ASD ISM 1781 Encrypt network data with ASD-approved cryptography
What it says
All data communicated over network infrastructure is encrypted using ASD-approved cryptography.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure all data over networks is encrypted using approved methods.
This control ensures that all the data sent over networks is scrambled so that only people who are meant to see it can read it. This is important because if data isn't protected like this, anyone snooping around on the network could easily steal sensitive information, like customer details or business secrets.
Free. Save your status, tasks and notes.
Why it matters
Without encryption, sensitive information could be intercepted, leading to data breaches and loss of customer trust, harming business reputation and finances.
How to implement
IT team should ensure that all data transmitted over the network is encrypted.
This involves using software and tools that apply Australian Signals Directorate (ASD)-approved cryptographic methods to scramble data during transmission.
Procurement should work with the IT department to purchase network devices and software that support ASD-approved encryption standards.
They should check product specifications and seek vendor confirmations.
Office managers should collaborate with IT staff to conduct regular training sessions for employees on the importance of network security and the role of encryption.
Use simple analogies to explain how encryption protects data.
Managers should verify that remote work software uses encrypted communications by consulting with IT.
Ask IT to configure tools like Virtual Private Networks (VPNs) that encrypt data traffic for remote workers.
System owners should conduct periodic audits to ensure compliance with encryption policies.
This can involve reviewing security settings with IT to confirm data encryption protocols are properly set up.
Keep it running
Regularly review and update the encryption standards based on ASD latest guidelines to ensure ongoing network data protection.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the network encryption policy document.
Look at
the specified encryption methods and whether they are ASD-approved.
Good evidence
clear examples of approved cryptographic protocols.
- Check 2 of 5What an auditor asks for
Good evidence
detailed logs showing encryption settings being active and compliant.
- Check 3 of 5What an auditor asks for
Ask for
training records on encryption practices.
Look at
attendance and topics covered.
Good evidence
well-documented sessions with a focus on explaining the need for encryption.
- Check 4 of 5What an auditor asks for
Look at
evidence from IT that data is sent securely.
Good evidence
IT showing data capture from a packet inspector displaying encrypted data.
- Check 5 of 5What an auditor asks for
Look at
how encryption compliance is assessed.
Good evidence
an audit report highlighting areas of compliance and any actions to address gaps.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.20.
ISM-1781 requires all data communicated over network infrastructure to be encrypted to protect confidentiality and reduce interception risk. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which typically includes implementing encrypted protocols (e.g. TLS, IPsec, SSH) and secure network configurations. Annex A 8.20 is broader because it covers many network security measures beyond encryption, while ISM-1781 is specifically about encrypting network data in transit.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.