5% of Australian Information Security Manual you already have
ACSC Essential Eight already covers about 5% of Australian Information Security Manual, leaving
1024 of 1081 controls as genuinely new work.
Already covered 57
Likely covered 0
New work 1024
What is genuinely new work
Nothing in ACSC Essential Eight reaches these. This is the list to scope.
ISM-0009System owners, in consultation with each system's authorising officer, identify any supple
ISM-0027System owners obtain an authorisation to operate for each non-classified, OFFICIAL: Sensit
ISM-0039A cyber security strategy is developed, implemented and maintained.
ISM-0041Systems have a system security plan that includes an overview of the system (covering the
ISM-0042System administration processes, and supporting system administration procedures, are deve
ISM-0043Systems have a cyber security incident response plan that covers the following: - guidelin
ISM-0047Organisational-level cyber security documentation is approved by the chief information sec
ISM-0072Security requirements associated with the confidentiality, integrity and availability of d
ISM-0078Systems processing, storing or communicating AUSTEO or AGAO data remain at all times under
ISM-0100Non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET gateways undergo an IRAP assessm
ISM-0109Event logs from workstations are analysed in a timely manner to detect cyber security even
ISM-0120Cyber security personnel have access to sufficient data sources and tools to ensure that s
ISM-0123Cyber security incidents are reported to the chief information security officer, or one of
ISM-0125A cyber security incident register is developed, implemented and maintained.
ISM-0133When a data spill occurs, data owners are advised and access to the data is restricted.
ISM-0137Legal advice is sought before allowing intrusion activity to continue on a system for the
ISM-0138The integrity of evidence gathered during an investigation is maintained by investigators:
ISM-0140Cyber security incidents are reported to ASD as soon as possible after they occur or are d
ISM-0141The requirement for service providers to report cyber security incidents to a designated p
ISM-0142The compromise or suspected compromise of cryptographic equipment or associated keying mat
ISM-0161IT equipment and media are secured when not in use.
ISM-0164Unauthorised people are prevented from observing systems, in particular workstation displa
ISM-0181Cabling infrastructure is installed in accordance with relevant Australian Standards, as d
ISM-0187SECRET cables, when bundled together or run in conduit, are run exclusively in their own i
ISM-0194In shared facilities, a visible smear of conduit glue is used to seal all plastic conduit
ISM-0195In shared facilities, uniquely identifiable SCEC-approved tamper-evident seals are used to
ISM-0198When penetrating a TOP SECRET audio secure room, the Australian Security Intelligence Orga
ISM-0201Labels for TOP SECRET conduits are a minimum size of 2.5 cm x 1 cm, attached at five-metre
ISM-0206Cable labelling processes, and supporting cable labelling procedures, are developed, imple
ISM-0208A cable register contains the following for each cable: - cable identifier - cable colour
ISM-0211A cable register is developed, implemented, maintained and verified on a regular basis.
ISM-0213SECRET and TOP SECRET cables are terminated on their own individual patch panels.
ISM-0216TOP SECRET patch panels are installed in individual TOP SECRET cabinets.
ISM-0217Where spatial constraints demand non-TOP SECRET patch panels be installed in the same cabi
ISM-0218If TOP SECRET fibre-optic fly leads exceeding five metres in length are used to connect wa
ISM-0225Unauthorised RF and IR devices are not brought into SECRET and TOP SECRET areas.
ISM-0229Personnel are advised of the permitted sensitivity or classification of information that c
ISM-0230Personnel are advised of security risks posed by non-secure telephone systems in areas whe
ISM-0231When using cryptographic equipment to permit different levels of conversation for differen
ISM-0232Telephone systems used for sensitive or classified conversations encrypt all traffic that
ISM-0233Cordless telephone handsets and headsets are not used for sensitive or classified conversa
ISM-0235Speakerphones are not used on telephone systems in TOP SECRET areas unless the telephone s
ISM-0236Off-hook audio protection features are used on telephone systems in areas where background
ISM-0240Paging, Multimedia Message Service, Short Message Service and messaging apps are not used
ISM-0245MFDs are not connected to digital telephone systems.
ISM-0246When an emanation security risk assessment is required, it is sought as early as possible
ISM-0249System owners deploying SECRET or TOP SECRET systems in mobile platforms, or as a deployab
ISM-0250IT equipment meets industry and government standards relating to electromagnetic interfere
ISM-0252Cyber security awareness training is undertaken annually by all personnel and covers: - th
ISM-0258A web usage policy is developed, implemented and maintained.
ISM-0260All web access, including that by internal servers, is conducted through web proxies.
ISM-0261The following details are centrally logged for websites accessed via web proxies: - web ad
ISM-0263TLS traffic communicated through gateways is decrypted and inspected.
ISM-0264An email usage policy is developed, implemented and maintained.
ISM-0267Access to non-approved webmail services is blocked.
ISM-0269Emails containing Australian Eyes Only, Australian Government Access Only or Releasable To
ISM-0270Protective markings are applied to emails and reflect the highest sensitivity or classific
ISM-0271Protective marking tools do not automatically insert protective markings into emails.
