ASD ISM 1971 ASD-led security assessment of TOP SECRET managed services every 24 months
What it says
Managed service providers and their TOP SECRET managed services, including sensitive compartmented information managed services, undergo a security control assessment by ASD assessors (or their delegates), using the latest release of the ISM available prior to the beginning of the security control assessment (or a subsequent release), at least every 24 months.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishProviders running TOP SECRET (including SCI) managed services must be assessed by ASD assessors, or their delegates, against a current ISM release at least every two years.
If you outsource a TOP SECRET system, or a sensitive compartmented information (SCI) system, to a managed service provider, this control says who checks that provider and how often. The assessment cannot be done by the provider's own staff or by any IRAP assessor of the provider's choosing. It must be carried out by ASD assessors, or by people ASD has delegated to do the work, and it covers both the provider as an organisation and the TOP SECRET managed services it operates. The assessment must be measured against a current version of the ISM: the latest release available before the assessment begins, or a newer one. This stops a provider being assessed against out-of-date controls. Finally, the cycle repeats at least every 24 months, so the evidence of good security never goes stale. Why it matters: TOP SECRET and SCI information is the most sensitive material the Australian Government holds, and compromise could cause exceptionally grave damage to national interests. Handing operation of those systems to a third party increases exposure, so the government needs independent, expert and repeated confirmation that the provider's controls actually work.
Free. Save your status, tasks and notes.
Why it matters
Without an ASD-led assessment against a current ISM release every 24 months, a managed service provider could be operating TOP SECRET or SCI systems with unverified or degraded controls. Weaknesses may go undetected for years, the authorising body would have no reliable basis for the provider's continued operation, and any resulting compromise of TOP SECRET information could cause exceptionally grave damage to Australia's security and national interests.
How to implement
The system owner records every TOP SECRET and SCI managed service, the responsible managed service provider, the date of the last ASD assessment and the next due date in a register, and sets reminders at least six months before each 24-month deadline.
The provider's security lead contacts ASD to book the assessment early, confirms whether ASD assessors or ASD delegates will conduct it, and agrees the scope so it covers both the provider organisation and each TOP SECRET and SCI managed service.
The provider's security lead checks the ASD website for the latest ISM release before the assessment starts, confirms that release (or a later one) with the assessors as the baseline, and updates the provider's control mapping to match it.
The provider's operations team prepares evidence against the agreed ISM release for every in-scope service ahead of the assessment, including system security plans, control implementation records and prior assessment findings.
The system owner and provider review the completed assessment report together, record the assessment date as the start of the next 24-month cycle, and track any findings through to closure before the following assessment.
Keep it running
In practice this control is driven by a calendar. Each TOP SECRET managed service (including any SCI managed service) needs a recorded date for its last ASD assessment and a due date no more than 24 months later. Engagement with ASD, or the assessors ASD delegates, needs to start well before that date because scheduling, scoping and evidence collection take time.
Before the assessment begins, confirm which ISM release is current, as that release (or a later one) becomes the baseline. When ASD publishes a new ISM release between assessments, review the changes so the provider is not surprised by new or altered controls at the next assessment.
The scope must include the provider itself as well as the managed services it delivers. Keep the assessment reports, the ISM release used, the dates and the assessor details together so the 24-month cycle can be evidenced for each service.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the register of TOP SECRET and SCI managed services and their providers.
Look at
Check that every such service is listed with its provider, the date of the most recent security control assessment and the next due date.
Good evidence
Every TOP SECRET and SCI managed service appears, and no service shows a gap of more than 24 months between assessments.
- Check 2 of 5What an auditor asks for
Ask for
Ask for the most recent security control assessment report for each service and provider.
Look at
Confirm who conducted the assessment and whether they were ASD assessors or people formally delegated by ASD.
Good evidence
Each report names ASD assessors or ASD delegates, with evidence of the delegation where a delegate was used, rather than an assessor chosen by the provider.
- Check 3 of 5What an auditor asks for
Ask for
Ask which ISM release each assessment was conducted against.
Look at
Compare the release cited in the report with the ISM releases published before the assessment start date.
Good evidence
The release used is the latest one available before the assessment began, or a later release.
- Check 4 of 5What an auditor asks for
Ask for
Ask for the assessment scope document or terms of engagement.
Look at
Check whether the scope covers the managed service provider itself as well as its TOP SECRET managed services, including any sensitive compartmented information managed services.
Good evidence
Both the provider and every in-scope TOP SECRET and SCI managed service are explicitly included, with nothing carved out.
- Check 5 of 5What an auditor asks for
Ask for
Ask for correspondence or scheduling records with ASD for the next assessment.
Look at
Check that engagement with ASD began early enough for the next assessment to finish within 24 months of the previous one.
Good evidence
A booked or confirmed assessment date exists that falls inside the 24-month window, and any past overruns are explained and remediated.
Mappings
Closest match in ISO/IEC 27001: A.5.36, Review compliance with information security policies, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.5.36.
ISM-1971 mandates periodic ASD security assessments for TOP SECRET managed services, providing formal assurance against the ISM baseline. ISO/IEC 27001:2022 Annex A 5.36 requires regular review of compliance with information security policies, rules and standards, which overlaps with using assessments/audits to verify compliance. Annex A 5.36 can be satisfied by internal or external reviews across all policies, whereas ISM-1971 is specifically an ASD (or delegate) assessment focused on TOP SECRET managed services and ISM conformance on a defined 24-month cycle.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.