Compliance Colleague · Standards · Australia & New Zealand

Australian Information Security Manual (ISM): cited answers and gap reviews

An AI compliance assistant for Australian government entities and their suppliers · updated 2026-10-03

The ASD Information Security Manual sets the cybersecurity controls for Australian government systems. Compliance Colleague covers control selection, system authorisation and IRAP preparation, including the September 2026 release and the AI controls.

Try it on your own Australian ISM work: one document review or two questions, free for 30 days, no card required. Start free →

What it covers

ISM controls and applicability markings
Classification levels: NC, OS, PROTECTED, SECRET and TOP SECRET
System authorisation and IRAP assessments
Essential Eight vs the ISM
The September 2026 release and AI application controls

Questions you can ask

“Which ISM controls apply to a PROTECTED cloud system?”
“What does the ISM now require for AI agents' identities and permissions?”
“How do we prepare for an IRAP assessment?”

Every answer cites the Australian ISM requirement, article or control it rests on, so you can check it in seconds.

What you can upload for review

A system security plan checked against applicable controls
A PROTECTED system architecture diagram checked for boundary controls
A control tracker (Excel) checked for unaddressed ISM controls

Files: PDF, Word, Excel or CSV, Visio (.vsdx), draw.io, or an image such as a screenshot. Choose a full review, a prioritized fix list (each gap with its fix and the evidence an assessor will expect) or a short summary, and download the result as Word or PDF.

Crosswalk Australian ISM to other standards

With Australian ISM in your plan you can compare it against any standard in the library and see where they align and exactly where they don’t. Common pairings:

What it’s built from

Compliance Colleague carries the official text and checks its answers against it: Information Security Manual (ISM), OSCAL catalog (Australian Signals Directorate (ASD), Australian Cyber Security Centre).

Re-checked every month for new versions, deadlines and penalty changes. Full list on the sources page.

More Australia & New Zealand standards

Australian Privacy Act · NZISM

Compliance Colleague covers 30+ security, privacy and AI governance standards. It reviews policies, spreadsheets and diagrams and answers questions with the clause cited; your judgment and sign-off stay with you. Try it free, no card required →

Research aid, not legal or audit advice, and not an audit opinion or certification. Verify findings against the official text before relying on them.