ASD ISM Controls List & Compliance Checklist

The Information Security Manual (ISM) is the cyber security framework published by the Australian Signals Directorate (ASD). It outlines a comprehensive set of principles, guidelines and controls that organisations can apply - using their own risk management framework - to protect information technology and operational technology systems from cyber threats.

The ISM is updated regularly and reflects ASD's considered advice, drawing on its threat intelligence, incident response experience and engagement with Australian organisations. The current edition is dated September 2026 and introduces a dedicated system access guideline, controls for AI agents and agentic AI applications, and MACsec as an approved protocol, building on the AI governance, cryptographic agility (post-quantum readiness) and operational technology changes of earlier 2026 editions.

Unlike prescriptive standards, the ISM is designed to be applied contextually. It describes risks and recommended mitigations - organisations select and tailor controls based on the system's business criticality, data sensitivity, operating environment and risk tolerance.

The ISM is written primarily for security and technology leaders designing, operating and assuring systems.

• Chief Information Security Officers (CISOs) - overall accountability for an organisation's cyber security posture and ISM implementation
• Chief Information Officers (CIOs) - enterprise technology leaders ensuring systems align to ISM controls
• Cyber security professionals - architects, engineers, assessors, analysts implementing and operating controls
• Information technology managers - responsible for the systems to which ISM controls apply
• System owners and authorising officers - individuals authorising systems to operate based on residual risk

While the ISM's primary audience is Australian Government, its principles are increasingly adopted by regulated industries, critical infrastructure operators, defence industry and suppliers delivering services to government.

The ISM represents the considered advice of ASD. This advice is provided in accordance with ASD's designated functions under the Intelligence Services Act 2001.

An organisation is not required as a matter of law to comply with the ISM, unless legislation - or a direction given under legislation or by a lawful authority - compels them to comply. The ISM does not override legal or legislative obligations; where there is conflict, legislation and law take precedence.

Where ASD publishes specific guidance (for example, Australian Communications Security Instructions, or operating system / application / device specific advice), that guidance may take precedence over the general advice in the ISM.

• Archives Act 1983 - record-keeping obligations relevant to logging and retention
• Privacy Act 1988 - personal information handling and notifiable data breaches
• Security of Critical Infrastructure Act 2018 (SOCI) - risk management program obligations for responsible entities
• Telecommunications (Interception and Access) Act 1979 - lawful interception considerations

The ISM explicitly recommends that organisations familiarise themselves with relevant legislation when designing, operating and decommissioning systems - the ISM does not provide comprehensive legal analysis.

The ISM organises its cyber security principles into six strategic functions that describe how an organisation should approach cyber security end-to-end. The functions align with global frameworks such as NIST CSF 2.0.

• Govern (GOV) - establish and maintain a strong, resilient cyber security culture; includes executive accountability, security risk management, supplier assurance, personnel suitability, legacy system management and continuous improvement (GOV-01 through GOV-14)
• Identify (IDE) - identify assets, interdependencies, business criticality, security and resilience requirements, and security risks (IDE-01 through IDE-06)
• Protect (PRO) - implement controls to manage security risks including secure lifecycle, supply chain security, identity and access management, vulnerability management, cryptography, segmentation and OT isolation (PRO-01 through PRO-20)
• Detect (DET) - centralised logging, baselining high-risk access, event detection, incident identification and detection capability efficacy (DET-01 through DET-05)
• Respond (RES) - incident planning, coordination, response, reporting and insights from lessons learnt (RES-01 through RES-05)
• Recover (REC) - system recovery assurance and business operations resumption (REC-01, REC-02)

Within each function, principles are listed in a logical implementation sequence - but the numeric identifiers (GOV-01, PRO-08, etc.) are labels, not an ordered workflow. Principles are interdependent and must be implemented collectively.

The ISM has a three-layer structure. Understanding the distinction between layers is essential to interpreting and applying the ISM correctly.

• Cyber security principles (strategic) - high-level outcomes grouped by function (Govern, Identify, Protect, Detect, Respond, Recover). They describe what good cyber security looks like at the organisational level
• Cyber security guidelines (domain-specific) - practical guidance organised by topic (e.g. system hardening, cryptography, email, gateways, enterprise mobility). Each guideline discusses the risks and recommended treatments for its domain
• Cyber security controls (tactical) - specific, measurable requirements embedded within guidelines. Controls are the items listed in Control Stack with identifiers like ISM-0123

Controls do not form an exhaustive list for any specific system. The ISM expects organisations to supplement the controls with context-specific mitigations identified through their own risk analysis.