ISM-0272Protective marking tools do not allow users to select protective markings that a system ha
ISM-0280If procuring an evaluated product, a product that has completed a PP-based evaluation, inc
ISM-0285Evaluated products are delivered in a manner consistent with any delivery procedures defin
ISM-0286When procuring high assurance information technology (IT) equipment, ASD is contacted for
ISM-0289Evaluated products are installed, configured, administered and operated in an evaluated co
ISM-0290High assurance IT equipment is installed, configured, administered and operated in an eval
ISM-0293IT equipment is classified based on the highest sensitivity or classification of data that
ISM-0294IT equipment, with the exception of high assurance IT equipment, is labelled with protecti
ISM-0296ASD's approval is sought before applying labels to external surfaces of high assurance IT
ISM-0298A centralised and managed approach that maintains the integrity of patches or updates, and
ISM-0300Patches, updates or other vendor mitigations for vulnerabilities in high assurance IT equi
ISM-0304Applications other than office productivity suites, web browsers and their extensions, ema
ISM-0305Maintenance and repairs of IT equipment is carried out on site by an appropriately cleared
ISM-0306If an appropriately cleared technician is not used to undertake maintenance or repairs of
ISM-0307If an appropriately cleared technician is not used to undertake maintenance or repairs of
ISM-0310IT equipment maintained or repaired off site is done so at facilities approved for handlin
ISM-0311IT equipment containing media is sanitised by removing the media from the IT equipment or
ISM-0312IT equipment, including associated media, that is located overseas and has processed, stor
ISM-0313IT equipment sanitisation processes, and supporting IT equipment sanitisation procedures,
ISM-0315High assurance IT equipment is destroyed prior to its disposal.
ISM-0316Following sanitisation, destruction or declassification, a formal administrative decision
ISM-0317At least three pages of random text with no blank areas are printed on each colour printer
ISM-0318When unable to sanitise printer cartridges or MFD print drums, they are destroyed as per e
ISM-0321When disposing of IT equipment that has been designed or modified to meet emanation securi
ISM-0323Media is classified to the highest sensitivity or classification of data it stores, unless
ISM-0325Any media connected to a system with a higher sensitivity or classification than the media
ISM-0330Before reclassifying media to a lower sensitivity or classification, the media is sanitise
ISM-0332Media, with the exception of internally mounted fixed media within information technology
ISM-0336A networked IT equipment register is developed, implemented, maintained and verified on a
ISM-0337Media is only used with systems that are authorised to process, store or communicate its s
ISM-0341Automatic execution features for removable media are disabled.
ISM-0343If there is no business requirement for writing to removable media and devices, such funct
ISM-0345External communication interfaces that allow DMA are disabled.
ISM-0347When transferring data manually between two systems belonging to different security domain
ISM-0348Media sanitisation processes, and supporting media sanitisation procedures, are developed,
ISM-0350The following media types are destroyed prior to their disposal: - microfiche and microfil
ISM-0351Volatile media is sanitised by removing its power for at least 10 minutes.
ISM-0352SECRET and TOP SECRET volatile media is sanitised by overwriting it at least once in its e
ISM-0354Non-volatile magnetic media is sanitised by overwriting it at least once (or three times i
ISM-0356Following sanitisation, SECRET and TOP SECRET non-volatile magnetic media retains its clas
ISM-0357Non-volatile EPROM media is sanitised by applying three times the manufacturer's specified
ISM-0358Following sanitisation, SECRET and TOP SECRET non-volatile EPROM and EEPROM media retains
ISM-0359Non-volatile flash memory media is sanitised by overwriting it at least twice in its entir
ISM-0360Following sanitisation, SECRET and TOP SECRET non-volatile flash memory media retains its
ISM-0361Magnetic media is destroyed using a degausser with a suitable magnetic field strength and
ISM-0362Product-specific directions provided by degausser manufacturers are followed.
ISM-0363Media destruction processes, and supporting media destruction procedures, are developed, i
ISM-0368Media destroyed using a hammer mill, disintegrator, grinder/sander or by cutting results i
ISM-0370The destruction of media is performed under the supervision of at least one cleared person
ISM-0371Personnel supervising the destruction of media supervise its handling to the point of dest
ISM-0372The destruction of media storing accountable material is performed under the supervision o
ISM-0373Personnel supervising the destruction of media storing accountable material supervise its
ISM-0374Media disposal processes, and supporting media disposal procedures, are developed, impleme
ISM-0375Following sanitisation, destruction or declassification, a formal administrative decision
ISM-0378Labels and markings indicating the owner, sensitivity, classification or any other marking
ISM-0380Unneeded user accounts, components, services and functionality of operating systems are di
ISM-0382Unprivileged users do not have the ability to uninstall or disable approved applications.
ISM-0383Default user accounts or credentials for operating systems, including for any pre-configur
ISM-0385Servers maintain effective functional separation with other servers allowing them to opera
ISM-0393Databases and their contents are classified based on the sensitivity or classification of
ISM-0400Development, testing, staging and production environments are segregated.
