Meet Australian ISM controls with automated evidence and monitoring

The ISM, or Information Security Manual, is a cyber security framework published by the Australian Signals Directorate. It sets out cyber security principles and detailed guidelines with numbered controls that organisations apply using a risk-based approach. Controls are tagged by the classification of the systems they apply to, from non-classified up to top secret, and ASD revises the manual regularly to reflect new threats and technology.

Australian Government entities are the main users, because the Protective Security Policy Framework directs them to apply the ISM to their systems. Private organisations are not bound by law to follow it, but cloud and service providers supplying government are commonly required by contract to have their systems assessed against the ISM through IRAP. Many other organisations adopt it voluntarily as a security baseline.

An IRAP assessment is an independent review of a system's implementation of ISM controls, carried out by an assessor endorsed by the Australian Signals Directorate under the Infosec Registered Assessors Program. Government agencies use the assessment report to understand residual risk before authorising a system or service. It is the usual route for cloud and technology providers that want to handle Australian Government data.

The June 2024 ISM restructured the cyber security principles. The former GOVERN principles were split into separate GOVERN and IDENTIFY groups, separating governance from asset and risk identification, and the RESPOND principles were revised to cover incident reporting, analysis, containment and recovery. Individual controls were also added, amended or rescinded, as happens in each release, so check ASD's change summary for details.

The Essential Eight is a set of prioritised mitigation strategies published by the Australian Signals Directorate, and its requirements are reflected in controls within the ISM. Organisations often implement the Essential Eight first as a baseline, then apply the wider ISM for a full, risk-based security programme covering governance, personnel, physical and technical security.

The ISM and ISO 27001 overlap heavily, since both cover governance, access control, cryptography, incident management and physical security. ISO 27001 is an international certifiable management system standard, while the ISM is a prescriptive Australian Government control framework assessed through IRAP. Mapping controls between them lets you reuse much of the same evidence for both.

Start by defining your system and its classification, then select the applicable ISM controls using a risk-based approach. Implement those controls, document them in a system security plan and supporting policies, and collect evidence that they work. Government systems are then authorised to operate, often after an IRAP assessment, and controls should be monitored and reviewed as ASD releases new versions.

Yes. OneClickComply supports the Australian ISM today, with controls mapped to the same control set used for ISO 27001, SOC 2 and other frameworks. The platform automates evidence collection, policy generation and continuous monitoring, and our audit team can advise on IRAP preparation. OneClickComply does not perform IRAP assessments, which must be carried out by an ASD-endorsed assessor.