Every ISM control carries an applicability marking that signals the classification level of systems it applies to. Markings let organisations tailor control selection to the sensitivity of each system.

• NC - Non-classified: controls applicable to all systems, including government and non-government systems that do not handle classified information
• OS - OFFICIAL: Sensitive: controls for systems processing OFFICIAL: Sensitive information
• P - PROTECTED: controls for systems processing PROTECTED information
• S - SECRET: controls for systems processing SECRET information
• TS - TOP SECRET: controls for systems processing TOP SECRET information, including sensitive compartmented information

Higher-classification markings generally include stricter requirements (for example: tighter patch timelines, phishing-resistant MFA, more rigorous key management, stronger physical security).

The ISM draws from NIST SP 800-37 Rev. 2 (Risk Management Framework for Information Systems and Organizations) and defines a six-step lifecycle for applying cyber security to a system.

This framework is the recommended operational approach to selecting and applying ISM controls. It is system-oriented - every system operated by the organisation should go through these steps.

• 1. Define the system - determine the system boundary, business criticality and security/resilience objectives based on compromise impact; document in the system security plan
• 2. Select controls - select and tailor controls to meet objectives; document in the system security plan annex; authorising officer approves control selection
• 3. Implement controls - deploy controls; record actual (vs planned) implementation in the system security plan annex
• 4. Assess controls - assessor verifies controls operate as intended; produce a security assessment report identifying strengths, weaknesses, remaining risks and remediation actions
• 5. Authorise the system - authorising officer decides whether to accept residual security risks and issue an authorisation to operate (ATO), with or without constraints
• 6. Monitor the system - continuous monitoring of threats, risks and control effectiveness; trigger events include incidents, policy changes and major architectural changes

Before a system handling government information can operate, it must be formally authorised. The authorising officer decides whether the residual risks are acceptable and issues an authorisation to operate (ATO).

The authorising officer must receive an authorisation package including the system security plan, incident response plan, change and configuration management plan, continuous monitoring plan, security assessment report, and plan of action and milestones.

• Non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET systems - authorising officer is the organisation's CISO (or delegate)
• TOP SECRET systems (including sensitive compartmented information systems) - authorising officer is the Director-General ASD (or delegate)
• Commercial providers serving an organisation - authorising officer is the CISO of the supported organisation (or delegate)
• Multi-organisation / multi-stakeholder systems - a single authorising officer may be agreed via formal arrangement, or multiple may issue a joint ATO
• Where no CISO exists - a chief security officer, CIO or other senior executive with appropriate seniority and understanding of the risks may serve as authorising officer

Authorisations can be granted with constraints (limiting functionality, time-bounded) or denied pending further remediation. After control changes or significant risk events, the authorisation package should be updated and revisited.

Security assessments validate that controls are implemented correctly and operating as intended. The ISM sets out who may conduct assessments based on system classification.

• Non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET systems - assessments may be conducted by the organisation's own assessors or by Infosec Registered Assessors Program (IRAP) assessors
• TOP SECRET systems, including sensitive compartmented information systems - assessments are conducted by ASD assessors (or their delegates)
• Assessors should hold appropriate security clearance and have sufficient experience and understanding of the type of system being assessed
• The assessment scope - type and extent of activities - should be agreed between the assessor, system owner and authorising officer, typically in a security assessment plan

IRAP assessors are endorsed by ASD. Their reports are widely relied upon by Commonwealth customers procuring cloud and managed services. An IRAP assessment is distinct from an ATO - IRAP provides the assessment report; the authorising officer issues the authorisation.

The September 2026 edition (OSCAL 2026.09.4, published in early September 2026) adds 44 controls (ISM-2124 to ISM-2167), revises the wording of more than 100 existing controls, rescinds ISM-0521 (disabling unused IPv6 in dual-stack devices) and merges ISM-1448 (ephemeral DH and ECDH for TLS) into ISM-1372. Its biggest structural change is a new guideline, Guidelines for system access, which brings identity, authentication and credential controls together in one place. The introductory chapter is now titled Using the cyber security framework.