ISM-0401Secure by Design principles and practices are followed throughout the software development
ISM-0402Software is comprehensively tested for vulnerabilities, using SAST, DAST and SCA prior to
ISM-0405Requests for unprivileged access to systems and their resources are validated when first r
ISM-0407A secure record is maintained for the life of systems and their resources that covers the
ISM-0408Systems have a logon banner that reminds users of their security responsibilities when acc
ISM-0409Foreign nationals, including seconded foreign nationals, do not have access to systems tha
ISM-0411Foreign nationals, excluding seconded foreign nationals, do not have access to systems tha
ISM-0414Personnel granted access to systems and their resources are uniquely identifiable.
ISM-0415The use of shared user accounts is strictly controlled, and personnel using such accounts
ISM-0417When systems cannot support multi-factor authentication, single-factor authentication usin
ISM-0418Physical credentials are kept separate from systems they are used to authenticate to, exce
ISM-0420Where systems process, store or communicate AUSTEO, AGAO or REL data, personnel who are fo
ISM-0421Passwords used for single-factor authentication on non-classified, OFFICIAL: Sensitive and
ISM-0422Passwords used for single-factor authentication on TOP SECRET systems are a minimum of 20
ISM-0428Services are configured with a session lock that: - activates after a maximum of 15 minute
ISM-0430Access to systems and their resources are removed or suspended the same day personnel no l
ISM-0432Access requirements for systems and their resources are documented in their system securit
ISM-0434Personnel undergo appropriate employment screening and, where necessary, hold an appropria
ISM-0435Personnel receive any necessary briefings before being granted access to systems and their
ISM-0441When personnel are granted temporary access to systems and their resources, effective cont
ISM-0443Temporary access is not granted to systems that process, store or communicate caveated or
ISM-0446Foreign nationals, including seconded foreign nationals, do not have privileged access to
ISM-0447Foreign nationals, excluding seconded foreign nationals, do not have privileged access to
ISM-0455Where practical, cryptographic equipment, applications and libraries provide a means of da
ISM-0457Cryptographic equipment, applications or libraries that have completed a Common Criteria e
ISM-0459Full disk encryption, or partial encryption where access controls will only allow writing
ISM-0460HACE is used when encrypting media that contains SECRET or TOP SECRET data.
ISM-0462When a user authenticates to the encryption functionality of IT equipment or media, it is
ISM-0465Cryptographic equipment, applications or libraries that have completed a Common Criteria e
ISM-0467HACE is used to protect SECRET and TOP SECRET data when communicated over insufficiently s
ISM-0469An ASD-Approved Cryptographic Protocol (AACP) or high assurance cryptographic protocol is
ISM-0471Only AACAs or high assurance cryptographic algorithms are used by cryptographic equipment,
ISM-0472When using DH for agreeing on encryption session keys, a modulus of at least 2048 bits is
ISM-0474When using ECDH for agreeing on encryption session keys, a base point order and key size o
ISM-0475When using ECDSA for digital signatures, a base point order and key size of at least 224 b
ISM-0476When using RSA for digital signatures, and transporting encryption session keys (and simil
ISM-0477When using RSA for digital signatures, and for transporting encryption session keys (and s
ISM-0479Symmetric cryptographic algorithms are not used in Electronic Codebook Mode.
ISM-0481Only AACPs or high assurance cryptographic protocols are used by cryptographic equipment,
ISM-0484The SSH daemon is configured to: - only listen on the required interfaces (ListenAddress x
ISM-0485Public key-based authentication is used for SSH connections.
ISM-0487When using logins without a password for SSH connections, the following are disabled: - ac
ISM-0488If using remote access without the use of a password for SSH connections, the 'forced comm
ISM-0489When SSH-agent or similar key caching applications are used, it is limited to workstations
ISM-0490Versions of S/MIME earlier than S/MIME version 3.0 are not used for S/MIME connections.
ISM-0494Tunnel mode is used for IPsec connections; however, if using transport mode, an IP tunnel
ISM-0496The ESP protocol is used for authentication and encryption of IPsec connections.
ISM-0498A security association lifetime of less than four hours (14400 seconds) is used for IPsec
ISM-0499Communications security doctrine and policy produced by ASD for the management and operati
ISM-0501Keyed cryptographic equipment is transported based on the sensitivity or classification of
ISM-0507Cryptographic key management processes, and supporting cryptographic key management proced
ISM-0516Network documentation includes high-level network diagrams showing all connections into ne
ISM-0518Network documentation is developed, implemented and maintained.
ISM-0520Network access controls are implemented on networks to prevent the connection of unauthori
ISM-0521IPv6 functionality is disabled in dual-stack network devices unless it is being used.
ISM-0529VLANs are not used to separate network traffic between networks belonging to different sec
ISM-0530Network devices managing VLANs are administered from the most trusted security domain.
ISM-0534Unused physical ports on network devices are disabled.
