ISM readiness for government suppliers

The Australian Government Information Security Manual (ISM), published by the Australian Signals Directorate, is what agencies and their suppliers are asked to demonstrate against when a system handles government information. Aegentra prepares the system and the evidence: controls mapping, gap assessment, the system security plan and the records an assessor will sample. An IRAP assessment is performed by an IRAP assessor endorsed by ASD. Aegentra is not an IRAP assessor and does not issue assessment reports.

What the ISM is and when a supplier meets it

The ISM is the Australian Signals Directorate’s manual of cyber security principles and controls for systems that handle Australian Government information. It sits inside the Protective Security Policy Framework, which sets the government’s protective security policy, and agencies apply it to their own systems and to the suppliers that host, process or support government information on their behalf. A supplier usually meets the ISM through a contract clause, a tender requirement or a hosting arrangement that asks for an IRAP assessment of the system.

• Published and maintained by the Australian Signals Directorate as part of the PSPF context for government systems
• Applied by the agency to its own systems and to the suppliers it relies on; the agency’s authorising officer decides whether to authorise the system
• Assessed through the Infosec Registered Assessors Program (IRAP): an IRAP assessor endorsed by ASD assesses the system and reports to the agency
• The ISM is updated by ASD; we work to the version the agency or contract names and do not quote control counts or release dates from memory
• Suppliers meet it most often through cloud hosting, managed services, SaaS sold to agencies and defence or security-cleared work

The system and the evidence, ready for an assessor who is not us.

The Information Security Manual is what agencies and their suppliers are asked to demonstrate against when a system handles government information. We decide the system boundary with you, map the ISM controls that apply, assess the gap against each one with evidence and write the system security plan and the supporting plans an assessor and an authorising officer expect to see. An IRAP assessment is performed by an IRAP assessor endorsed by ASD. Aegentra is not an IRAP assessor and does not issue assessment reports.

At a glance

Four parts, built inside your environment.

Readiness has four parts; the evidence is built where your people already work, so the assessment samples records that exist, not descriptions of records that should.

System boundary

The boundary and the classification context are agreed with you and, where possible, the agency, together with the ISM release the agency or contract names, so the assessment scope is not a surprise.

Controls mapping

Which ISM controls apply to the system, with implementation status and owner recorded per control; where you hold ISO 27001, the Statement of Applicability is mapped to the ISM controls so one evidence set serves both.

System security plan

The system security plan and the four supporting plans an assessor and an authorising officer expect: security risk management, incident response, continuous monitoring, and the plan of action and milestones.

Evidence by control

A gap assessment against each applicable control with the evidence examined and the remediation required, and an evidence pack indexed by control so the trace from plan to record is short.

What you end up with, and what an assessor samples from it.

Three documents carry the engagement. Each says on its cover what it is, and the gap assessment says it is a readiness view, not an IRAP report.

Controls mapping: Status and owner per control, against the named ISM release

The ISM controls that apply to the system, recorded with the implementation status and the owner per control and tracked against the ISM release the agency or contract names; a change during the engagement is recorded rather than discovered at assessment.

Gap assessment: A readiness view, labelled as such on its cover

Each applicable control assessed against the evidence examined, with the remediation required recorded for your engineers, your providers or the Harden practice as a separate scope. It is not an IRAP report and cannot be presented as one.

Plans and evidence pack: The system security plan, four supporting plans and the evidence indexed by control

The system security plan with the security risk management plan, incident response plan, continuous monitoring plan and plan of action and milestones, and the evidence organised by control so an assessor can trace from the plan to the record.

Who it applies to

Suppliers that have been asked for an IRAP assessment or an ISM alignment statement, and suppliers bidding for work that will require one. The request often arrives late and attached to a deadline.