• Guidelines for system access (new): 123 controls across two sections, Identity and access management and Credential management. All existing controls in it were moved from the personnel security and system hardening guidelines; 16 are new.
• AI agents as identities: each AI agent gets a unique identity distinct from personnel and other agents (ISM-2133), backed by an AI agent register recording owner, purpose, identities, credentials and permissions (ISM-2134, ISM-2135).
• Agentic AI applications: minimum tools and permissions (ISM-2156), tool calls bound by both the invoking user and the agent (ISM-2157), retrieved content treated as untrusted and kept separate from instructions (ISM-2158), and central logging of tool invocations, external requests and outputs (ISM-2159). AI applications now require human approval before sensitive or high-impact actions (ISM-2113).
• OAuth and device code flows: only an authorised administrator may consent to third-party OAuth applications (ISM-2137), consents reviewed at least every six months with unused applications and excessive permissions revoked (ISM-2138), consent and token activity centrally logged (ISM-2139), and device code authentication disabled unless required (ISM-2140), plus risk-based access decisions from contextual signals (ISM-2136).
• Tokens and sessions: authentication tokens, session cookies and refresh tokens cryptographically bound to the issuing device (ISM-2147); sessions and tokens revoked on credential reset, compromise, device non-compliance or high-risk sign-in (ISM-2148).
• Application and workload credentials: prefer short-lived dynamic credentials (ISM-2141), manage static secrets centrally (ISM-2142), one unique credential per workload and environment (ISM-2143), changed when compromised or exposed (ISM-2144) and revoked when no longer required (ISM-2146); user account credentials are likewise revoked when no longer required (ISM-2145). KRBTGT credentials now change at least every six months (ISM-1847).
• Service provider access: restricted to approved remote management tools, source addresses and time windows (ISM-2124) and independently logged by the customer organisation (ISM-2125); unauthorised access is treated as a cyber security incident (ISM-1576).
• Synthetic impersonation: personnel positively identify requestors through a pre-established authentication method or an independent trusted channel before changing account or banking details or conducting financial transactions (ISM-2126).
• Operating system and Active Directory hardening: driver signature enforcement and kernel-mode code restrictions (ISM-2127, ISM-2128), WMI activity logging (ISM-2129), AD CS web enrolment, template review and enrolment logging (ISM-2130 to ISM-2132), and DCSync permission reviews at least every six months (ISM-1934).
• Administration and backups: an enforced list of authorised RMM and remote access tools with gateway blocking (ISM-2149, ISM-2150); technically enforced immutable backups and segregated backup infrastructure (ISM-2151, ISM-2152).
• Security assurance: threat hunting informed by current threat intelligence at least every three months (ISM-2153); vulnerability assessments and penetration tests at least every six months (ISM-2118).
• Software supply chain: dependencies pinned to approved versions in source (ISM-2154), reproducible builds (ISM-2155) and secret scanning extended to credentials (ISM-2030).
• Networking: management interfaces reachable only from a dedicated management network (ISM-2160), firmware and configuration integrity checked against a known-good baseline (ISM-2161), unneeded device functionality removed (ISM-2162), 802.1X extended to wired networks (ISM-1322, ISM-1323) and to cover key exchange (ISM-1321), and MACsec added as an ASD-approved cryptographic protocol with five new controls covering cipher suites, association lifetimes, EAP-TLS re-authentication and no pre-shared key fallback (ISM-2163 to ISM-2167).
• Incident handling: intrusion remediation now uses trusted systems separate from the compromised one (ISM-1731), is sequenced to minimise re-compromise (ISM-1732), and continues with enhanced monitoring until eradication is confirmed (ISM-1213).

Terminology also shifted: "users" became "human users", "controls" became "security controls" and "security assessments" became "security control assessments" across many statements, and a further set of controls received grammatical edits without changing their intent. Existing controls keep their identifiers and URLs; the rescinded and merged controls are no longer listed and their old links redirect to this hub. To see the 146 controls ASD dated to this release, use the September 2026 button on the homepage, which opens the controls library filtered to this release.

ISM compliance is driven by a mix of legislation, whole-of-government policy and contractual requirements.

• Non-corporate Commonwealth entities - directed under the Protective Security Policy Framework (PSPF) to apply ISM controls proportionate to classification
• Corporate Commonwealth entities - strongly encouraged to adopt the PSPF (including ISM) as good practice
• Defence Industry Security Program (DISP) members - must align to ISM controls as part of DISP obligations
• State and territory government agencies - many jurisdictions reference the ISM either directly or via aligned state frameworks
• Critical infrastructure responsible entities (SOCI Act) - the ISM (alongside the Essential Eight and other frameworks) supports satisfying CIRMP obligations
• Government suppliers - service contracts frequently require ISM / IRAP alignment, particularly for cloud and managed services handling government data

Private-sector organisations not covered by the above often adopt ISM controls voluntarily for systems handling sensitive or regulated information, or to win government contracts.