ISM-0535Network devices managing VLANs belonging to different security domains do not share VLAN t
ISM-0536Public wireless networks provided for general public use are segregated from all other org
ISM-0546When video conferencing or IP telephony traffic passes through a gateway containing a fire
ISM-0547Video conferencing and IP telephony calls are conducted using a secure real-time transport
ISM-0548Video conferencing and IP telephony calls are established using a secure session initiatio
ISM-0549Video conferencing and IP telephony traffic is separated physically or logically from othe
ISM-0551IP telephony is configured such that: - IP phones authenticate themselves to the call cont
ISM-0553Authentication and authorisation is used for all actions on a video conferencing network,
ISM-0554An encrypted and non-replayable two-way authentication scheme is used for call authenticat
ISM-0555Authentication and authorisation is used for all actions on an IP telephony network, inclu
ISM-0556Workstations are not connected to video conferencing units or IP phones unless the worksta
ISM-0558IP phones used in public areas do not have the ability to access data networks, voicemail
ISM-0559Microphones (including headsets and USB handsets) and webcams are not used with non-SECRET
ISM-0565Email servers are configured to block, log and report emails with inappropriate protective
ISM-0567Email servers only relay emails destined for or originating from their domains (including
ISM-0569Emails are routed via centralised email gateways.
ISM-0570Where backup or alternative email gateways are in place, they are maintained at the same s
ISM-0571When users send or receive emails, an authenticated and encrypted channel is used to route
ISM-0572Opportunistic TLS encryption is enabled on email servers that make incoming or outgoing em
ISM-0574SPF is used to specify authorised email servers (or lack thereof) for an organisation's do
ISM-0576A cyber security incident management policy, and associated cyber security incident respon
ISM-0580An event logging policy is developed, implemented and maintained.
ISM-0582Security-relevant events for Microsoft Windows operating systems are centrally logged.
ISM-0585For each event logged, the date and time of the event, the relevant user or process, the r
ISM-0588An MFD usage policy is developed, implemented and maintained.
ISM-0589MFDs are not used to scan or copy documents above the sensitivity or classification of net
ISM-0590Authentication measures for MFDs are the same strength as those used for workstations on n
ISM-0591Evaluated peripheral switches are used when sharing peripherals between systems.
ISM-0597When planning, designing, implementing or introducing additional connectivity to CDSs, ASD
ISM-0610Users are trained on the secure use of CDSs before access is granted.
ISM-0611System administrators for gateways are assigned the minimum privileges required to perform
ISM-0612System administrators for gateways are formally trained on the operation and management of
ISM-0613System administrators for gateways that connect to Australian Eyes Only or Releasable To n
ISM-0616Separation of duties is implemented in performing administrative activities for gateways.
ISM-0619Users authenticate to other networks accessed via gateways.
ISM-0622IT equipment authenticates to other networks accessed via gateways.
ISM-0626CDSs are implemented between SECRET or TOP SECRET networks and any other networks belongin
ISM-0628Gateways are implemented between networks belonging to different security domains.
ISM-0629For gateways between networks belonging to different security domains, any shared componen
ISM-0631Gateways only allow explicitly authorised data flows.
ISM-0634Security-relevant events for gateways are centrally logged, including: - data packets and
ISM-0635CDSs implement isolated upward and downward network paths.
ISM-0637Gateways implement a demilitarised zone if external parties require access to an organisat
ISM-0639Evaluated firewalls are used between networks belonging to different security domains.
ISM-0643Evaluated diodes are used for controlling the data flow of unidirectional gateways between
ISM-0645Evaluated diodes used for controlling the data flow of unidirectional gateways between SEC
ISM-0649Files imported or exported via gateways or CDSs are filtered for allowed file types.
ISM-0651Files identified by content filtering checks as malicious, or that cannot be inspected, ar
ISM-0652Files identified by content filtering checks as suspicious are quarantined until reviewed
ISM-0657When manually importing data to systems, the data is scanned for malicious and active cont
ISM-0659Files imported or exported via gateways or CDSs undergo content filtering checks.
ISM-0660Data transfer logs for SECRET and TOP SECRET systems are fully verified at least monthly.
ISM-0661Users transferring data to and from systems are held accountable for data transfers they p
ISM-0663Data transfer processes, and supporting data transfer procedures, are developed, implement
ISM-0664Data exported from SECRET and TOP SECRET systems is reviewed and authorised by a trustwort
ISM-0665Trustworthy sources for SECRET and TOP SECRET systems are limited to people and services t
ISM-0669When manually exporting data from SECRET and TOP SECRET systems, digital signatures are va
ISM-0670Security-relevant events for CDSs are centrally logged.
ISM-0675Data authorised for export from SECRET and TOP SECRET systems is digitally signed by a tru
ISM-0677Files imported or exported via gateways or CDSs that have a digital signature or cryptogra
ISM-0682Bluetooth functionality is not enabled on SECRET and TOP SECRET mobile devices.
ISM-0687Mobile devices that access SECRET or TOP SECRET systems or data use mobile platforms that
ISM-0694Privately-owned mobile devices and desktop computers do not access SECRET and TOP SECRET s
ISM-0701Mobile device emergency sanitisation processes, and supporting mobile device emergency san
ISM-0702If a cryptographic zeroise or sanitise function is provided for cryptographic keys on a SE
ISM-0705When accessing an organisation's network via a VPN connection, split tunnelling is disable
ISM-0714A CISO is appointed to provide cyber security leadership and guidance for their organisati
ISM-0717The CISO oversees the management of cyber security personnel within their organisation.
