ACSC ISM March 2023
ActiveSpecialized framework
Best for: Australian Government agencies and ICT contractors handling data at OFFICIAL, PROTECTED, or SECRET classification levels must align with the ISM. Cloud providers, managed service providers, and software vendors with government contracts will typically face ISM alignment requirements, often enforced through an IRAP assessment. Critical infrastructure operators under the SOCI Act 2018 also frequently adopt this framework.
| Mandatory? | Mandatory for Australian government entities |
|---|---|
| Who validates? | Self-assessment; IRAP assessors for higher classifications |
| Renewal | Annual; updated quarterly by ACSC |
| Scope | Information and systems across Australian government |
| Governing body | Australian Cyber Security Centre (ACSC), part of the Australian Signals Directorate (ASD), ACSC ISM March 2023. Official source |
Get started
Point the module source at the ACSC ISM March 2023 endpoint and pin a version range you reviewed:
module "..." {
source = "acscism2023.compliance.tf/terraform-aws-modules/<module>/aws"
version = "<version>"
}acscism2023.compliance.tf lists every ACSC ISM March 2023 module with its versions, inputs and outputs.
What compliance.tf covers and what you handle
| Area | Compliance.tf automates | You handle |
|---|---|---|
| Logging and Audit Trail Completeness | Covers CloudTrail data event logging for S3 (read and write), CloudWatch log integration, and service-level logging for ELB, CodeBuild, DocumentDB, and Elasticsearch. Each maps to ISM event logging requirements. | Setting retention periods per classification level, writing SIEM alerting rules, establishing log review procedures, and documenting the logging policy itself. |
| Encryption and Cryptographic Standards | Checks ACM certificate key lengths (RSA 2048+), deprecated SSL/TLS protocol usage on CloudFront, root CA status in AWS Private CA, and KMS-based encryption of EKS secrets. | Maintaining a cryptographic key register, defining approved algorithm lists per ISM guidance, managing key rotation schedules, and handling ASD-approved cryptographic equipment for classified systems. |
| Identity and Access Management | Flags empty IAM groups, inline policies attached to groups, users, or roles, and administrative privilege grants via inline policy. | Defining access approval workflows, conducting periodic access reviews, managing privileged access management (PAM) processes, and keeping records of access authorizations from system owners. |
| Threat Detection and Monitoring | Checks that GuardDuty is enabled in all regions and aggregated to a delegated administrator account. | Triaging and responding to GuardDuty findings, integrating them into your incident response process, tuning suppression rules, and reporting to the ACSC as required for government systems. |
| Network and Application Protection | Confirms WAF Web ACL association on API Gateway stages. Detects internet-facing endpoints with no web application firewall coverage. | Configuring WAF rule groups to match your threat profile, maintaining allow/deny lists, reviewing WAF logs, and designing broader network segmentation per ISM gateway guidelines. |
Controls by category
17 of 26 mapped controls are Enforced by compliance.tf modules at terraform plan. The other 9 are Mapped only: ACSC ISM March 2023 lists them, no compliance.tf module checks them.
Guidelines for Cryptography
Certificate inventories and TLS configuration reports are the primary evidence here. The assessor checks that ACM certificates use RSA 2048-bit keys or stronger (ISM-0994, ISM-1446) and that no deprecated protocols remain in use on public or internal endpoints. Legacy TLS on internal services is a frequent finding, particularly on services that were excluded from the initial hardening scope.
Guidelines for System Monitoring
S3 data event logging is disabled by default in AWS, and this is the most common gap under ISM-0580, ISM-0585, and ISM-0586. Assessors check that CloudTrail covers data-plane events (not just management events), that logs flow to a centralized SIEM or CloudWatch Logs, and that retention satisfies the 7-year minimum for PROTECTED systems.
Additional controls (19)
Amazon OpenSearch Service (1)
| Control | Status |
|---|---|
| OpenSearch domains should have audit logging enabled | Enforced |
Amazon RDS (4)
Amazon Redshift (5)
Amazon S3 (6)
Amazon SNS (1)
| Control | Status |
|---|---|
| SNS topics should be encrypted at rest | Enforced |
Amazon SageMaker (1)
| Control | Status |
|---|---|
| SageMaker notebook instance encryption should be enabled | Mapped |
Other (1)
| Control | Status |
|---|---|
| Redshift Serverless workgroups should have enhanced VPC routing enabled | Mapped |
Related frameworks
| Framework | Control overlap | Note |
|---|---|---|
| PCI DSS v4.0 | High 83% | |
| NIST Cybersecurity Framework v1.1 | High 78% | |
| ISO/IEC 27001:2022 | High 70% |
Frequently asked questions
Does the ISM apply to my organization if we are not an Australian Government agency?
Not mandatory for private companies with no government nexus. If you're a cloud service provider, managed service provider, or software vendor contracting with the Australian Government, you'll likely be required to demonstrate ISM alignment, typically through an IRAP assessment. Companies with no government work are free to adopt the ISM voluntarily; in critical infrastructure sectors regulated under the SOCI Act, many do.
How does the ISM relate to IRAP assessments?
IRAP is the assessment mechanism; the ISM is the control set being assessed against. An IRAP assessor evaluates your system against the ISM controls relevant to your data classification level and produces a security assessment report (and a cloud security assessment report for cloud systems). There is no formal 'ISM certification'. The authorising officer accepts residual risk based on the IRAP assessment findings.
This benchmark references the March 2023 ISM. Is it outdated?
The ACSC updates the ISM multiple times per year. March 2023 is one snapshot; later 2023 and 2024 editions introduced control numbering changes and new guidelines. Check the ACSC website for the current version and compare control IDs against this benchmark. Most controls are stable across versions, so coverage remains substantial, but verify any gaps against the latest published edition.
How many controls does the full ISM contain, and why does this benchmark only cover 50?
The full ISM contains over 800 controls spanning physical security, personnel security, communications security, and ICT security. This mapping covers the ISM controls that AWS resource configuration checks can verify. Physical security, personnel vetting, governance processes, and documentation controls can't be verified through infrastructure scanning and require manual assessment or separate tooling.
Can I use this benchmark to satisfy both ISM and Essential Eight requirements simultaneously?
Partially. Essential Eight controls that intersect with this benchmark's checks (restricting administrative privileges, for example) will be covered. The Essential Eight maturity model has specific implementation requirements at each level (Maturity Level 1 through 3) that go beyond what ISM controls specify. Run both benchmarks and cross-reference findings to identify shared remediation work.