.
Hold a brief training session to explain how HTTPS protects data and to heighten awareness of its role in security.
Web developers should configure the Content Security Policy to ensure that all resources that the website loads, such as scripts and images, are also served over HTTPS.
This requires updating the website's codebase to adhere to HTTPS protocols.
IT support should regularly review and renew SSL certificates before they expire.
Set up calendar reminders and automatic renewals with your certificate issuer to avoid lapses.
Keep it running
Enforce HTTPS-only via HSTS and redirects; monitor TLS certificate expiry; and regularly scan for any HTTP resources/mixed content across web pages and APIs.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The website's SSL certificate details: Request documentation that shows the purchase and installation of an SSL certificate.
Look at
The certificate's validity period and the domain name it covers. Good means the certificate covers all sites, is currently valid, and expires in the future.
- Check 2 of 5What an auditor asks for
Ask for
Web server configuration settings: Request a demonstration or a screenshot of server settings showing HTTPS redirection. Check that HTTP requests are automatically redirected to HTTPS. Good means every HTTP request is captured and redirected smoothly.
- Check 3 of 5What an auditor asks for
Ask for
A network traffic report: Request logs or reports showing traffic patterns.
Look at
Entries showing consistent use of HTTPS connections. Good shows no unsecured HTTP traffic and consistent HTTPS usage.
- Check 4 of 5What an auditor asks for
Ask for
A content security policy record: Request documentation on the policies set up to enforce HTTPS. Check for rules that mandate all script, image, and resource loading over HTTPS. Good means all resources conform to HTTPS protocols.
- Check 5 of 5What an auditor asks for
Ask for
The SSL expiry monitoring system: Request evidence of tracking SSL certificate expiry.
Look at
Alerts or reminders set up to renew certificates.
Good evidence
Automated systems or alerts that prevent certificate expiry problems.
Mappings
Closest match in ISO/IEC 27001: A.8.26, Defining security requirements for applications, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.26.
ISM-1552 requires all web application content to be delivered exclusively using HTTPS to protect confidentiality and integrity in transit. Annex A 8.26 requires identifying and approving application security requirements during development or acquisition, which would commonly include a requirement for HTTPS-only delivery. ISM-1552 is a single concrete requirement, whereas Annex A 8.26 is broader and covers the full process of defining and approving multiple security requirements for applications.
This control supports A.8.9.
ISM-1552 requires organisations to configure web applications and associated services so content is delivered only via HTTPS. Annex A 8.9 establishes the need for configuration management to document, implement, monitor and review security configurations, which is a prerequisite for reliably enforcing HTTPS-only (e.g. TLS settings, redirects, HSTS, and disabling HTTP listeners). ISM-1552 specifies the security outcome for web transport, while Annex A 8.9 provides the lifecycle control that makes that outcome sustainable and auditable.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.