ISM-0718The CISO regularly reports directly to their organisation's board of directors or executiv
ISM-0720The CISO oversees the development, implementation and maintenance of a cyber security comm
ISM-0724The CISO implements cyber security measurement metrics and key performance indicators for
ISM-0725The CISO coordinates cyber security and business alignment through a cyber security steeri
ISM-0726The CISO coordinates security risk management activities between cyber security and busine
ISM-0731The CISO oversees cyber supply chain risk management activities for their organisation.
ISM-0732The CISO receives and manages a dedicated cyber security budget for their organisation.
ISM-0733The CISO is fully aware of all cyber security incidents within their organisation.
ISM-0734The CISO contributes to the development, implementation and maintenance of business contin
ISM-0735The CISO oversees the development, implementation and maintenance of their organisation's
ISM-0810Classified systems are secured in facilities that meet the requirements for a security zon
ISM-0813Server rooms, communications rooms and security containers are not left in unsecured state
ISM-0817Personnel are advised of what suspicious contact via online services is and how to report
ISM-0820Personnel are advised to not post work information to unauthorised online services and to
ISM-0821Personnel are advised of security risks associated with posting personal information to on
ISM-0824Personnel are advised not to send or receive files via unauthorised online services.
ISM-0829Security measures are used to detect and respond to unauthorised RF devices in SECRET and
ISM-0831Media is handled in a manner suitable for its sensitivity or classification.
ISM-0835Following sanitisation, TOP SECRET volatile media retains its classification if it stored
ISM-0836Non-volatile EEPROM media is sanitised by overwriting it at least once in its entirety wit
ISM-0839The destruction of media storing accountable material is not outsourced.
ISM-0840When outsourcing the destruction of media storing non-accountable material, a National Ass
ISM-0846All users (with the exception of local administrator accounts and break glass accounts) ca
ISM-0853On a daily basis, outside of business hours and after an appropriate period of inactivity,
ISM-0854AUSTEO and AGAO data can only be accessed from systems under the sole control of the Austr
ISM-0861DKIM signing is enabled on emails originating from an organisation's domains (including su
ISM-0863Mobile devices prevent personnel from installing non-approved applications once provisione
ISM-0864Mobile devices prevent personnel from disabling or modifying security functionality once p
ISM-0866Sensitive or classified data is not viewed on mobile devices in public locations unless ca
ISM-0869Mobile devices encrypt their internal storage and any removable media.
ISM-0870Mobile devices are carried or stored in a secured state when not being actively used.
ISM-0871Mobile devices are kept under continual direct supervision when being actively used.
ISM-0874Mobile devices and desktop computers access the internet via an organisation's internet ga
ISM-0888Cyber security documentation is reviewed at least annually and includes a 'current as at \
ISM-0912Systems have a change and configuration management plan that includes: - the establishment
ISM-0917When malicious code is detected, the following steps are taken to handle the infection: -
ISM-0926Non-classified, OFFICIAL: Sensitive and PROTECTED cables are coloured neither salmon pink
ISM-0931In SECRET and TOP SECRET areas, push-to-talk handsets or push-to-talk headsets are used to
ISM-0938Vendors that have demonstrated a commitment to Secure by Design and Secure by Default prin
ISM-0947When transferring data manually between two systems belonging to different security domain
ISM-0955Application control is implemented using cryptographic hash rules, publisher certificate r
ISM-0958An organisation-approved list of domain names, or list of website categories, is implement
ISM-0961Client-side active content is restricted by web content filters to an organisation-approve
ISM-0963Web content filtering is implemented to filter potentially harmful web-based content.
ISM-0971The OWASP Application Security Verification Standard is used in the development of web app
ISM-0988An accurate and consistent time source is used for event logging.
ISM-0994ECDH is used in preference to DH.
ISM-0998AUTH_HMAC_SHA2_256_128, AUTH_HMAC_SHA2_384_192, AUTH_HMAC_SHA2_512_256 or NONE (only with
ISM-0999DH or ECDH is used for key establishment of IPsec connections, preferably 384-bit random E
ISM-1000PFS is used for IPsec connections.
ISM-1006Security measures are implemented to prevent unauthorised access to network management tra
ISM-1013The effective range of wireless communications outside an organisation's area of control i
ISM-1014Individual logins are implemented for IP phones used for SECRET or TOP SECRET conversation
ISM-1019A denial of service response plan for video conferencing and IP telephony services is deve
ISM-1023The intended recipients of blocked inbound emails, and the senders of blocked outbound ema
ISM-1024Notifications of undeliverable emails are only sent to senders that can be verified via SP
ISM-1026DKIM signatures on incoming emails are verified.
ISM-1027Email distribution list applications used by external senders is configured such that it d
ISM-1028A NIDS or NIPS is deployed in gateways between an organisation's networks and other networ
ISM-1030A NIDS or NIPS is located immediately inside the outermost firewall for gateways and confi
ISM-1034A HIPS or EDR solution is implemented on critical servers and high-value servers.
ISM-1036MFDs are located in areas where their use can be observed.
ISM-1037Gateways undergo testing following configuration changes, and at regular intervals no more
ISM-1053Classified servers, network devices and cryptographic equipment are secured in server room
ISM-1055LAN Manager and NT LAN Manager authentication methods are disabled.
