Skip to content
Cryptography
ASD ISMISM-1802

ASD ISM 1802 Operate approved high assurance cryptographic equipment

What it says

HACE are issued an Approval for Use by ASD and operated in accordance with the latest version of their associated Australian Communications Security Instructions.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Use approved high-security cryptographic tools according to Australian guidelines.

It's all about making sure that when we use high-security equipment to encode information, like secret business emails or customer data, we are following Australia's strict rules. If we don't stick to these guidelines, someone could potentially crack that information open, leading to data breaches that can harm trust and security.

Why it matters

Using non‑ASD approved HACE or operating it outside ACSIs can weaken encryption and key handling, exposing classified/sensitive data and enabling compromise.

How to implement

  1. The IT manager should ensure that only approved cryptographic equipment is used.

    They can do this by checking the Australian Signals Directorate (ASD) list of approved tools and making sure all equipment in use is listed.

  2. Procurement should verify that any new cryptographic equipment being ordered is ASD-approved.

    They need to cross-reference all prospective purchases against the approved list before finalising any order.

  3. The system administrator must keep equipment updated according to the latest Australian Communications Security Instructions.

    They should sign up for updates from the ASD to receive the latest guidelines directly.

  4. Senior management should hold a quarterly meeting with the IT team to review cryptographic practices.

    This meeting should include a review of current equipment and verification against the approved list.

  5. The compliance officer is responsible for ensuring procedures are documented.

    This includes creating a checklist based on ASD guidelines for deploying and maintaining high-security cryptographic equipment.

Keep it running

Regularly verify all HACE retain ASD Approval for Use, and operate/configure them strictly to the latest ACSIs, including key management, physical handling and operator procedures.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The list of all cryptographic equipment in use: Make sure it includes model numbers and purchase dates.

    Look at

    Evidence that each piece of equipment appears on the ASD's approved list.

    Good evidence

    Includes a spreadsheet or document with each item's details and ASD approval noted.

  2. Check 2 of 5What an auditor asks for

    Good evidence

    Will be a document with a recent date that matches the current ASD publications.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Procurement records of cryptographic equipment: Check that every purchase order includes notations of ASD approval checks. Good records highlight a clear process for purchasing only approved equipment.

  4. Check 4 of 5What an auditor asks for

    Ask for

    To see the meeting minutes from quarterly reviews on cryptographic practices: Verify that the minutes discuss equipment validation against the ASD's approved list.

    Good evidence

    Includes detailed minutes showing active management review and compliance.

  5. Check 5 of 5What an auditor asks for

    Good evidence

    Shows regular updates and cross-verification against ASD guidelines.

Mappings

Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.8.24Effective use of cryptography and key managementPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.