Guidelines for evaluated products
5 controls · September 2026 edition
- ISM-0280 · Evaluated product selection
If procuring an evaluated product, a product that has completed a PP-based evaluation, including against all applicable PP modules (as well as a software bill of materials assessment if applicable), is selected in preference to one that has completed an EAL-based evaluation.
- ISM-0285 · Delivery of evaluated products
Evaluated products are delivered in a manner consistent with any delivery procedures defined in associated evaluation documentation.
- ISM-0286 · Delivery of evaluated products
When procuring high assurance information technology (IT) equipment, ASD is contacted for any equipment-specific delivery procedures.
- ISM-0289 · Using evaluated products
Evaluated products are installed, configured, administered and operated in an evaluated configuration and in accordance with vendor guidance.
- ISM-0290 · Using evaluated products
High assurance IT equipment is installed, configured, administered and operated in an evaluated configuration and in accordance with ASD guidance.
Official control wording and applicability: Australian Signals Directorate, © Commonwealth of Australia 2026. September 2026 ISM, OSCAL v2026.09.4, reproduced under CC BY 4.0. Formatting is adapted for this website.
Latticework Systems’ implementation guidance is our interpretation. Provenance and scope.