ASD ISM 1636 Security control assessment of systems by own or IRAP assessors
What it says
System owners, in consultation with each system's authorising officer, ensure security controls for each non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET system and its operating environment undergo a security control assessment by their organisation's own assessors or Infosec Registered Assessor Program (IRAP) assessors to determine if they have been implemented correctly and are operating as intended.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSystem owners, working with the authorising officer, get each non-classified to SECRET system and its environment assessed by their organisation's own assessors or IRAP assessors to confirm controls are in place and working.
Writing down that a system has a security control is not the same as the control actually being there and doing its job. This control requires the system owner, working with the system's authorising officer, to have the security controls of every non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET system checked by an assessor. The assessor can be one of the organisation's own assessors or an Infosec Registered Assessor Program (IRAP) assessor, and the check covers not just the system itself but also the operating environment it sits in (the network, facilities, supporting services and processes around it). The assessment answers two questions for each control: has it been implemented correctly, and is it operating as intended? These are different. A firewall rule can exist but be written wrongly (not implemented correctly), or be written correctly but bypassed by a later change (not operating as intended). It matters because authorising officers make decisions about whether a system is safe to run based on what they believe its security posture to be. Without an assessment, that belief rests on self-reporting and good intentions. Real weaknesses, such as controls that were never finished, drifted after a change, or only ever existed on paper, stay invisible until an attacker or an incident finds them first.
Free. Save your status, tasks and notes.
Why it matters
If security control assessments are not carried out, the authorising officer is asked to accept the risk of running a system without evidence from a security control assessment that its controls exist or work. Misconfigured, incomplete or decayed controls on non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET systems go undetected, leaving the information they hold exposed to compromise. The organisation may also be unable to demonstrate to regulators, partners or its own leadership that its systems were assessed by competent assessors, undermining the basis of any authorisation to operate.
How to implement
System owners: build and maintain a register of every non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET system you are responsible for, recording its classification, its operating environment boundary and its named authorising officer, so the full assessment scope is visible.
System owners and authorising officers: for each in-scope system, agree in writing whether the organisation's own assessors or an IRAP assessor will perform the security control assessment, and record the decision and the planned assessment date.
System owners: prepare an assessment pack for the assessor that lists every security control the system claims to implement, plus the system and environment documentation, so each control can be tested for correct implementation and for operation as intended.
Assessors (internal or IRAP): test every control in scope across both the system and its operating environment, recording for each whether it is implemented correctly and whether it is operating as intended, with the evidence that supports that conclusion.
System owners: after the assessment, walk the authorising officer through the findings, log each control that failed either test, and schedule the next assessment so that the system is reassessed as it changes over its life-cycle.
Keep it running
Day to day, this control lives in the relationship between the system owner, the authorising officer and the assessor. System owners keep a current list of the systems they are responsible for, with the classification of each (non-classified, OFFICIAL: Sensitive, PROTECTED or SECRET), so that no in-scope system is missed. For each system they agree with the authorising officer on who will assess it (the organisation's own assessors or an IRAP assessor) and when.
Before an assessment, the system owner gathers the material the assessor will need: the list of security controls the system claims to implement, the system and environment documentation, and access to the people and platforms that will be inspected. During the assessment the assessor tests each control for correct implementation and for operation as intended, covering the operating environment as well as the system. Afterwards, the system owner receives the findings, discusses them with the authorising officer, and records any controls found to be missing, wrong or not operating.
Assessments are not a one-off. Keep the schedule in step with the system life-cycle so that a system is assessed before it is relied on and reassessed as it changes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the register of systems in scope for security control assessment.
Look at
Check that every non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET system is listed with its classification, system owner and authorising officer.
Good evidence
The register is complete and current, and each system can be traced to a completed or scheduled assessment.
- Check 2 of 5What an auditor asks for
Ask for
Ask for evidence of the system owner consulting the authorising officer about the assessment of a sample of systems.
Look at
Look for records (emails, minutes, sign-offs) showing the authorising officer was involved in agreeing the assessor and the assessment approach.
Good evidence
The consultation is documented for each sampled system rather than assumed, and the authorising officer's involvement is clear.
- Check 3 of 5What an auditor asks for
Ask for
Ask who performed each assessment and for evidence of their standing.
Look at
Check that the assessor is either one of the organisation's own assessors or an IRAP assessor, and that this is recorded in the assessment report.
Good evidence
Every assessment names the assessor and their basis for performing it, with no assessments carried out by parties outside those two categories.
- Check 4 of 5What an auditor asks for
Ask for
Ask for the security control assessment report for a sampled system.
Look at
Confirm the report covers the system and its operating environment, and that for each control it states whether it was implemented correctly and whether it is operating as intended.
Good evidence
The report addresses both tests for each control, includes the operating environment, and backs its conclusions with evidence rather than self-attestation.
- Check 5 of 5What an auditor asks for
Ask for
Ask how assessment findings were handled and when the system will next be assessed.
Look at
Look for a record of controls found not implemented correctly or not operating as intended, the resulting discussion with the authorising officer, and the planned reassessment.
Good evidence
Failed controls are tracked to closure, the authorising officer has seen the findings, and reassessment is planned in step with the system's life-cycle.
Mappings
Closest match in ISO/IEC 27001: A.5.35, Independent review of information security, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.5.35.
ISM-1636 requires a security control assessment of each system and its operating environment by organisational assessors or IRAP to confirm controls are implemented correctly and operating as intended. ISO/IEC 27001:2022 Annex A 5.35 relates by requiring independent review of the organisation's information security approach and its implementation at planned intervals or when significant changes occur. Annex A 5.35 is broader at the governance/program level, while ISM-1636 is more specific to system-by-system control assessments tied to authorisation and Australian classification contexts.
This control partially overlaps A.8.34.
ISM-1636 requires system owners (with the authorising officer) to have security controls for systems and their operating environment assessed by internal assessors or IRAP to confirm controls are correctly implemented and operating as intended. ISO/IEC 27001:2022 Annex A 8.34 relates by requiring audit tests/assurance activities on operational systems to be planned and agreed with management, which is a key safeguard when conducting the types of assessments ISM-1636 calls for. Annex A 8.34 focuses on controlling the conduct and safety of audits, whereas ISM-1636 mandates that an independent security control assessment occurs (including assessor source and system classification scope).
ISO/IEC 42001: 1 mapping
This control partially overlaps A.6.2.4.
Annex A 6.2.4 requires the organisation to define and document AI system verification and validation measures and criteria to confirm the system operates as intended. ISM-1636 requires security assessment of system controls and the operating environment to determine if controls are implemented correctly and operating as intended, which overlaps strongly with the 'verification' aspect for security controls within an AI system deployment. ISM-1636 is security-control assurance for systems generally, while Annex A 6.2.4 is AI-system-specific and also includes broader validation (e.g., model performance, bias, robustness, intended use).
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.