ASD ISM 2019 ASD assessment of TOP SECRET gateways every 24 months
What it says
TOP SECRET gateways undergo a security control assessment by ASD assessors (or their delegates), using the latest release of the ISM available prior to the beginning of the assessment (or a subsequent release), at least every 24 months.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishTOP SECRET gateways must be independently assessed by ASD assessors (or their delegates) against a current ISM release at least once every two years.
A TOP SECRET gateway is the boundary system that connects a TOP SECRET network to other networks and controls what passes between them. Because it protects the most sensitive information a government or defence organisation handles, an internal self-check is not enough. This control requires that ASD assessors, or people ASD has delegated to act on its behalf, formally assess the gateway's security controls at least every 24 months. The assessment must be conducted against the latest release of the ISM that was available before the assessment began (or a later release if one comes out during the work). This stops an organisation from being assessed against out-of-date requirements that no longer reflect current threats. Why it matters: gateways drift. Rules get added, patches get missed, architecture changes, and the ISM itself evolves. Without a recurring independent assessment, weaknesses in the one system that stands between a TOP SECRET network and the outside world can go unnoticed for years, and a compromise at that boundary could expose material whose disclosure would cause exceptionally grave damage to national interests.
Free. Save your status, tasks and notes.
Why it matters
If TOP SECRET gateways are not assessed by ASD assessors or their delegates at least every 24 months, or are assessed against a superseded ISM release, weaknesses at the highest-classification boundary can persist undetected. The organisation loses independent assurance that the gateway still meets current requirements, the gateway's authorisation to operate may lapse or be withdrawn, and a compromise at that boundary could expose TOP SECRET information with exceptionally grave consequences for national security.
How to implement
The system owner maintains a register of every TOP SECRET gateway, recording the last assessment completion date, the assessors involved, the ISM release used, and a next-assessment due date set no later than 24 months after the previous assessment.
The security team engages ASD in writing at least six months before each due date to request an ASD assessment, or to confirm who ASD has delegated to perform it, and files the confirmation of the assessors' ASD authority with the gateway's records.
The assessment coordinator checks the current ISM release on the ASD website in the week before the assessment starts, records the release identifier, and agrees with the assessors that this release (or any subsequent release) will be the baseline for the assessment.
The gateway administrators prepare the gateway's architecture documentation, configuration baselines, and control implementation statements mapped to the agreed ISM release so the assessors can evaluate the gateway's security controls efficiently.
The Chief Information Security Officer adds every TOP SECRET gateway's 24-month assessment deadline to the organisation's security calendar with automated reminders at 12, 6 and 3 months, and reports upcoming and overdue assessments to the executive each quarter.
Keep it running
Day to day, this control is about tracking three things for every TOP SECRET gateway: when it was last assessed, who assessed it, and which ISM release was used.
Keep a register of TOP SECRET gateways with the completion date of the last ASD (or delegate) assessment and a due date no more than 24 months later. Treat that due date as a hard deadline and start engagement with ASD well ahead of it, since assessor availability and scoping take time.
Before each assessment begins, record which ISM release is the latest available and confirm with the assessors that this release (or a newer one) is the baseline. If ASD publishes a new ISM release mid-assessment, note whether the assessment moved to the subsequent release.
Confirm and record the assessors' standing: either ASD staff or persons formally delegated by ASD. Retain the engagement correspondence, the assessment report, and evidence of the date the assessment concluded so the next 24-month window can be calculated unambiguously.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the register of TOP SECRET gateways showing the date each one was last assessed.
Look at
Compare the completion date of the most recent assessment for each gateway against today's date and the previous assessment date.
Good evidence
Every TOP SECRET gateway has been assessed within the past 24 months, and the interval between consecutive assessments never exceeds 24 months.
- Check 2 of 5What an auditor asks for
Ask for
Ask for the assessment report and the engagement correspondence for the most recent assessment of each gateway.
Look at
Check who conducted the assessment and whether they were ASD assessors or persons formally delegated by ASD.
Good evidence
The report is issued by ASD, or by assessors whose delegation from ASD is documented in the file.
- Check 3 of 5What an auditor asks for
Ask for
Ask which ISM release was used as the baseline for the most recent assessment.
Look at
Compare the ISM release named in the report with the ISM releases ASD had published before the assessment start date.
Good evidence
The assessment used the latest ISM release available before the assessment began, or a release published after that date.
- Check 4 of 5What an auditor asks for
Ask for
Ask for the schedule or calendar entry for the next assessment of each TOP SECRET gateway.
Look at
Check that a next assessment is planned and that its planned date falls within 24 months of the last completed assessment.
Good evidence
Each gateway has a scheduled assessment with ASD or its delegates that falls inside the 24-month window.
- Check 5 of 5What an auditor asks for
Ask for
Ask for evidence that the organisation confirmed the ISM baseline and assessor authority before the assessment started.
Look at
Look for a scoping document, email or minute that records the agreed ISM release and the assessors' ASD standing, dated before the assessment began.
Good evidence
Pre-assessment records show the ISM release and assessor delegation were confirmed up front rather than reconstructed afterwards.
Mappings
Closest match in ISO/IEC 27001: A.5.35, Independent review of information security, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.35.
ISM-2019 requires TOP SECRET gateways to undergo an independent security control assessment by ASD (or delegates) at least every 24 months using a current ISM release. This aligns with ISO/IEC 27001:2022 Annex A 5.35, which requires independent reviews of the organisation's information security approach and its implementation at planned intervals. ISM-2019 is a more prescriptive, high-assurance instantiation of independent review, specifying assessor type (ASD), assessment baseline (latest ISM) and a fixed periodicity for a specific system class (TOP SECRET gateways).
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.