The Essential Eight is a prioritised subset of the broader Strategies to Mitigate Cyber Security Incidents published by ASD. The Essential Eight provides a baseline; the full Strategies and the ISM provide depth.

The Essential Eight addresses a narrow band of technical controls (patching, MFA, admin privileges, application control, macro restrictions, hardening, backups). The ISM addresses the complete cyber security lifecycle - governance, personnel, physical security, cryptography, networks, gateways, development, data transfers and more.

• Start with the Essential Eight as a baseline for IT networks running Microsoft Windows
• Layer the ISM's broader principles and controls on top, guided by the risk management framework and system classification
• For high-assurance or classified systems, the ISM is the operative reference - the Essential Eight alone is insufficient
• Commonwealth entities are expected to implement the Essential Eight at or above ML2 while also meeting relevant ISM controls

The ISM sits inside a broader policy environment. Knowing how it relates helps avoid duplicate effort and reconcile overlapping requirements.

• Protective Security Policy Framework (PSPF) - whole-of-government framework; its information security requirements direct non-corporate Commonwealth entities to apply the ISM
• Essential Eight - prioritised baseline; subset of the broader Strategies to Mitigate Cyber Security Incidents and the ISM
• NIST SP 800-37 Rev. 2 - the ISM's risk management framework is adapted from this NIST publication
• NIST Cybersecurity Framework (CSF) 2.0 - six-function structure (Govern, Identify, Protect, Detect, Respond, Recover) aligns closely with the ISM's cyber security principles
• ISO/IEC 27001:2022 - an ISMS certification standard; ISO Annex A controls overlap with ISM domains (access control, cryptography, physical security, supplier relationships) but are higher-level than ISM controls
• NZISM (New Zealand Information Security Manual) - structurally similar Trans-Tasman counterpart; organisations operating in both jurisdictions can often run combined assessments
• SOC 2 Trust Services Criteria - US-centric; overlaps in areas such as access, change management and vendor oversight

There is no ASD-issued certification for individuals against the ISM. Practitioners typically hold ISO 27001-based qualifications and acquire ISM expertise through practical work, IRAP training and ASD guidance.

Mindset Cyber offers PECB-accredited ISO/IEC 27001 training that supports ISM implementation work. ISM and ISO 27001 share the same underlying discipline (risk-based information security management), making the ISO training an effective foundation for ISM practitioners - especially for control assessment, documentation and governance activities.

• ISO 27001 Foundation - introductory course; useful for team members and stakeholders who need to understand risk-based information security ($399)
• ISO 27001 Lead Implementer - five-day course for those leading ISMS programs, including teams aligning ISO 27001 with ISM obligations ($849)
• ISO 27001 Lead Auditor - five-day course for auditors; valuable for internal assessors validating ISM control implementation ($849)
• IRAP assessor endorsement - administered by ASD; the pathway for professionals wishing to conduct formal IRAP assessments

All Mindset Cyber courses are delivered as self-paced eLearning or live weekend training. Certification is through PECB and is internationally recognised.

Patterns that ASD, IRAP assessors and internal auditors commonly identify when ISM implementations underperform.

• Treating the ISM as a control checklist rather than a risk management framework - controls must be selected, tailored and justified, not blanket-applied
• Misusing applicability markings - applying only NC controls to an OFFICIAL: Sensitive system, or applying TS controls to a non-classified system and over-engineering
• Under-scoping the authorisation boundary - systems extending into third-party cloud or managed services not fully documented in the system security plan
• Skipping the monitor step - once an ATO is issued, systems drift; without continuous monitoring, residual risk quietly rises above the accepted threshold
• Relying on the Essential Eight alone for classified or high-assurance systems - Essential Eight is a baseline; ISM coverage is much broader
• Not keeping pace with ISM updates: major updates (like September 2026) introduce new principles and controls that existing authorisations may not cover
• Documentation gaps - the ATO package is only as strong as the system security plan, assessment report and POA&M; vague or outdated documentation is frequently cited
• Treating IRAP as certification - IRAP produces assessment reports; authorisation decisions still rest with the authorising officer
• Overlooking OT and enterprise mobility - the ISM has dedicated guidelines; these are often under-implemented compared to the IT mainstream

ASD strongly recommends independent assessment (IRAP or equivalent) before relying on self-assessed ISM compliance for regulatory or contractual purposes.