ASD ISM: What It Is & Why It Matters

What it is

The Information Security Manual (ISM) is a comprehensive cybersecurity framework produced by the Australian Signals Directorate (ASD) through its Australian Cyber Security Centre. It provides a detailed, risk-based catalogue of guidance and security controls intended to help organisations protect their systems and data. It is a cornerstone of Australian government cybersecurity and is widely referenced beyond government as well.

Unlike a short baseline, the ISM is broad and deep, covering governance, personnel, physical and technical aspects of security. It is updated regularly so that its guidance keeps pace with changing threats and technologies.

Key principles

The ISM is built around a risk-management approach: organisations are expected to understand their risks and apply controls proportionately, rather than blindly implementing everything. Its guidance spans a wide range of domains.

• Cybersecurity governance — roles, responsibilities and risk management.
• Personnel and physical security — the human and physical context around systems.
• Technical controls — system hardening, access control, cryptography, networking and more.
• Guidelines and a control catalogue — detailed, actionable guidance across these domains.

The ISM and the Essential Eight are complementary: the Essential Eight is a focused baseline of key mitigations, while the ISM is the broader, more comprehensive framework around it. An organisation may use the Essential Eight as a starting point and the ISM for fuller coverage.

Why it matters for debt recovery

For an Australian provider handling debtor data, the ISM is a recognised, locally authored benchmark for comprehensive cybersecurity. Because it is risk-based and broad, it speaks not only to technical controls but to governance and the human and physical context, all of which are relevant to protecting sensitive personal and financial information.

For a risk team, alignment with ISM principles signals a provider thinking about security comprehensively and in an Australian context. Its breadth makes it a useful reference for asking about areas that narrower checklists can miss, such as governance, personnel security and cryptography.

What to ask a provider

Useful questions include:

• Do your security practices draw on the ISM, and in which areas?
• How do you take a risk-based approach to applying controls?
• How do you address governance, personnel and physical security, not just technical controls?
• How do you keep your practices current as the ISM is updated?

A provider familiar with the ISM can describe how it applies a risk-based approach across these domains rather than treating security as a purely technical concern. You can read about our overall approach on our compliance page.

How Merion approaches it

Merion aligns with the principles of the ISM by taking a risk-based approach to security across governance, people and technical controls, in an Australian context.

This page is general information and not a claim of any particular ISM assessment or accreditation for Merion. As the ISM and our environment evolve, please verify a provider's current practices and any independent assessment directly during due diligence.