What is the Information Security Manual (ISM)?
The Information Security Manual (ISM) is a cyber security framework produced by the Australian Signals Directorate (ASD). It helps organisations protect information technology (IT) and operational technology (OT) systems through a risk-based approach. It is primarily intended for government entities, critical infrastructure, large organisations, CISOs, CIOs, cyber security professionals, and IT and OT managers.
The June 2026 ISM is structured as six functions, 49 cyber security principles, 22 cyber security guidelines, and 1,102 controls. The principles define the strategic security outcomes organisations should achieve and are distributed across Govern (14 principles), Identify (6), Protect (17), Detect (5), Respond (5), and Recover (2). The principles are interdependent and should be implemented collectively rather than treated as isolated requirements.
The 22 guidelines cover cyber security roles; cyber security incidents; procurement and outsourcing; cyber security documentation; physical security; personnel security; communications infrastructure; communications systems; enterprise mobility; evaluated products; information technology equipment; media; system hardening; system management; security assurance; software development; database systems; email; networking; cryptography; gateways; and data transfers.
The framework consists of six functions containing 49 principles, supported by 22 implementation guidelines and 1,102 detailed controls. The principles define the intended security outcomes, the guidelines explain the relevant risks and implementation areas, and the controls specify the administrative, personnel, physical, and technical measures used to achieve those outcomes. Organisations select and tailor the controls according to their system architecture, operating environment, information classification, and risk tolerance.
The ISM is not automatically mandatory for every organisation. It becomes binding where required by legislation, government policy, contract, or another lawful direction. It supports Australian Government implementation of the Protective Security Policy Framework (PSPF) and is updated regularly. The current release is the June 2026 ISM.
What are the requirements for the Information Security Manual (ISM)?
The ISM follows six steps: define the system, select controls, implement controls, assess controls, authorise the system, and continuously monitor the system. Organisations must define system boundaries and security objectives, select controls based on risk and information classification, document implementation, test control effectiveness, address gaps, and monitor changes over time.
Key documentation includes a system security plan, cyber security incident response plan, change and configuration management plan, continuous monitoring plan, security assessment report, and plan of action and milestones. These documents support the authorising officer’s decision on whether the residual risk is acceptable and the system can operate.
Non-classified, OFFICIAL: Sensitive, PROTECTED, and SECRET systems may be assessed by qualified internal or IRAP assessors and are generally authorised by the organisation’s CISO or delegate. TOP SECRET systems require ASD assessment or delegation and authorisation by the Director-General ASD or delegate. The ISM is not an organisational certification, and implementing the Essential Eight alone does not establish full ISM alignment.
Why should you be Information Security Manual (ISM) compliant?
ISM alignment gives organisations a structured way to identify cyber risks, implement appropriate controls, test their effectiveness, and document risk decisions. It strengthens governance, improves security across IT and OT environments, supports system authorisation, and demonstrates due diligence to government customers, assessors, partners, and other stakeholders.
Failure to meet applicable ISM requirements can increase exposure to cyber incidents, data loss, service disruption, remediation costs, and adverse audit findings. It may also lead an authorising officer to restrict, deny, suspend, or revoke a system’s authorisation to operate. The ISM does not itself impose universal fines; penalties depend on the applicable law, policy, contract, or lawful direction.
How to achieve Information Security Manual (ISM) compliance?
Centraleyes turns the ISM’s principles, guidelines, and controls into a structured, built-in assessment. Teams can assess requirements by control ID, guideline, or function; centralise answers and evidence; identify gaps; assign remediation tasks; and track progress through real-time dashboards and reports. Automated workflows, remediation tracking, and risk analysis provide a clear view of completed and outstanding actions.
Centraleyes smart mappings connect the ISM with the Essential Eight and other frameworks, allowing organisations to reuse relevant answers and evidence and reduce duplicated work. The platform also helps teams identify controls affected by new ISM releases and manage ongoing updates from one place. This creates a more efficient, measurable, and sustainable path to ISM alignment, while final system authorisation remains with the applicable authorising officer.
Read more: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism