ASD ISM 1917 Support post-quantum cryptographic algorithms by 2030
What it says
The development and procurement of new cryptographic equipment, applications and libraries ensures support for the use of ML-DSA-87, ML-KEM-1024, SHA-384, SHA-512 and AES-256 by no later than 2030.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishNew cryptographic tools must support specific secure algorithms by 2030 to be ready for future quantum computing.
This control is all about getting ready for the future when computers get super powerful. By 2030, new systems need to be built so they can handle a new kind of security that will work even against these future computers. If we don't prepare, these powerful computers could break our current security, leading to data breaches or even financial loss.
Free. Save your status, tasks and notes.
Why it matters
Without PQC-ready crypto (ML-DSA-87/ML-KEM-1024, SHA-384/512, AES-256) by 2030, data may be broken later via quantum attacks.
How to implement
The IT team should update their software tools to support post-quantum cryptographic algorithms.
They can do this by researching which cryptographic algorithms are recommended, such as AES-256 and SHA-512, and ensuring their tools are compatible with these standards.
Procurement officers should include post-quantum readiness as a requirement when buying new tech gear.
They need to check with vendors if their products will support algorithms like ML-DSA-87 by 2030.
Managers should organise training sessions for their staff to understand the importance of post-quantum security.
They can invite experts to explain how these algorithms protect against future threats.
System owners should inventory current systems and identify which ones need upgrading or replacing.
They can work with their IT team to make a plan ensuring all systems are updated before 2030.
The compliance officer should incorporate a timeline for adopting new cryptographic algorithms into the organisation's security policies.
This involves setting milestones and review points to stay on track for the 2030 deadline.
Keep it running
For all new procurements, verify libraries/equipment support ML-DSA-87, ML-KEM-1024, SHA-384/512 and AES-256, and record compliance to meet the 2030 deadline.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A future-focused technology strategy plan: Request the document outlining the organisation's roadmap for adopting post-quantum algorithms.
Look at
The timelines and milestones.
Good evidence
Has specific dates and actions for updating systems before 2030.
- Check 2 of 5What an auditor asks for
Ask for
Procurement records showing requirements for post-quantum capability.
Look at
Contracts with clauses about support for specific algorithms like ML-KEM-1024.
Good evidence
Includes recent contracts that mention these future security needs.
- Check 3 of 5What an auditor asks for
Ask for
Training records or schedules: Request documentation of staff training sessions on quantum readiness.
Look at
Attendee lists and session content.
Good evidence
Shows regular training sessions carried out with participation across key teams.
- Check 4 of 5What an auditor asks for
Ask for
System inventory updates.
Look at
The records of systems that identify which ones need upgrades.
Good evidence
Shows a list with clear notes on the actions required and completion timelines.
- Check 5 of 5What an auditor asks for
Ask for
Policy documents mentioning post-quantum security: Request the organisation's security policy that includes post-quantum planning.
Look at
Sections about algorithm requirements like SHA-384.
Good evidence
Includes detailed policies on these future approaches.
Mappings
Closest match in ISO/IEC 27001: A.8.26, Defining security requirements for applications, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.8.26.
ISM-1917's focus on supporting specific PQC and strong algorithms by 2030 through procurement and development can be captured within ISO/IEC 27001:2022 Annex A 8.26, which mandates defining security requirements for new applications. Annex A 8.26 is broad, addressing all security requirements, whereas ISM-1917 is a specific cryptography mandate.
This control partially meets A.8.27.
ISM-1917 states that new systems must support specific PQC and strong algorithms by 2030. ISO/IEC 27001:2022 Annex A 8.27 involves secure system architecture principles that could include cryptographic agility and long-term resilience. Annex A 8.27 is broad, while ISM-1917 specifically focuses on certain cryptographic algorithms and a timeline.
This control partially overlaps A.8.24.
Annex A 8.24 requires organisations to define and implement rules for the effective use of cryptography and for cryptographic key management. ISM-1917 overlaps by requiring procurement and development to ensure future support for specific post-quantum and strong algorithms (e.g., ML-DSA-87, ML-KEM-1024, SHA-384/512, AES-256), which is part of defining cryptographic standards under Annex A 8.24. ISM-1917 focuses on capability uplift and roadmap/timelines, whereas Annex A 8.24 also requires operational key management rules and processes beyond algorithm support.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.