The ISM is the Australian Signals Directorate's catalogue of security controls. It sits behind the Essential Eight and is what assessors ultimately measure Australian systems against. New Zealand's counterpart is the NZISM, published by the GCSB.
Why it matters
The Essential Eight is a baseline; the ISM is the fuller picture. Knowing how they relate helps an organisation plan beyond the minimum without drowning in controls. If you operate on both sides of the Tasman, mapping the ISM and the NZISM once saves repeating the work twice.
Where Intelligence Group fits
- Treat the Essential Eight as the priority baseline inside the ISM
- Map your systems to the ISM controls that apply, and to the NZISM if you serve New Zealand government
- Record decisions where you depart from a control, with reasons
- Keep control documentation current as systems change
- Use the ISM to plan maturity beyond the Essential Eight
Intelligence Group rates this strategy from the evidence your organisation already generates, reports the maturity level it supports, and sets out the next step to lift it.
Official guidance: the ASD Information Security Manual (ISM) and the New Zealand Information Security Manual (NZISM)