ASD ISM 1563Assessor Produces Security Assessment Report Covering Required Content
Official control statement
At the conclusion of a security control assessment for a system, a security assessment report is produced by the assessor and covers: - the scope of the security control assessment - the system's strengths and weaknesses - security risks associated with the operation of the system - the effectiveness of the implementation of security controls - any recommended remediation actions.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
When a system's security control assessment finishes, the assessor writes a report setting out scope, strengths and weaknesses, operating risks, control effectiveness and recommended fixes.
What this means in practice
A security control assessment is only useful if its results are written down in a form that decision-makers can act on. This control requires that, once the assessment of a system is complete, the assessor (not the system owner) produces a security assessment report. The report must cover five things: what was and was not assessed (the scope), where the system is strong and where it is weak, the security risks that come with operating the system, how effectively the security controls have actually been implemented, and what remediation actions the assessor recommends. It matters because the report is the bridge between the assessment and every decision that follows it, such as whether to authorise the system to operate, which weaknesses to fix first and what risk the organisation is accepting. If the report is missing, incomplete or written by someone other than the assessor, the organisation may authorise a system without understanding its real weaknesses, or spend remediation effort on the wrong things. A clear scope statement also stops a report being read as covering more than it does.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Detective
Classifications
NC, OS, P, S, TS
ISM last updated
Sept 2026
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Topic
Security assessment report
Why it matters
Without a complete assessor-produced report, the organisation authorises and operates the system on incomplete or second-hand information. Weaknesses and operating risks found during the assessment can go unrecorded and unremediated, the effectiveness of controls cannot be demonstrated to the authorising officer or auditors, and gaps in scope can be mistaken for assurance, leaving exploitable weaknesses in place.
Operational notes
In practice this control is applied at the close-out of every security control assessment for a system. The assessor drafts the report against a standard template that has a mandatory section for each of the five required elements, so nothing is dropped under time pressure. The scope section should state the system boundary, the controls and environments assessed, and anything excluded. Findings are usually organised so that each weakness is tied to the affected controls, the resulting security risk and a recommended remediation action, with strengths recorded separately so the report gives a balanced picture.
Day to day, the report is delivered to the system owner and the authorising officer at the end of the assessment, filed with the system's authorisation records, and used as the input to the remediation plan and the authorisation decision. When a system is reassessed, the new report is produced fresh by the assessor and the previous report is retained for comparison. Track report completion as part of assessment close-out so an assessment is not considered finished until the report exists and covers all five elements.
Implementation tips
- The security governance lead defines a security assessment report template with mandatory headings for scope, system strengths and weaknesses, security risks of operating the system, effectiveness of control implementation, and recommended remediation actions, and issues it to all assessors.
- The assessor, at the conclusion of each system's security control assessment, drafts the report themselves using the template, rather than delegating drafting to the system owner or project team.
- The assessor writes the scope section to state the system boundary, the controls and environments assessed, the assessment methods used and any exclusions, so readers can see exactly what the findings cover.
- The assessor records each weakness alongside the affected controls, an assessment of how effectively those controls are implemented, the resulting security risk to operating the system and a specific recommended remediation action, and records strengths in their own section.
- The system owner adds a close-out step to the assessment process that checks the report has been received from the assessor and contains all five required elements before the assessment is marked complete and the report is filed with the system's authorisation records.
Audit / evidence tips
- AskAsk for the security assessment report from the most recent security control assessment of the system.Look atCheck who authored the report and whether it was produced at the conclusion of the assessment.GoodThe report is written and issued by the assessor, and its date aligns with the completion of the assessment.
- AskAsk for the scope section of the report.Look atLook for a clear statement of the system boundary, the controls and environments assessed, and any exclusions.GoodThe scope is explicit enough that a reader can tell what the findings do and do not cover.
- AskAsk where the report records the system's strengths and weaknesses.Look atCheck that both strengths and weaknesses are documented, not just a list of failures.GoodThe report gives a balanced picture, with specific strengths and specific weaknesses tied to the assessed controls.
- AskAsk for the sections covering security risks of operating the system and the effectiveness of control implementation.Look atCheck that risks are stated in terms of operating the system and that each control area has an effectiveness judgement.GoodOperating risks are clearly described and the report states how effectively controls have actually been implemented, not just whether they exist on paper.
- AskAsk for the recommended remediation actions in the report.Look atCheck that each identified weakness has a corresponding recommended action from the assessor.GoodEvery weakness is matched to a specific, practical remediation recommendation.
Cross-framework mappings
How ISM-1563 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
sync_altPartially overlaps(2)expand_less | ||
| Annex A 5.35 | ISM-1563 requires producing a security assessment report documenting scope, control effectiveness, risks and remediation | |
| Annex A 8.34 | ISM-1563 requires the assessor to produce a security assessment report that documents assessment scope, strengths/weaknesses, risks, cont... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Cyber security documentation
See all Guidelines for cyber security documentation controls, or browse the full ASD ISM library.