Australian Information Security Manual ISM-1636: Security assessment by organisational or IRAP assessors

System owners, in consultation with each system's authorising officer, ensure controls for each non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET system and its operating environment undergo a security assessment by their organisation's own assessors or Infosec Registered Assessor Program (IRAP) assessors to determine if they have been implemented correctly and are operating as intended.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

What else in your programme already covers this

This control maps to 7 controls across 4 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

New Zealand Information Security Manual (NZISM) · 3 controls

4.2.11.C.01 4.2.11.C.01 Certification authority acceptance of control effectiveness
4.3.18.C.03 4.3.18.C.03 Auditor reviews architecture against security principles
4.3.18.C.04 4.3.18.C.04 Auditor confirms SecPol protects classified information

NIST Cybersecurity Framework 2.0 · 2 controls

NIST-CSF-ID.IM-02 Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties
NIST-CSF-ID.RA-08 Processes for receiving, analyzing, and responding to vulnerability disclosures are established

CIS Controls v8 · 1 control

CIS-18.4 Validate Security Measures

ISO 27002:2022 · 1 control

5.35 Independent review of information security

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.