If the Essential Eight is the headline, the Information Security Manual is the full text. The ISM is the ASD’s comprehensive cyber security guidance — hundreds of controls covering everything from system hardening to incident response. It can look overwhelming, so here is how a smaller business should approach it.

Key takeaways
  • The ISM is published by the ASD and is updated regularly throughout the year.
  • It uses a risk-based framework rather than a rigid checklist.
  • The Essential Eight is a prioritised subset of ISM guidance, which is where most SMBs should start.
  • Backup, recovery and data retention controls run throughout the ISM.

What the ISM is

The Information Security Manual (ISM) is the Australian Signals Directorate’s detailed cyber security framework. It is aimed at chief information security officers, IT managers and security practitioners, and provides a large catalogue of controls organised around a risk-management approach: define your context, identify risks, apply controls, and monitor. It is refreshed regularly, so it tracks the current threat landscape.

How it relates to the Essential Eight

People often ask whether they should follow the ISM or the Essential Eight. The answer is that the Essential Eight is effectively a prioritised starter-set drawn from the broader ISM. For a small business, the sensible path is to implement the Essential Eight first, then reach into relevant ISM controls as your maturity and obligations grow.

Which parts matter most for an SMB

You do not need every control. Focus on the areas with the highest payoff:

  • Access control and MFA — strong authentication everywhere it counts.
  • Patching and hardening — keep systems current and minimise attack surface.
  • Email and web security — the most common entry points.
  • Data backup and recovery — regular, retained, tested and isolated.
  • Incident response — a simple, documented plan beats improvisation.

The role of backups in the ISM

Backup and recovery controls thread through the ISM, reflecting a simple truth: resilience is a security outcome, not an afterthought. The guidance consistently points to backups that are performed regularly, retained for an appropriate period, tested through restoration, and protected from unauthorised modification or deletion. For cloud data such as Xero, that means an independent backup you control.

A pragmatic approach

Treat the ISM as a reference library, not a to-do list. Anchor on the Essential Eight, document your decisions, and consult specific ISM controls when a contract, a customer or a risk assessment calls for them.