ISM-1059All data stored on media is encrypted.
ISM-1065The host-protected area and device configuration overlay table are reset prior to the sani
ISM-1067The ATA secure erase command is used, in addition to block overwriting software, to ensure
ISM-1071Each system has a designated system owner.
ISM-1073An organisation's systems are not accessed or administered by a service provider unless a
ISM-1074Keys or equivalent access mechanisms to server rooms, communications rooms and security co
ISM-1076Televisions and computer monitors with minor burn-in or image persistence are sanitised by
ISM-1078A telephone system usage policy is developed, implemented and maintained.
ISM-1079ASD's approval is sought before undertaking any maintenance or repairs to high assurance I
ISM-1080An ASD-Approved Cryptographic Algorithm (AACA) or high assurance cryptographic algorithm i
ISM-1082A mobile device usage policy is developed, implemented and maintained.
ISM-1083Personnel are advised of the sensitivity or classification permitted for voice and data co
ISM-1084If unable to carry or store mobile devices in a secured state, they are physically transfe
ISM-1085Mobile devices encrypt all sensitive or classified data communicated over public network i
ISM-1088Personnel report the potential compromise of mobile devices, removable media or credential
ISM-1089Protective marking tools do not allow users replying to or forwarding emails to select pro
ISM-1091Keying material is changed when compromised or suspected of being compromised.
ISM-1095Wall outlet boxes denote the systems, cable identifiers and wall outlet box identifier.
ISM-1096Cables are labelled at each end with sufficient source and destination details to enable t
ISM-1098SECRET cables are terminated in an individual cabinet; or for small systems, a cabinet wit
ISM-1100TOP SECRET cables are terminated in an individual TOP SECRET cabinet.
ISM-1101In TOP SECRET areas, cable reticulation systems leading into cabinets in server rooms or c
ISM-1102Cable reticulation systems leading into cabinets are terminated as close as possible to th
ISM-1103In TOP SECRET areas, cable reticulation systems leading into cabinets not in server rooms
ISM-1105SECRET and TOP SECRET wall outlet boxes contain exclusively SECRET or TOP SECRET cables.
ISM-1107Non-classified, OFFICIAL: Sensitive and PROTECTED wall outlet boxes are coloured neither s
ISM-1109Wall outlet box covers are clear plastic.
ISM-1111Fibre-optic cables are used for cabling infrastructure instead of copper cables.
ISM-1112Cables in non-TOP SECRET areas are inspectable every five metres or less.
ISM-1114Cable bundles or conduits sharing a common cable reticulation system have a dividing parti
ISM-1115Cables from cable trays to wall outlet boxes are run in flexible or plastic conduit.
ISM-1116A visible gap exists between TOP SECRET cabinets and non-TOP SECRET cabinets.
ISM-1119Cables in TOP SECRET areas are fully inspectable for their entire length.
ISM-1122Where wall penetrations exit a TOP SECRET area into a lower classified area, TOP SECRET ca
ISM-1123A power distribution board with a feed from an Uninterruptible Power Supply is used to pow
ISM-1130In shared facilities, cables are run in an enclosed cable reticulation system.
ISM-1133In shared facilities, TOP SECRET cables are not run in party walls.
ISM-1137System owners deploying SECRET or TOP SECRET systems within fixed facilities contact ASD f
ISM-1139Only the latest version of TLS is used for TLS connections.
ISM-1143Patch management processes, and supporting patch management procedures, are developed, imp
ISM-1145Privacy filters are applied to the screens of SECRET and TOP SECRET mobile devices.
ISM-1146Personnel are advised to maintain separate work and personal user accounts for online serv
ISM-1151SPF is used to verify the authenticity of incoming emails.
ISM-1157Evaluated diodes are used for controlling the data flow of unidirectional gateways between
ISM-1158Evaluated diodes used for controlling the data flow of unidirectional gateways between SEC
ISM-1160If using degaussers to destroy media, degaussers evaluated by the United States' National
ISM-1163Systems have a continuous monitoring plan that includes: - conducting vulnerability scans
ISM-1164In shared facilities, conduits or the front covers of ducts, cable trays in floors and cei
ISM-1171Attempts to access websites through their IP addresses instead of their domain names are b
ISM-1178Network documentation provided to a third party, or published in public tender documentati
ISM-1181Networks are segregated into multiple network zones according to the criticality of server
ISM-1182Network access controls are implemented to limit the flow of network traffic within and be
ISM-1183A hard fail SPF record is used when specifying authorised email servers (or lack thereof)
ISM-1186IPv6 capable network security appliances are used on IPv6 and dual-stack networks.
ISM-1187When manually exporting data from systems, the data is checked for unsuitable protective m
ISM-1192Gateways inspect and filter data flows at the transport and above network layers.
