Govern
Identify and manage security risks, roles, accountabilities and reporting. Tie this to the agency's risk framework.
Australia · Australian Signals Directorate (ASD) / ACSC · ISM
Information Security Manual
The ASD's cybersecurity framework used by Australian Government agencies to protect their information and systems.
What it is
The Information Security Manual (ISM) is the ASD's risk-based framework for protecting government information and systems from cyber threats. Each entity applies it through its own risk-management approach. It is built around cyber security principles and their related controls. Agencies apply controls based on data classification, from OFFICIAL to TOP SECRET. For IRAP assessments, the ISM is the authoritative control catalogue.
Who it applies to
Mandatory for non-corporate Commonwealth entities (via the PSPF) and corporate Commonwealth entities under the Archives Act. State and territory governments and suppliers handling government data widely adopt it.
Requirements
Protect
Apply controls to reduce risk across personnel, information, cyber, physical, ICT and supply chain.
Detect
Detect cybersecurity events. Monitor systems and analyse event data to understand them.
Respond
Respond to and recover from cybersecurity incidents. Use planning, exercises and post-incident review.
Start with a conversation.
Speak to us about your cyber governance and compliance requirements.
Message sent
Thanks. We have your message.
A member of our team will be in touch soon at . You can also reach us during business hours on 1800 816 044.
- Topic
- Company
Need us sooner? Call +61 8 8208 0800, or the 24/7 incident line on 1800 816 044 if something is happening now.