What does ASD ISM 1990 require?

policyASD Information Security Manual (ISM)

ASD ISM 1990Prefer FIPS 140-3 Validated ML-DSA and ML-KEM Implementations

When using the post-quantum algorithms ML-DSA (FIPS 204) and ML-KEM (FIPS 203), prefer implementations that meet the pre-requisite FIPS 140-3 validation.

Proactive NC OS PASD Information Security ManualGuidelines for cryptography Environment separation Devices March 2026 ISM Update

record_voice_over

Plain language

This control means that when your organisation deploys the post-quantum cryptographic algorithms ML-DSA (defined in FIPS 204) and ML-KEM (defined in FIPS 203), you should prefer implementations that have met the pre-requisite FIPS 140-3 validation. FIPS 140-3 validation confirms that a cryptographic module has been independently tested against a recognised security standard. Choosing validated implementations gives you assurance that these newer quantum-resistant algorithms are built and operating correctly, reducing the risk of weaknesses in how the cryptography is put into practice.

01 - Overview

Framework

ASD Information Security Manual (ISM)

Control effect

Proactive

Classifications

NC, OS, P, S, TS

ISM last updated

Mar 2026

Control Stack last updated

10 Aug 2026

E8 maturity levels

N/A

Guideline

Guidelines for cryptography

Section

Cryptographic algorithms

Topic

Using post-quantum cryptographic algorithms

Official control statement

When using ML-DSA and ML-KEM, as per FIPS 204 and FIPS 203 respectively, adherence to pre-requisite FIPS 140-3 validation is preferred.

policyASD Information Security Manual (ISM)ISM-1990

priority_high

Why it matters

Without preferring FIPS 140-3 validated implementations, ML-DSA and ML-KEM may be deployed with unverified cryptography, undermining the protection these post-quantum algorithms are meant to provide.

settings

Operational notes

Recheck CMVP listings periodically, as FIPS 140-3 validations and the availability of validated ML-DSA and ML-KEM modules change over time.

02 - Implement

build

Implementation tips

Have your cryptography or platform team confirm that any product or library offering ML-DSA or ML-KEM carries a current FIPS 140-3 validation before selecting it.
Check the NIST Cryptographic Module Validation Program (CMVP) listings to verify the FIPS 140-3 validation covers the exact module and version you plan to deploy.
Update procurement and product selection criteria so that FIPS 140-3 validated ML-DSA and ML-KEM implementations are preferred over unvalidated ones.
Configure systems to use ML-DSA in line with FIPS 204 and ML-KEM in line with FIPS 203, disabling any non-conforming modes or parameters.
Maintain an inventory of where ML-DSA and ML-KEM are used and record the FIPS 140-3 validation status of each implementation so validated options can be prioritised.

03 - Audit

fact_check

Audit / evidence tips

AskAsk which systems and services use the ML-DSA and ML-KEM algorithms.GoodA current inventory that identifies each system using ML-DSA or ML-KEM and the specific implementation or module in use.
AskAsk for evidence that the deployed ML-DSA and ML-KEM implementations meet FIPS 140-3 validation.GoodCurrent FIPS 140-3 validation records that match the exact module and version deployed.
AskAsk how the organisation selects cryptographic products that provide these post-quantum algorithms.GoodDocumented criteria that give preference to FIPS 140-3 validated ML-DSA and ML-KEM implementations.
AskAsk how ML-DSA and ML-KEM are configured to conform to FIPS 204 and FIPS 203.GoodConfiguration showing ML-DSA used as per FIPS 204 and ML-KEM as per FIPS 203 with conforming parameters.
AskAsk what the organisation does when a FIPS 140-3 validated implementation is not yet available.GoodA documented rationale and a plan to move to a FIPS 140-3 validated implementation once one is available.

04 - Mappings

link

Cross-framework mappings

How ISM-1990 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.

ISO 27001

Control	Notes	Details
layersPartially meets(1)expand_less
Annex A 8.24	ISM-1990 requires that when implementing ML-DSA and ML-KEM, organisations should also follow the pre-requisite FIPS publications referenc...
handshakeSupports(2)expand_less
Annex A 5.15	ISM-1990 requires organisations to enforce separation between work and personal mobile apps and data, typically via MDM/MAM controls, con...
Annex A 6.7	ISM-1990 requires organisations to keep work and personal apps and data separate on mobile devices to reduce data leakage and cross-conta...

E8

Control	Notes	Details
handshakeSupports(3)expand_less
E8-RA-ML1.5	ISM-1990 requires organisations to keep work and personal apps and data separated on mobile devices to reduce data leakage and cross-cont...
E8-RA-ML1.6	ISM-1990 addresses segregation of work and personal apps/data on mobile devices to prevent inappropriate access or data mixing
E8-RA-ML1.7	ISM-1990 requires separation between work and personal apps and data on mobile devices to limit data leakage pathways