What does ASD ISM 1972 require?

policyASD Information Security Manual (ISM)

ASD ISM 1972ASD Security Control Assessment of TOP SECRET Cloud Services Every 24 Months

Official control statement

Outsourced cloud service providers and their TOP SECRET cloud services, including sensitive compartmented information cloud services, undergo a security control assessment by ASD assessors (or their delegates), using the latest release of the ISM available prior to the beginning of the security control assessment (or a subsequent release), at least every 24 months.

policyASD Information Security Manual (ISM)ISM-1972

Quoted as published. Everything else on this page is written by Control Stack.

In plain English

Outsourced TOP SECRET cloud providers and services (including SCI services) get an ASD-led ISM assessment at least every two years, against the current ISM at the time it starts.

TSASD Information Security ManualGuidelines for procurement and outsourcing

Control Stack classificationDetective Cloud security Assurance and audit

record_voice_over

What this means in practice

If your organisation uses an outsourced cloud provider for TOP SECRET workloads, including sensitive compartmented information (SCI) cloud services, you cannot rely on the provider's own word or on a generic commercial certification. This control requires that both the provider and the specific TOP SECRET cloud services it delivers are assessed by ASD assessors, or people ASD has delegated to do so, and that the assessment is repeated at least every 24 months. The assessment must use the latest release of the ISM that was available before the assessment began (or a later release). That matters because the ISM changes several times a year, and an assessment against an out-of-date baseline can miss controls that have been added or strengthened since. Why it matters: TOP SECRET and SCI data sits at the very top of the classification scale. A cloud provider hosting it is a single point of enormous concentration risk. Cloud platforms also change constantly, with new regions, features, staff and supply-chain components, so an assessment done once and never repeated quickly stops reflecting reality. A regular, independent, ASD-level assessment is how the organisation gets ongoing assurance that the provider and its services still meet the bar before it keeps trusting them with the nation's most sensitive information.

01 - Overview

Framework

ASD Information Security Manual (ISM)

Control effect (Control Stack)

Detective

Classifications

ISM last updated

Sept 2026

Control Stack last updated

29 Sept 2026

E8 maturity levels

N/A

Guideline

Guidelines for procurement and outsourcing

Section

Managed services and cloud services

Topic

Assessment of outsourced cloud service providers

priority_high

Why it matters

Without a current ASD security control assessment, the organisation is placing TOP SECRET and SCI data with a provider whose controls have not been independently verified against the ISM, or were verified against a version that is now out of date. Weaknesses introduced by platform changes, new services, staffing or supply-chain shifts can go unnoticed for years. If a compromise occurs, the consequences are at the highest end: exposure of TOP SECRET material, harm to national security, and loss of the authority to keep operating the service.

settings

Operational notes

Day to day, this control is mostly about tracking and coordination rather than technical work. Someone in the organisation needs to own the register of outsourced TOP SECRET and SCI cloud services, know the date each provider and service was last assessed, and know when the 24-month window closes. Because ASD assessment capacity is limited and the work is significant, engagement with ASD (or its delegates) should start well before the deadline rather than in the final weeks.

When planning an assessment, confirm which ISM release is the latest available at the start date and record it, so there is no dispute later about the baseline used. If a new ISM release lands part-way through, the team may choose to assess against the newer release, but must not fall back to an older one.

Keep the scope honest: every outsourced TOP SECRET cloud service and every SCI cloud service must be inside the assessment, and new services or major changes should be flagged to the assessment owner as they appear so the next assessment covers them. Treat the assessment report and any findings as living inputs to the organisation's authorisation decisions for the service.

02 - Implement

build

Implementation tips

The CISO or system owner maintains a register listing every outsourced cloud service provider and each TOP SECRET cloud service and sensitive compartmented information cloud service it delivers, so the full assessment scope is known before engaging assessors.
The security governance lead records, for each provider and service, the completion date of the last ASD security control assessment and calculates a due date no later than 24 months after it, tracked in the organisation's compliance calendar with early warnings.
The system owner engages ASD, or assessors ASD has delegated, well ahead of the due date to book the security control assessment and agree the scope, timing and access the provider will need to give.
The assessment coordinator identifies the latest ISM release available before the assessment start date, records that version in the assessment plan, and confirms with the assessors that this release (or a later one) is the baseline used.
The provider relationship manager works with the cloud service provider ahead of time to assemble the evidence, environment access and staff availability the assessors will need, so the assessment can start on schedule and cover all in-scope services.

03 - Audit

fact_check

Audit / evidence tips

AskAsk for the register of outsourced cloud service providers and their TOP SECRET cloud services, including any sensitive compartmented information cloud services.Look atCompare the register against the scope of the most recent security control assessment to see whether every provider and service is covered.GoodEvery outsourced TOP SECRET and SCI cloud service in use appears in the assessment scope, with no services running outside it.
AskAsk for the most recent security control assessment report for each provider and service.Look atCheck who performed the assessment and confirm they were ASD assessors or delegates authorised by ASD.GoodThe report is clearly issued by ASD or an ASD-delegated assessor, not by the provider itself or an unaffiliated third party.
AskAsk for the assessment plan or report section that states the ISM release used.Look atCompare the stated ISM release to the ISM releases published before the assessment start date.GoodThe assessment used the latest ISM release available before it began, or a later release, and the version is explicitly recorded.
AskAsk for the dates of the last two assessments and the schedule for the next one.Look atCalculate the gap between assessments and the time remaining to the next due date.GoodNo more than 24 months separates consecutive assessments, and the next one is already scheduled with ASD or its delegates inside the window.
AskAsk how new or changed TOP SECRET cloud services are brought into assessment scope.Look atLook for change records or onboarding steps that notify the assessment owner and update the register.GoodNew services and significant changes are captured in the register promptly and are included in the next scheduled assessment.

04 - Mappings

link

Cross-framework mappings

How ISM-1972 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.

ISO 27001

Control	Notes	Details
layersPartially meets(2)expand_less
Annex A 5.21	ISM-1972 establishes a formal, recurring ASD assessment requirement for outsourced TOP SECRET cloud services to validate their security c...
Annex A 5.35	ISM-1972 requires outsourced TOP SECRET cloud service providers and their services to undergo an ASD-led (or delegate-led) ISM security c...
sync_altPartially overlaps(2)expand_less
Annex A 5.19	ISM-1972 requires outsourced TOP SECRET cloud service providers (including SCI cloud services) to undergo an ASD assessor (or delegate) s...
Annex A 5.22	ISM-1972 requires a recurring (at least 24-monthly) security control assessment of outsourced TOP SECRET cloud services performed by ASD ...