Information security manual (September 2026)

The Australian Signals Directorate’s (ASD) Information security manual (ISM) outlines a cyber security framework that organisations can use to protect their information technology (IT) and operational technology (OT) systems from cyber threats. It represents the considered advice of ASD, provided in accordance with ASD’s designated functions under the Intelligence Services Act 2001, and is intended for chief information security officers, chief information officers, cyber security professionals, and IT and OT managers. ASD also provides cyber security advice in the form of Australian Communications Security Instructions and other cyber security-related publications. In these cases, operating system, application and device-specific advice may take precedence over the advice in the ISM.

An organisation is not required as a matter of law to comply with the ISM, unless legislation, or a direction given under legislation or by some other lawful authority, compels them to comply. The ISM does not override any obligations imposed by legislation or law. If the ISM conflicts with legislation or law, the latter takes precedence.

If you have questions regarding the guidance within the ISM you can write to us or call us on 1300 CYBER1 (1300 292 371).