ISM-1195Mobile Device Management solutions that have completed a Common Criteria evaluation agains
ISM-1196Non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices are configured to remain
ISM-1198Bluetooth pairing for non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices is
ISM-1199Bluetooth pairings for non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices ar
ISM-1200Bluetooth pairing for non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices is
ISM-1203System owners, in consultation with each system's authorising officer, conduct a threat an
ISM-1211System administrators perform system administration activities in accordance with the syst
ISM-1213Following intrusion remediation activities, full network traffic is captured for at least
ISM-1216SECRET and TOP SECRET cables with non-conformant cable colouring are banded with the appro
ISM-1217Labels and markings indicating the owner, sensitivity, classification or any other marking
ISM-1218IT equipment, including associated media, that is located overseas and has processed, stor
ISM-1219MFD print drums and image transfer rollers are inspected and destroyed if there is remnant
ISM-1220Printer and MFD platens are inspected and destroyed if any text or images are retained on
ISM-1221Printers and MFDs are checked to ensure no pages are trapped in the paper path due to a pa
ISM-1222Televisions and computer monitors that cannot be sanitised are destroyed.
ISM-1223Memory in network devices is sanitised using the following processes, in order of preferen
ISM-1227Credentials set for user accounts are randomly generated.
ISM-1228Cyber security events are analysed in a timely manner to identify cyber security incidents
ISM-1233IKE version 2 is used for key exchange when establishing IPsec connections.
ISM-1234Email content filtering is implemented to filter potentially harmful content in email bodi
ISM-1235Add-ons, extensions and plug-ins for office productivity suites, web browsers, email clien
ISM-1236Malicious domain names, dynamic domain names and domain names that can be registered anony
ISM-1237Web content filtering is applied to outbound web traffic where appropriate.
ISM-1238Threat modelling is used in support of the software development life cycle.
ISM-1239Robust web application frameworks are used in the development of web applications.
ISM-1240Validation and sanitisation are performed on all input received over the internet by softw
ISM-1241Output encoding is performed on all output produced by web applications.
ISM-1243A database register is developed, implemented, maintained and verified on a regular basis.
ISM-1245All temporary installation files and logs created during server application installation p
ISM-1246Server applications are hardened using ASD and vendor hardening guidance, with the most re
ISM-1247Unneeded user accounts, components, services and functionality of server applications are
ISM-1249Server applications are configured to run as a separate user account with the minimum priv
ISM-1250The user accounts under which server applications run have limited access to their underly
ISM-1255Database users' ability to access, insert, modify and remove database contents is restrict
ISM-1256File-based access controls are applied to database files.
ISM-1260Default user accounts or credentials for server applications, including for any pre-config
ISM-1263Unique privileged user accounts are used for administering individual server applications.
ISM-1268The need-to-know principle is enforced for database contents through the application of mi
ISM-1269Database servers and web servers are functionally separated.
ISM-1270Database servers are placed on a different network segment to user workstations.
ISM-1271Network access controls are implemented to restrict database server communications to stri
ISM-1272If only local access to a database is required, networking functionality of database manag
ISM-1273Database servers for development, testing, staging and production environments are segrega
ISM-1274Database contents from production environments are not used in non-production environments
ISM-1275All queries to databases from software are filtered for legitimate content and correct syn
ISM-1276Parameterised queries or stored procedures, instead of dynamically generated queries, are
ISM-1277Data communicated between database servers and web servers is encrypted.
ISM-1278Software is designed or configured to provide as little error information as possible abou
ISM-1284Files imported or exported via gateways or CDSs undergo content validation.
ISM-1286Files imported or exported via gateways or CDSs undergo content conversion.
ISM-1287Files imported or exported via gateways or CDSs undergo content sanitisation.
ISM-1288Files imported or exported via gateways or CDSs undergo antivirus scanning using multiple
ISM-1289Archive files imported or exported via gateways or CDSs are unpacked in order to undergo c
ISM-1290Archive files are unpacked in a controlled manner to ensure content filter performance or
ISM-1293Encrypted files imported or exported via gateways or CDSs are decrypted in order to underg
ISM-1294Data transfer logs for systems are partially verified at least monthly.
ISM-1296Physical security is implemented to protect network devices in public areas from physical
ISM-1297Legal advice is sought prior to allowing privately-owned mobile devices and desktop comput
ISM-1298Personnel are advised of privacy and security risks when travelling overseas with mobile d
ISM-1299Personnel are advised to take the following precautions when using mobile devices: - never
ISM-1300Upon returning from travelling overseas with mobile devices, personnel take the following
ISM-1304Default user accounts or credentials for network devices, including for any pre-configured
ISM-1311SNMP version 1 and SNMP version 2 are not used on networks.
ISM-1312All default SNMP community strings on network devices are changed and write access is disa
ISM-1314All wireless devices are Wi-Fi Alliance certified.
ISM-1315The administrative interface on wireless access points is disabled for wireless network co
ISM-1316Default SSIDs of wireless access points are changed.
ISM-1317SSIDs of non-public wireless networks are not readily associated with an organisation, the
ISM-1318SSID broadcasting is not disabled on wireless access points.
ISM-1319Static addressing is not used for assigning IP addresses on wireless networks.
ISM-1320MAC address filtering is not used to restrict which devices can connect to wireless networ
ISM-1321802.1X authentication with EAP-TLS, using X.509 certificates, is used for mutual authentic
ISM-1322Evaluated supplicants, authenticators, wireless access points and authentication servers a
ISM-1323Certificates are required for devices and users accessing wireless networks.
