ASD ISM 1563 Assessor produces security assessment report covering required content
What it says
At the conclusion of a security control assessment for a system, a security assessment report is produced by the assessor and covers: - the scope of the security control assessment - the system's strengths and weaknesses - security risks associated with the operation of the system - the effectiveness of the implementation of security controls - any recommended remediation actions.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishWhen a system's security control assessment finishes, the assessor writes a report setting out scope, strengths and weaknesses, operating risks, control effectiveness and recommended fixes.
A security control assessment is only useful if its results are written down in a form that decision-makers can act on. This control requires that, once the assessment of a system is complete, the assessor (not the system owner) produces a security assessment report. The report must cover five things: what was and was not assessed (the scope), where the system is strong and where it is weak, the security risks that come with operating the system, how effectively the security controls have actually been implemented, and what remediation actions the assessor recommends. It matters because the report is the bridge between the assessment and every decision that follows it, such as whether to authorise the system to operate, which weaknesses to fix first and what risk the organisation is accepting. If the report is missing, incomplete or written by someone other than the assessor, the organisation may authorise a system without understanding its real weaknesses, or spend remediation effort on the wrong things. A clear scope statement also stops a report being read as covering more than it does.
Free. Save your status, tasks and notes.
Why it matters
Without a complete assessor-produced report, the organisation authorises and operates the system on incomplete or second-hand information. Weaknesses and operating risks found during the assessment can go unrecorded and unremediated, the effectiveness of controls cannot be demonstrated to the authorising officer or auditors, and gaps in scope can be mistaken for assurance, leaving exploitable weaknesses in place.
How to implement
The security governance lead defines a security assessment report template with mandatory headings for scope, system strengths and weaknesses, security risks of operating the system, effectiveness of control implementation, and recommended remediation actions, and issues it to all assessors.
The assessor, at the conclusion of each system's security control assessment, drafts the report themselves using the template, rather than delegating drafting to the system owner or project team.
The assessor writes the scope section to state the system boundary, the controls and environments assessed, the assessment methods used and any exclusions, so readers can see exactly what the findings cover.
The assessor records each weakness alongside the affected controls, an assessment of how effectively those controls are implemented, the resulting security risk to operating the system and a specific recommended remediation action, and records strengths in their own section.
The system owner adds a close-out step to the assessment process that checks the report has been received from the assessor and contains all five required elements before the assessment is marked complete and the report is filed with the system's authorisation records.
Keep it running
In practice this control is applied at the close-out of every security control assessment for a system. The assessor drafts the report against a standard template that has a mandatory section for each of the five required elements, so nothing is dropped under time pressure. The scope section should state the system boundary, the controls and environments assessed, and anything excluded. Findings are usually organised so that each weakness is tied to the affected controls, the resulting security risk and a recommended remediation action, with strengths recorded separately so the report gives a balanced picture.
Day to day, the report is delivered to the system owner and the authorising officer at the end of the assessment, filed with the system's authorisation records, and used as the input to the remediation plan and the authorisation decision. When a system is reassessed, the new report is produced fresh by the assessor and the previous report is retained for comparison. Track report completion as part of assessment close-out so an assessment is not considered finished until the report exists and covers all five elements.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the security assessment report from the most recent security control assessment of the system.
Look at
Check who authored the report and whether it was produced at the conclusion of the assessment.
Good evidence
The report is written and issued by the assessor, and its date aligns with the completion of the assessment.
- Check 2 of 5What an auditor asks for
Ask for
Ask for the scope section of the report.
Look at
Look for a clear statement of the system boundary, the controls and environments assessed, and any exclusions.
Good evidence
The scope is explicit enough that a reader can tell what the findings do and do not cover.
- Check 3 of 5What an auditor asks for
Ask for
Ask where the report records the system's strengths and weaknesses.
Look at
Check that both strengths and weaknesses are documented, not just a list of failures.
Good evidence
The report gives a balanced picture, with specific strengths and specific weaknesses tied to the assessed controls.
- Check 4 of 5What an auditor asks for
Ask for
Ask for the sections covering security risks of operating the system and the effectiveness of control implementation.
Look at
Check that risks are stated in terms of operating the system and that each control area has an effectiveness judgement.
Good evidence
Operating risks are clearly described and the report states how effectively controls have actually been implemented, not just whether they exist on paper.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the recommended remediation actions in the report.
Look at
Check that each identified weakness has a corresponding recommended action from the assessor.
Good evidence
Every weakness is matched to a specific, practical remediation recommendation.
Mappings
Closest match in ISO/IEC 27001: A.5.35, Independent review of information security, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.5.35.
ISM-1563 requires producing a security assessment report documenting scope, control effectiveness, risks and remediation. ISO/IEC 27001:2022 Annex A 5.35 overlaps as it involves documenting findings, weaknesses and improvement actions from an independent review of information security. While ISM-1563 is focused on a system security control assessment, Annex A 5.35 has a broader governance emphasis.
This control partially overlaps A.8.34.
ISM-1563 requires the assessor to produce a security assessment report that documents assessment scope, strengths/weaknesses, risks, control effectiveness and remediation actions. ISO/IEC 27001:2022 Annex A 8.34 relates by requiring audit/assurance activities on operational systems to be planned and agreed, which influences the scope and constraints of the assessment required in ISM-1563. However, Annex A 8.34 emphasises audit planning, while ISM-1563 focuses on the report's required contents.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.