ISM control lookup / Topic

Guidelines for data transfers

14 controls · September 2026 edition

• ISM-0657 · Manual import of data

  When manually importing data to systems, the data is scanned for malicious and active content.

• ISM-0660 · Monitoring data import and export

  Data transfer logs for SECRET and TOP SECRET systems are fully verified at least monthly.

• ISM-0661 · Accountability for data transfers

  Human users transferring data to and from systems are held accountable for data transfers they perform.

• ISM-0663 · Data transfer processes and procedures

  Data transfer processes, and supporting data transfer procedures, are developed, implemented and maintained.

• ISM-0664 · Authorising export of data

  Data exported from SECRET and TOP SECRET systems is reviewed and authorised by a trustworthy source beforehand.

• ISM-0665 · Authorising export of data

  Trustworthy sources for SECRET and TOP SECRET systems are limited to people and systems that have been verified and authorised as such by the chief information security officer.

• ISM-0669 · Manual export of data

  When manually exporting data from SECRET and TOP SECRET systems, digital signatures are validated and keyword checks are performed within all textual data.

• ISM-0675 · Authorising export of data

  Data authorised for export from SECRET and TOP SECRET systems is digitally signed by a trustworthy source.

• ISM-1187 · Manual export of data

  When manually exporting data from systems, the data is checked for unsuitable protective markings.

• ISM-1294 · Monitoring data import and export

  Data transfer logs for systems are partially verified at least monthly.

• ISM-1535 · Data transfer processes and procedures

  Processes, and supporting procedures, are developed, implemented and maintained to prevent AUSTEO, AGAO and REL data in textual and non-textual formats from being exported to unsuitable foreign systems.

• ISM-1586 · Monitoring data import and export

  Data transfer logs are used to record all data imports and exports from systems.

• ISM-1778 · Manual import of data

  When manually importing data to systems, all data that fails security checks is quarantined until reviewed and subsequently approved or not approved for release.

• ISM-1779 · Manual export of data

  When manually exporting data from systems, all data that fails security checks is quarantined until reviewed and subsequently approved or not approved for release.