The ISM is ASD's catalogue of security controls. It sits behind the ASD Essentials and is what assessors ultimately measure an organisation's systems against.
Why it matters
The ASD Essentials is a baseline; the ISM is the fuller picture. Understanding how they relate helps an organisation plan beyond the minimum without being overwhelmed.
How Conformance helps
- Treat the ASD Essentials as the priority baseline within the ISM
- Map your systems to the relevant ISM controls
- Record decisions where you vary from a control, with reasons
- Keep control documentation current as systems change
- Use the ISM to plan maturity beyond the ASD Essentials
How Conformance helps
Conformance validates this strategy from the evidence your organisation already produces, shows your maturity level, and tells you the next step to raise it.
Official guidance: the ASD Information Security Manual (ISM)