Information Security Manual (ISM) Australia

The Information Security Manual provides authoritative guidance on how organisations should protect systems, data, and services using recognised cyber security principles and cyber frameworks. Developed by the Australian Signals Directorate, the ISM reflects national expectations for governance, accountability, and practical risk reduction. It sets out what “reasonable” cyber security looks like in the Australian context and provides a clear benchmark against which organisations can measure their maturity.

This article explains what the Information Security Manual is, why it matters to Australian organisations, how it is structured, and what recent changes mean in practice for managing cyber security risk. It also shows how to align the ISM with ISO 27001 and the Essential Eight to achieve predictable, defensible outcomes that leadership can trust, without creating unnecessary complexity or disruption.

Related:  Updated Information Security Manual

While the ISM is mandatory for many government environments, its influence now extends well beyond the public sector. Customers, partners, insurers, and regulators increasingly expect organisations to demonstrate alignment with recognised cyber frameworks when assessing cyber resilience and risk management. In this environment, the Information Security Manual has become a de facto benchmark for reasonable cyber security practice in Australia.

For growth‑oriented, regulation‑exposed organisations, the Information Security Manual provides clarity and certainty. It helps leadership move cyber security out of reactive firefighting and into structured governance. By aligning to the ISM, organisations can show that cyber security is being managed deliberately as a board‑level business risk, rather than treated as an ad hoc technical issue or delegated without oversight.

The primary audience includes executives, directors, risk owners, cyber security leaders, and technology teams. Importantly, the ISM is designed to support accountability at the leadership level. It requires clear ownership of cyber risk, documented risk acceptance, and ongoing assurance that controls remain effective as threats and technologies evolve.

For executives and boards, the ISM provides a common language for discussing cyber security in terms of risk, impact, and governance, rather than tools or technical detail. This makes it easier to integrate cyber security into broader enterprise risk management and strategic planning.

The Information Security Manual is organised into two complementary layers that balance strategy and execution.

Cyber security principles
These principles define what good cyber security looks like across five functional areas: governance, identification, protection, detection, and response or recovery. They establish expectations around accountability, secure‑by‑design thinking, and continuous improvement.

Cyber security guidelines
The guidelines translate those principles into practical, actionable controls. They explain how organisations can implement protections across identity, infrastructure, applications, monitoring, incident response, and supplier management.

This structure allows organisations to align policy and governance at the executive level, while giving IT and security teams the detailed guidance needed to implement and maintain controls consistently. It also supports flexibility, enabling organisations to tailor implementation based on risk and context without losing alignment to national expectations.

The Information Security Manual covers a broad range of cyber security domains. In practice, several components consistently have the greatest impact on reducing cyber risk.

Governance and risk
Clear accountability, defined risk appetite, documented risk acceptance, and regular reporting to leadership. This ensures cyber security decisions are visible, deliberate, and defensible.

Identity and access
Strong authentication, privileged access management, and least‑privilege principles. Identity remains one of the most common paths used by threat actors, making this a critical control area.

System hardening and patching
Secure configurations, timely patching, and application controls reduce exposure to known vulnerabilities that are frequently exploited.

Monitoring and detection
Centralised logging, alerting, and analysis enable early detection of cyber threats and faster response when incidents occur.

Incident response and recovery
Documented and tested response plans, reliable backups, and clearly defined recovery objectives support operational resilience and minimise downtime.

Supplier assurance
Managed services, cloud providers, and third parties are assessed and monitored to ensure they meet ISM expectations, reducing supply chain risk.

Together, these components help organisations move from reactive security to predictable, repeatable cyber risk management.

The most recent update to the Information Security Manual was released in December 2025, reflecting ongoing changes in the threat landscape and technology use.

Key highlights included:

AI governance
A new requirement to establish and maintain a general‑purpose AI usage policy, recognising the growing risks associated with AI‑enabled systems and data use.

Authentication hardening
Updated guidance discouraging the use of security questions and email for out‑of‑band authentication, reducing reliance on weak or easily compromised methods.

Legacy removal
Rescission of fax‑related controls and explicit guidance not to use fax or online fax services, removing outdated practices that introduce unnecessary risk.

These changes reinforce the ISM’s focus on modernising controls, removing weak practices, and embedding secure‑by‑design principles across systems and services.

The Information Security Manual supports a structured approach to cyber risk management.

1. Identify systems, data, suppliers, and dependencies that support business operations.
2. Assess cyber threats, vulnerabilities, and potential business impact.
3. Implement ISM‑aligned controls across identity, hardening, monitoring, and recovery.
4. Accept or treat residual risk at the appropriate level, with clear thresholds and documentation.
5. Monitor and improve through metrics, testing, assurance, and regular review.

This approach ensures cyber security investment is focused on the areas of greatest risk, while providing leadership with visibility and confidence.

ISO 27001 provides a structured management system for information security governance and continual improvement. The Information Security Manual complements this by providing deeper technical guidance aligned to Australian risk conditions. The Essential Eight offers prioritised mitigation strategies that address the most common attack paths.

Used together, these frameworks create a balanced approach. ISO 27001 establishes governance and assurance, the Essential Eight delivers a strong baseline, and the ISM fills the gaps with comprehensive, nationally recognised guidance.

Executives should own risk appetite, material risk acceptance, and investment priorities. Audit and Risk functions should oversee assurance and evidence. Technology leadership should ensure secure‑by‑design delivery and supplier assurance.

KMTech aligns your cyber security programme to the Information Security Manual, the Essential Eight, and ISO 27001. We provide co‑managed capability where required, reduce operational noise, and deliver executive reporting that replaces uncertainty with clarity and confidence.

Relevant internal links

• Managed Cyber Security Services
• The ACSC Essential Eight Explained
• Compliance as a Service (CaaS)