ASD ISM 1967 ASD assessor security control assessment of TOP SECRET systems
What it says
System owners, in consultation with each system's authorising officer, ensure security controls for each TOP SECRET system and its operating environment, including each sensitive compartmented information system and its operating environment, undergo a security control assessment by ASD assessors (or their delegates) to determine if they have been implemented correctly and are operating as intended.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishTOP SECRET systems (including SCI systems) and their operating environments must be assessed by ASD assessors or delegates, arranged by system owners with the authorising officer.
Before you can trust that a TOP SECRET system is actually protected, someone independent and suitably qualified needs to check that the security controls exist, were set up properly and are doing their job. For TOP SECRET systems, and for any sensitive compartmented information (SCI) system, that independent check must come from ASD assessors or people ASD has delegated to do the work. The assessment is not limited to the system itself; it also covers the operating environment the system sits in, such as the facility, the people, the processes and the supporting infrastructure. The system owner is responsible for making this happen, and they do it in consultation with the system's authorising officer, the person who will ultimately decide whether the system is allowed to operate. Why it matters: TOP SECRET and SCI systems hold the information whose compromise would cause the most serious damage to national interests. A self-assessment, or an assessment by someone without the right expertise or independence, can miss misconfigured controls, undocumented gaps or controls that look right on paper but do not work in practice. Having ASD assessors (or their delegates) verify that controls are implemented correctly and operating as intended gives the authorising officer a reliable basis for their authorisation decision.
Free. Save your status, tasks and notes.
Why it matters
Without an ASD assessor (or delegate) security control assessment, a TOP SECRET or SCI system may be authorised and operated on the basis of controls that were never independently verified. Misconfigured, missing or non-functioning controls can go undetected, exposing the most sensitive information to compromise. The authorising officer's decision rests on an incomplete picture, the system's authorisation may be invalid, and the organisation may be found non-compliant with the ISM's requirements for TOP SECRET systems.
How to implement
System owners identify and record every TOP SECRET system and every sensitive compartmented information system they are responsible for, together with each system's operating environment, and note the authorising officer for each so that the assessment obligation is visible for the full population.
System owners meet with each system's authorising officer to agree the assessment scope (system plus operating environment), the timing relative to the authorisation decision, and how results will be reported, and record that consultation in the system's authorisation file.
System owners formally request a security control assessment from ASD, or confirm in writing which assessors ASD has delegated to perform it, and obtain the assessor engagement details before any assessment activity starts.
System owners prepare the assessment inputs the assessors will need, including the system security plan, the list of security controls claimed to be implemented and the supporting configuration and procedural evidence, so assessors can test whether each control is implemented correctly and operating as intended.
System owners receive the ASD assessor's security assessment report, brief the authorising officer on the findings, assign owners and dates to any controls found not to be implemented correctly or not operating as intended, and file the report and remediation plan with the system's authorisation records.
Keep it running
In practice this control lives in the system life-cycle rather than in day-to-day operations, but it needs ongoing attention:
- Maintain a register of every TOP SECRET system and every sensitive compartmented information system, with the system owner and authorising officer recorded for each, so nothing is missed when assessments are being scheduled.
- Engage ASD early. Assessment capacity is finite, so system owners should raise the request with ASD (or confirm which delegate ASD has approved) well before the intended authorisation date.
- Scope the assessment to include the operating environment, not just the technology. Facility, personnel, procedural and physical controls that the system relies on should be in scope alongside the system's technical controls.
- Consultation with the authorising officer should be recorded, including agreement on scope, timing and how findings will be handled.
- The assessment outcome (whether each control is implemented correctly and operating as intended) feeds directly into the authorisation package, so keep the security assessment report and any remediation tracking together with the system's authorisation records.
- When a system changes significantly, or is reauthorised, revisit whether a further ASD assessment is needed in consultation with the authorising officer.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the organisation's register of TOP SECRET systems and sensitive compartmented information systems, showing the system owner and authorising officer for each.
Look at
Check that every TOP SECRET and SCI system in operation appears on the register and that each has a named system owner and authorising officer.
Good evidence
A complete register with no unlisted TOP SECRET or SCI systems, and clear accountability recorded for every entry.
- Check 2 of 5What an auditor asks for
Ask for
Ask for evidence that the system owner consulted the authorising officer about the security control assessment for each system.
Look at
Look for meeting records, emails or signed scoping documents showing the authorising officer was involved in agreeing the assessment scope and timing.
Good evidence
Documented consultation for each system, dated before the assessment took place, with the authorising officer's involvement clearly shown.
- Check 3 of 5What an auditor asks for
Ask for
Ask for confirmation of who performed the security control assessment for each TOP SECRET and SCI system.
Look at
Check that the assessors were ASD assessors or that there is written evidence ASD delegated the assessment to the named assessors.
Good evidence
Each assessment was performed by ASD assessors, or by delegates with documented ASD delegation, rather than by internal staff or unapproved third parties.
- Check 4 of 5What an auditor asks for
Ask for
Ask for the security assessment report for each TOP SECRET and SCI system.
Look at
Check that the report covers both the system and its operating environment, and that it states for each security control whether it is implemented correctly and operating as intended.
Good evidence
Reports that address the full scope, including the operating environment, with explicit findings on correctness of implementation and operational effectiveness for each control.
- Check 5 of 5What an auditor asks for
Ask for
Ask how findings from the assessment were handled and how they informed the authorisation decision.
Look at
Look at the remediation tracker and the authorisation documentation to see whether findings were addressed or accepted and whether the authorising officer had the assessment results when authorising the system.
Good evidence
Every finding has an owner and outcome, and the authorisation record references the ASD assessment report as an input to the decision.
Mappings
Closest match in ISO/IEC 27001: A.5.35, Independent review of information security, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.35.
ISM-1967 mandates system owners, in collaboration with authorising officers, ensure ASD assessors conduct security control assessments for TOP SECRET systems to verify implementation and operation. ISO/IEC 27001:2022 Annex A 5.35 broadly requires independent security reviews at planned intervals or after significant changes, without specific requirements on system classification or assessor role. Therefore, Annex A 5.35 is broader as it encompasses general independent review principles.
This control partially overlaps A.8.34.
ISM-1967 specifies the need for assessment of TOP SECRET controls by ASD assessors. ISO/IEC 27001:2022 Annex A 8.34 requires planned and agreed testing and assurance on operational systems, including coordination of audits. While ISM-1967 gives a specific mandate for certain systems, Annex A 8.34 provides guidance on testing arrangement, which overlaps in scope with ISM-1967 in ensuring operational controls are effectively assessed.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.