• SaaS and hosting providers selling to Australian Government agencies
• Managed service providers supporting agency systems or government information
• Defence industry and security-cleared suppliers where the ISM sits beside other obligations
• Suppliers that already hold ISO 27001 and need to show how the ISMS controls map to the ISM
• Agencies and suppliers preparing a system for authorisation after a redesign or a cloud migration

What we deliver

Evidence is built inside your environment so the assessment samples records that exist, not descriptions of records that should.

• System boundary and classification context agreed with you and, where possible, the agency
• Controls mapping: which ISM controls apply to the system, with implementation status and owner recorded per control, against the ISM release the agency or contract names
• Gap assessment against each applicable control, with the evidence examined and the remediation required
• System security plan and the supporting documents: security risk management plan, incident response plan, continuous monitoring plan and plan of action and milestones
• Evidence organised by control so an assessor can trace from the plan to the record
• Where you hold ISO 27001, a mapping from the Statement of Applicability to the ISM controls so one evidence set serves both, and a briefing for the assessor you engage

What we do not do

The boundary matters and we state it plainly on the documents and in the proposal.

• Aegentra is not an IRAP assessor, does not perform IRAP assessments and does not issue assessment reports
• The authorisation decision belongs to the agency’s authorising officer; neither the assessor nor Aegentra makes it
• Our gap assessment is a readiness view, not an IRAP report, and cannot be presented as one
• Technical remediation, Microsoft 365 hardening through Harden, penetration testing and post-assessment remediation are scoped separately, so the person who assessed the gap is not grading their own fix
• The delivery team’s ASD ISM audit training is training, not IRAP endorsement, and we do not present it as such

How the engagement runs

Named steps, each with what happens and what you receive.

Boundary: Agree the system boundary and the ISM release

A scoping call records the system boundary, the classification context, the ISM version the agency or contract names, the documents to be produced and the evidence access you can provide. Classified material is handled only under arrangements agreed here.

What you receive:

• A written system boundary and classification context
• The ISM release confirmed and tracked in the controls mapping
• A fixed-fee quote for the agreed scope

Agency or contract requirement → System boundary and ISM release → Written scope and fixed fee

Map: Map the controls that apply to the system

The ISM controls that apply to the system are identified and recorded with the implementation status and the owner per control. Where an ISO 27001 ISMS exists, the Statement of Applicability is mapped to the ISM controls so one evidence set serves both.

What you receive:

• A controls mapping with status and owners
• The ISO 27001 to ISM mapping where you hold a certificate
• A change record if the ISM release moves during the engagement

ISM release named by the agency → Applicable controls per system → Controls mapping with owners

Assess: Assess the gap against each control with evidence

Each applicable control is assessed against the evidence examined, and the remediation required is recorded. The document is a readiness view, labelled as such on its cover; it is not an IRAP report.

What you receive:

• A gap assessment with evidence and remediation per control
• Remediation identified for your engineers, your providers or the Harden practice as a separate scope
• Evidence organised by control

Controls mapping → Evidence examined per control → Readiness gap assessment

Plan: Write the system security plan and the supporting plans

The system security plan is written with the security risk management plan, the incident response plan, the continuous monitoring plan and the plan of action and milestones, and the evidence is organised so the trace from plan to record is short.

What you receive:

• The system security plan
• The four supporting plans
• An evidence pack indexed by control

Assessed system → System security plan and supporting plans → Evidence pack by control

Hand over: Brief the assessor you engage; the agency decides

You engage the IRAP assessor directly or through the agency, and we help you brief them on the system and the evidence. The assessor reports to the agency; the authorising officer decides whether to accept the residual risk and authorise the system. Remediation of the assessment’s findings can be scoped as a follow-on engagement.

What you receive:

• An assessor briefing on the system and the evidence
• A plan of action and milestones the authorising officer can read
• A follow-on scope for post-assessment remediation if you want one

Evidence pack and plans → IRAP assessor, endorsed by ASD, outside Aegentra → Authorising officer decision, outside Aegentra

Who needs ISM readiness

Suppliers that have been asked for an IRAP assessment or an ISM alignment statement, and suppliers bidding for work that will require one. The request often arrives late and attached to a deadline, after the system has already been designed, which is why readiness work usually starts with a gap assessment rather than a clean sheet.

