The Australian Signals Directorate (ASD) introduced Control ISM-1917 in the March 2024 update of the Information Security Manual (ISM), requiring that future cryptographic requirements and dependencies be considered in the development and procurement of new cryptographic equipment and software. The control specified that new systems intended for use beyond 2030 must support ML-DSA-87, ML-KEM-1024, SHA-384, SHA-512, and AES-256, according to legal analysis of the ISM updates.
For Commonwealth agencies and organizations required to comply with the ISM, the new control established a formal obligation to account for post-quantum cryptography in procurement decisions. ASD had been evaluating candidate post-quantum algorithms and monitoring NIST’s standardization process. ISM-1917 marked the first time the ISM contained an explicit mandate related to post-quantum readiness.