Information Security Manual
Voluntary. The ISM is ASD’s advice, not legislation, and it does not bind a private law firm unless legislation, a contract or a lawful direction makes it mandatory.
ASD’s cyber security framework for protecting IT and operational technology systems. It is advice unless a law or a direction makes it compulsory.
MaintainedLast reviewed
Key facts
- Issued by
- Australian Signals Directorate
- Sources listed
- 3
This is a reading aid for an Australian law firm. It is not legal advice, not a certification, and not a finding that a tool or a firm complies. The sentences paraphrase the sources listed, checked on the date shown. Where a standard is sold by ISO or the AICPA, the page uses the publisher’s public description and does not reproduce the standard.
What it is
The Information Security Manual is a cyber security framework the Australian Signals Directorate produces. ASD’s September 2026 edition says an organisation can use it to protect information technology and operational technology systems from cyber threats. It is intended for chief information security officers, chief information officers, cyber security professionals, and IT and OT managers.
The same page says the ISM is ASD’s considered advice, given under ASD’s functions in the Intelligence Services Act 2001. Where ASD has also published operating-system, application or device-specific advice, that more specific advice may take precedence.
Who it applies to
ASD says an organisation is not required as a matter of law to comply with the ISM, unless legislation, or a direction given under legislation or by some other lawful authority, compels it. The ISM does not override obligations imposed by legislation or law. If the two conflict, the legislation or law takes precedence.
A private law firm is not compelled to adopt the ISM merely by being a law firm. A government client, a panel deed, or a gateway or cloud arrangement handling official information can make particular controls relevant. That is a term of the arrangement, which the firm has to read. It is not a consequence of this page.
What it asks of a law firm using AI
- Use the current edition. ASD publishes the manual on cyber.gov.au and archives earlier releases. The edition checked for this page is September 2026.
- Treat the manual as advice about controls for IT and OT systems, not as a substitute for the Privacy Act, a court rule, or a solicitor’s conduct rule.
- The Essential Eight FAQ says ISM control applicability follows the classification of data a system will store, process or communicate, while Essential Eight maturity follows the tradecraft the organisation is trying to mitigate. Do not treat one as a shorthand for the other.
- An IRAP assessment tests selected ISM controls for a named system. ASD says completion of an assessment does not mean the system is compliant with the controls that were tested.
How it maps to this framework
The rows are this site’s questions. Where the cell says “Not set here”, the instrument does not set that requirement. The gap is still recorded, so it is not treated as answered.
| This site’s question | What the instrument says that bears on it |
|---|---|
| Efficiency Whether the tool saves total human work at the quality the task needs. | Not set here. |
| Effectiveness Whether the output is good enough for the task. The catalogue does not score this. | Not set here. |
| Due diligence What the firm has actually read about hosting, training and assurance before it relies on the tool. | When a vendor says a system was assessed against the ISM, ask which edition, which system boundary, which classification, and for the assessment report. The ISM itself is the control catalogue an assessor uses. It is not a product approval. |
| Confidentiality Whether client and other confidential information can go into the tool. | ISM controls are one way to reduce unauthorised access to systems that hold information. They do not define a solicitor’s duty, and they do not authorise putting client material into a particular AI tool. |
| Disclosure When the firm tells the client, and where required the court or another party, that AI was used. | Not set here. |
| Certifications ISO, SOC 2 and IRAP names recorded against the tool. A listed name is not a finding that the certificate covers the firm’s plan. | Following the ISM is not a certification. IRAP is the ASD program under which an endorsed assessor can assess a system against ISM controls. The two pages should be read together, and neither is a badge that covers every plan a vendor sells. |
| Data residency Where the tool holds data, including whether that place is recorded as Australia. | The manual is about protecting systems. It does not, on the page checked here, name a country where a law firm’s client data must be hosted. |
Sources
- Information security manual
- Information security manual (September 2026)
- Essential Eight maturity model FAQ, on how the ISM and the Essential Eight differ
Checked 2026-10-10. Issued by Australian Signals Directorate.