• SaaS and hosting providers selling to Australian Government agencies
• Managed service providers supporting agency systems or government information
• Defence industry and security-cleared suppliers where the ISM sits beside other obligations
• Suppliers that already hold ISO 27001 and need to show how the ISMS controls map to the ISM
• Agencies and suppliers preparing a system for authorisation after a redesign or a cloud migration

What we prepare

Readiness has four parts: deciding the system boundary, mapping the ISM controls that apply to it, assessing the gap against each control with evidence, and writing the system security plan and supporting documents an assessor and an authorising officer expect to see. We build the evidence inside your environment so that the assessment samples records that exist, not descriptions of records that should.

• System boundary and classification context agreed with you and, where possible, the agency, so the assessment scope is not a surprise
• Controls mapping: which ISM controls apply to the system, with the implementation status and the owner recorded per control
• Gap assessment against each applicable control, with the evidence examined and the remediation required
• System security plan and the supporting documents: security risk management plan, incident response plan, continuous monitoring plan and plan of action and milestones
• Evidence organised by control so an assessor can trace from the plan to the record
• Where you hold ISO 27001, a mapping from the Statement of Applicability to the ISM controls so one evidence set serves both

IRAP assessment: who does what

The boundary matters and we state it plainly. An IRAP assessment is performed by an IRAP assessor endorsed by the Australian Signals Directorate. The assessor examines the system against the ISM and reports the findings; the agency’s authorising officer decides whether to accept the residual risk and authorise the system. Aegentra is not an IRAP assessor, does not perform IRAP assessments and does not issue assessment reports. We prepare the system and the evidence for that assessment.

• You engage the IRAP assessor directly, or through the agency; we can help you brief them on the system and the evidence
• Our gap assessment is a readiness view, not an IRAP report, and the document says so on its cover
• Remediation of findings from the IRAP assessment can be scoped as a follow-on engagement
• The delivery team’s training includes ASD ISM General and Technical audit codes; that is training, not IRAP endorsement, and we do not present it as such

ISM beside ISO 27001 and the Essential Eight

The three are different instruments. The ISM is a control catalogue for government systems; ISO 27001 is a management-system standard with risk-selected controls; the Essential Eight is a set of eight mitigation strategies with maturity levels. A supplier that already runs an ISMS has much of the governance evidence an ISM readiness needs, and the Essential Eight work covers several of the technical controls the ISM also expects. We map rather than duplicate.

• ISO 27001 certified suppliers: the Statement of Applicability and operating evidence are mapped to the applicable ISM controls, and the gaps are usually technical
• Essential Eight maturity work feeds the ISM controls on application control, patching, administrative privileges, multi-factor authentication and backups
• The ISM asks for system-specific documents, such as the system security plan, that an ISMS does not produce by default
• None of the three substitutes for the others in a contract that names one of them

Scope and boundaries

Not an IRAP assessor.

An IRAP assessment is performed by an IRAP assessor endorsed by the Australian Signals Directorate, who reports to the agency; the agency’s authorising officer decides whether to authorise the system. Aegentra is not an IRAP assessor, does not perform IRAP assessments and does not issue assessment reports. The delivery team’s ASD ISM audit training is training, not IRAP endorsement, and we do not present it as such.

Frequently asked questions

Is Aegentra an IRAP assessor?

No. An IRAP assessment is performed by an IRAP assessor endorsed by the Australian Signals Directorate. Aegentra is not an IRAP assessor, does not perform IRAP assessments and does not issue assessment reports. We prepare the system and the evidence so the assessment can proceed, and we can help you brief the assessor you engage.

What is the difference between ISM readiness and an IRAP assessment?

