Skip to content
Procurement and outsourcing
ASD ISMISM-1972

ASD ISM 1972 ASD security control assessment of TOP SECRET cloud services every 24 months

What it says

Outsourced cloud service providers and their TOP SECRET cloud services, including sensitive compartmented information cloud services, undergo a security control assessment by ASD assessors (or their delegates), using the latest release of the ISM available prior to the beginning of the security control assessment (or a subsequent release), at least every 24 months.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Outsourced TOP SECRET cloud providers and services (including SCI services) get an ASD-led ISM assessment at least every two years, against the current ISM at the time it starts.

If your organisation uses an outsourced cloud provider for TOP SECRET workloads, including sensitive compartmented information (SCI) cloud services, you cannot rely on the provider's own word or on a generic commercial certification. This control requires that both the provider and the specific TOP SECRET cloud services it delivers are assessed by ASD assessors, or people ASD has delegated to do so, and that the assessment is repeated at least every 24 months. The assessment must use the latest release of the ISM that was available before the assessment began (or a later release). That matters because the ISM changes several times a year, and an assessment against an out-of-date baseline can miss controls that have been added or strengthened since. Why it matters: TOP SECRET and SCI data sits at the very top of the classification scale. A cloud provider hosting it is a single point of enormous concentration risk. Cloud platforms also change constantly, with new regions, features, staff and supply-chain components, so an assessment done once and never repeated quickly stops reflecting reality. A regular, independent, ASD-level assessment is how the organisation gets ongoing assurance that the provider and its services still meet the bar before it keeps trusting them with the nation's most sensitive information.

Why it matters

Without a current ASD security control assessment, the organisation is placing TOP SECRET and SCI data with a provider whose controls have not been independently verified against the ISM, or were verified against a version that is now out of date. Weaknesses introduced by platform changes, new services, staffing or supply-chain shifts can go unnoticed for years. If a compromise occurs, the consequences are at the highest end: exposure of TOP SECRET material, harm to national security, and loss of the authority to keep operating the service.

How to implement

  1. The CISO or system owner maintains a register listing every outsourced cloud service provider and each TOP SECRET cloud service and sensitive compartmented information cloud service it delivers, so the full assessment scope is known before engaging assessors.

  2. The security governance lead records, for each provider and service, the completion date of the last ASD security control assessment and calculates a due date no later than 24 months after it, tracked in the organisation's compliance calendar with early warnings.

  3. The system owner engages ASD, or assessors ASD has delegated, well ahead of the due date to book the security control assessment and agree the scope, timing and access the provider will need to give.

  4. The assessment coordinator identifies the latest ISM release available before the assessment start date, records that version in the assessment plan, and confirms with the assessors that this release (or a later one) is the baseline used.

  5. The provider relationship manager works with the cloud service provider ahead of time to assemble the evidence, environment access and staff availability the assessors will need, so the assessment can start on schedule and cover all in-scope services.

Keep it running

Day to day, this control is mostly about tracking and coordination rather than technical work. Someone in the organisation needs to own the register of outsourced TOP SECRET and SCI cloud services, know the date each provider and service was last assessed, and know when the 24-month window closes. Because ASD assessment capacity is limited and the work is significant, engagement with ASD (or its delegates) should start well before the deadline rather than in the final weeks.

When planning an assessment, confirm which ISM release is the latest available at the start date and record it, so there is no dispute later about the baseline used. If a new ISM release lands part-way through, the team may choose to assess against the newer release, but must not fall back to an older one.

Keep the scope honest: every outsourced TOP SECRET cloud service and every SCI cloud service must be inside the assessment, and new services or major changes should be flagged to the assessment owner as they appear so the next assessment covers them. Treat the assessment report and any findings as living inputs to the organisation's authorisation decisions for the service.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    Ask for the register of outsourced cloud service providers and their TOP SECRET cloud services, including any sensitive compartmented information cloud services.

    Look at

    Compare the register against the scope of the most recent security control assessment to see whether every provider and service is covered.

    Good evidence

    Every outsourced TOP SECRET and SCI cloud service in use appears in the assessment scope, with no services running outside it.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Ask for the most recent security control assessment report for each provider and service.

    Look at

    Check who performed the assessment and confirm they were ASD assessors or delegates authorised by ASD.

    Good evidence

    The report is clearly issued by ASD or an ASD-delegated assessor, not by the provider itself or an unaffiliated third party.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Ask for the assessment plan or report section that states the ISM release used.

    Look at

    Compare the stated ISM release to the ISM releases published before the assessment start date.

    Good evidence

    The assessment used the latest ISM release available before it began, or a later release, and the version is explicitly recorded.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Ask for the dates of the last two assessments and the schedule for the next one.

    Look at

    Calculate the gap between assessments and the time remaining to the next due date.

    Good evidence

    No more than 24 months separates consecutive assessments, and the next one is already scheduled with ASD or its delegates inside the window.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Ask how new or changed TOP SECRET cloud services are brought into assessment scope.

    Look at

    Look for change records or onboarding steps that notify the assessment owner and update the register.

    Good evidence

    New services and significant changes are captured in the register promptly and are included in the next scheduled assessment.

Mappings

Closest match in ISO/IEC 27001: A.5.21, Managing information security in the ICT supply chain, which this control partially meets.

ISO 27001

ISO/IEC 27001: 4 mappings

  • A.5.21Managing information security in the ICT supply chainPartially meets
  • A.5.35Independent review of information securityPartially meets
  • A.5.19Managing information security in supplier relationshipsPartially overlaps
  • A.5.22Monitoring and managing supplier servicesPartially overlaps

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.