What does ASD ISM 1995 require?

policyASD Information Security Manual (ISM)

ASD ISM 1995Use ML-KEM for Secure Key Encapsulation

Official control statement

When using ML-KEM for encapsulating encryption session keys (and similar keys), ML-KEM-768 or ML-KEM-1024 is used, preferably ML-KEM-1024.

policyASD Information Security Manual (ISM)ISM-1995

Quoted as published. Everything else on this page is written by Control Stack.

In plain English

Ensure encryption keys are protected using recommended ML-KEM-768 or ML-KEM-1024 methods.

NC OS PASD Information Security ManualGuidelines for cryptography

Control Stack classificationPreventative Cryptography

record_voice_over

What this means in practice

Using strong methods to protect digital keys that encrypt your data is crucial. If these keys aren't properly secured, your sensitive information could be exposed to hackers, leading to data breaches, financial loss, or damage to your reputation. This control ensures you use the best available methods to keep your encryption keys safe.

01 - Overview

Framework

ASD Information Security Manual (ISM)

Control effect (Control Stack)

Preventative

Classifications

NC, OS, P, S, TS

ISM last updated

Dec 2024

Control Stack last updated

29 Sept 2026

E8 maturity levels

N/A

Guideline

Guidelines for cryptography

Section

Cryptographic algorithms

Topic

Using the Module-Lattice-Based Key Encapsulation Mechanism

priority_high

Why it matters

Using weaker or non-approved KEMs instead of ML-KEM-768/1024 can enable session key compromise, exposing encrypted data and services.

settings

Operational notes

Verify key encapsulation uses ML-KEM-768 or preferably ML-KEM-1024, and block non-approved KEM parameter sets in crypto policies.

02 - Implement

build

Implementation tips

The IT team should ensure that ML-KEM-1024 is used for encrypting keys. This involves updating any software or systems that still use older methods. They should start by identifying existing systems and consult with experts if needed to replace outdated practices.
Managers should schedule regular training sessions for their staff. These sessions should explain the importance of using recommended methods like ML-KEM-1024 to protect digital keys. Managers should coordinate with the IT team to provide easy-to-understand training materials.
Procurement should ensure that any new encryption-related software purchased is compatible with ML-KEM-1024. During purchasing, they should require vendors to confirm this compatibility and get written assurance.
The cyber security officer should create a policy that mandates the use of ML-KEM-1024 for all new projects. This policy should be shared with all team leaders to ensure everyone is on the same page and avoids using weaker methods.
System owners should conduct a review of existing systems to identify where encryption keys are not secured using ML-KEM-1024. They can create a checklist to systematically audit each system and liaise with IT to make necessary changes.

03 - Audit

fact_check

Audit / evidence tips

AskThe encryption method documentation: Request records showing what encryption techniques are employed across systemsLook atMentions of ML-KEM-768 or ML-KEM-1024GoodHas clear documentation showing ML-KEM-1024 as the standard method
AskTo see recent training material: Request any slides, videos, or documents used to train staff on ML-KEM-1024Look atClear explanations and relevance to current practicesGoodShows up-to-date material that staff can understand and apply
AskProcurement records: Request to see purchase orders or contracts with software vendorsLook atClauses requiring ML-KEM-1024 compatibilityGoodIncludes contracts specifying compliance with this standard
AskPolicy documents: Request to see formal policies regarding encryption methodsLook atA mandate for ML-KEM-1024 useGoodHas a signed policy dated recently with clear requirements
AskSystem review reports: Request evidence of the latest system audits for encryption key securityLook atChecklists or reports detailing current encryption methodsGoodIndicates thorough audits aligned with ML-KEM-1024 standards

04 - Mappings

link

Cross-framework mappings

How ISM-1995 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.

ISO 27001

Control	Notes	Details
layersPartially meets(1)expand_less
Annex A 8.24	Annex A 8.24 requires organisations to define and implement rules for effective cryptography use and cryptographic key management

These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.

ISM-1992

Using Hedged Variant of ML-DSA for Digital Signatures

ISM-1993

Use Pre-Hashed ML-DSA Variants Only When Necessary

ISM-1994

Use Correct Hashing for ML-DSA Pre-hashed Variants

ISM-1996

Using Hybrid Schemes for Secure Encryption

ISM-2073

Develop a Post-Quantum Cryptography Transition Plan

ISM-0142