ASD ISM controls for Microsoft 365

The Australian Signals Directorate's Information Security Manual (ISM), with ASD's wording for each control, the Essential Eight maturity levels that cite it, and the Microsoft 365 changes that affect it. Free weekly bulletin, no login. Independent of ASD.

What is the ASD ISM?

The ASD's cyber security framework for Australian organisations. It is published as numbered controls grouped into guideline chapters. We show ASD's wording under CC-BY 4.0.

How do ISM controls relate to the Essential Eight?

ASD maps each Essential Eight strategy and maturity level to ISM controls. We use that mapping to link Microsoft 365 changes to ISM controls.

Does a Microsoft 365 change mean a control is non-compliant?

No. A change affects a control when it touches the Essential Eight control that control supports. It is a prompt to review your settings, not evidence of non-compliance. Not IRAP advice.

Is this an official ASD resource?

No. It is an independent EDUC4TE service. ISM content is © Commonwealth of Australia. ASD and the ACSC do not endorse this site.

How often is it updated?

The Microsoft change feeds are checked every 30 minutes and every six hours. The ISM catalogue is refreshed from ASD's published release; we check each quarter.