Readiness is the preparation: deciding the boundary, mapping the applicable controls, finding and closing the gaps and writing the system security plan and supporting documents. The IRAP assessment is the independent examination of that system by an endorsed assessor, whose report goes to the agency. Our gap assessment document is a readiness view and is labelled as such; it is not an IRAP report and cannot be presented as one.

Who decides whether our system is authorised?

The agency’s authorising officer, on the basis of the IRAP assessment and the agency’s own risk appetite. Neither the assessor nor Aegentra makes that decision. Readiness work is aimed at giving the authorising officer a system security plan, a risk picture and evidence that make the decision straightforward.

We hold ISO 27001. How much of the ISM does that cover?

A good deal of the governance and process evidence, and some of the technical controls, but the mapping has to be done control by control. The ISM asks for system-specific documents such as the system security plan that an ISMS does not produce by default, and several technical controls go beyond what a risk-selected Annex A set usually includes. We map the Statement of Applicability to the applicable ISM controls and the gaps are usually clear within the first weeks.

Which ISM version do you work to?

The version the agency or the contract names. ASD updates the ISM, and an assessment is made against a stated release. We confirm the release at scoping and track it in the controls mapping so that a change during the engagement is recorded rather than discovered at assessment.

What documents will we end up with?

A controls mapping with implementation status and owners, a gap assessment with evidence and remediation, a system security plan, and the supporting plans an assessor expects: security risk management plan, incident response plan, continuous monitoring plan and a plan of action and milestones. The evidence is organised by control so the trace from plan to record is short.

Does ISM readiness include the technical remediation?

The gap assessment tells you what to remediate. The remediation itself is scoped separately so the cost is visible: Microsoft 365 configuration through our Harden practice, other platforms with your engineers or your providers. Keeping the two apart also keeps the readiness view honest, because the person who assessed the gap is not grading their own fix.

How does the Essential Eight relate to the ISM?

The Essential Eight is a set of eight mitigation strategies with maturity levels; the ISM is the broader control catalogue for government systems. Work done to reach an Essential Eight maturity level feeds the ISM controls on application control, patching, administrative privileges, multi-factor authentication and backups, but it does not cover the ISM. Our Essential Eight assessment and the ISM readiness are separate services that share evidence.

Can you handle classified information during the engagement?

Only under arrangements agreed at scoping. Readiness work can usually be done from system documentation, configuration exports and interviews without handling classified material. Where it cannot, we agree the handling, the people and the locations before any work starts, and we say in the proposal what is excluded.

What does ISM readiness cost?

It is scoped and quoted as a fixed fee after a scoping call. The drivers are the size and complexity of the system, the classification context, how much documentation exists, whether an ISMS is already certified and how much evidence can be produced from the systems themselves. IRAP assessor fees are separate and paid to the assessor; we do not publish a price for this service.

Where the service fits

Related Aegentra services

• ISO 27001 consulting and implementation
• Essential Eight maturity assessment and uplift plan
• Right Fit For Risk (RFFR) accreditation readiness
• Microsoft 365 security assessment (Harden)

Related PECB courses

• PECB ISO 27001 Lead Implementer course

Training, implementation, internal audit and independent certification have separate scopes and fees.

Tell us about the system before the assessor is booked.

Share the system that handles government information, the agency or contract asking for an IRAP assessment, the ISM release they name and whether you hold ISO 27001. A practitioner replies with the readiness scope and a fixed fee. Do not include classified material.

Suppliers that hold or are building an ISMS start from our ISO 27001 consulting and implementation service; the technical mitigations the ISM shares with the Essential Eight are covered by the Essential Eight maturity assessment. Employment services providers under DEWR deeds should read Right Fit For Risk readiness instead, which is the Department’s own ISO 27001-based scheme.

Where we work

Teams in Melbourne and Sydney. Delivered across all Australian states and territories, remotely or onsite by arrangement. New Zealand and Asia Pacific by arrangement.