ISM-1324Certificates are generated using an evaluated certificate authority or hardware security m
ISM-1327Certificates are protected by logical and physical access controls, encryption, and user a
ISM-1330The PMK caching period is not set to greater than 1440 minutes (24 hours).
ISM-1332WPA3-Enterprise 192-bit mode is used to protect the confidentiality and integrity of all w
ISM-1334Wireless networks implement sufficient frequency separation from other wireless networks.
ISM-1335Wireless access points enable the use of the 802.11w amendment to protect management frame
ISM-1338Instead of deploying a small number of wireless access points that broadcast on high power
ISM-1341A HIPS or EDR solution is implemented on workstations.
ISM-1359A removable media usage policy is developed, implemented and maintained.
ISM-1361Security Construction and Equipment Committee-approved equipment or ASIO-approved equipmen
ISM-1364Network devices managing VLANs terminate VLANs belonging to different security domains on
ISM-1366Security updates are applied to mobile devices as soon as they become available.
ISM-1369AES-GCM is used for encryption of TLS connections.
ISM-1370Only server-initiated secure renegotiation is used for TLS connections.
ISM-1372DH or ECDH is used for key establishment of TLS connections.
ISM-1373Anonymous DH is not used for TLS connections.
ISM-1374SHA-2-based certificates are used for TLS connections.
ISM-1375SHA-2 is used for the Hash-based Message Authentication Code (HMAC) and pseudorandom funct
ISM-1380Privileged users use separate privileged and unprivileged operating environments.
ISM-1385Administrative infrastructure is segregated from the wider network and the internet.
ISM-1386Network management traffic can only originate from administrative infrastructure.
ISM-1387Administrative activities are conducted through jump servers.
ISM-1389Executable files imported via gateways or CDSs are automatically executed in a sandbox to
ISM-1392When implementing application control using path rules, only approved users can modify app
ISM-1395Service providers, including any subcontractors, provide an appropriate level of protectio
ISM-1400Personnel using privately-owned mobile devices or desktop computers to access OFFICIAL: Se
ISM-1402Credentials stored on systems are protected by a password manager; a hardware security mod
ISM-1403User accounts, except for break glass accounts, are locked out after a maximum of five fai
ISM-1404Unprivileged access to systems and their resources are disabled after 45 days of inactivit
ISM-1405A centralised event logging facility is implemented.
ISM-1406SOEs are used for workstations and servers.
ISM-1407The latest release, or the previous release, of operating systems are used.
ISM-1408Where supported, 64-bit versions of operating systems are used.
ISM-1409Operating systems are hardened using ASD and vendor hardening guidance, with the most rest
ISM-1412Web browsers are hardened using ASD and vendor hardening guidance, with the most restricti
ISM-1416A software firewall is implemented on workstations and servers to restrict inbound and out
ISM-1417An antivirus application is implemented on workstations and servers with: - signature-base
ISM-1418If there is no business requirement for reading from removable media and devices, such fun
ISM-1419Development and modification of software only takes place in development environments.
ISM-1420Data from production environments is not used in non-production environments unless the no
ISM-1422Unauthorised access to the authoritative source for software is prevented.
ISM-1424Content-Security-Policy, Hypertext Transfer Protocol Strict Transport Security and X-Frame
ISM-1427Gateways perform ingress traffic filtering to detect and prevent IP source address spoofin
ISM-1428Unless explicitly required, IPv6 tunnelling is disabled on all network devices.
ISM-1429IPv6 tunnelling is blocked by network security appliances at externally-connected network
ISM-1430Dynamically assigned IPv6 addresses are configured with Dynamic Host Configuration Protoco
ISM-1431Denial-of-service attack mitigation strategies are discussed with cloud service providers,
ISM-1432Domain names for online services are protected via registrar locking and confirming that d
ISM-1436Critical online services are segregated from other online services that are more likely to
ISM-1437Cloud service providers are used for hosting online services.
ISM-1438Where a high availability requirement exists for website hosting, CDNs that cache websites
ISM-1439If using CDNs, disclosing the IP addresses of web servers under an organisation's control
ISM-1446When using elliptic curve cryptography, a suitable curve from NIST SP 800-186 is used.
ISM-1448When using DH or ECDH for key establishment of TLS connections, the ephemeral variant is u
ISM-1449SSH private keys are protected with a password or a key encryption key.
ISM-1450Microphones (including headsets and USB handsets) and webcams are not used with non-TOP SE
ISM-1451Types of data and its ownership is documented in contractual arrangements with service pro
ISM-1452A supply chain risk assessment is performed for suppliers of operating systems, applicatio
ISM-1453Perfect Forward Secrecy (PFS) is used for TLS connections.
ISM-1454Communications between authenticators and a RADIUS server are encapsulated with an additio
ISM-1457Evaluated peripheral switches used for sharing peripherals between SECRET and TOP SECRET s
ISM-1460When using a software-based isolation mechanism to share a physical server's hardware, the
ISM-1461When using a software-based isolation mechanism to share a physical server's hardware for
ISM-1467The latest release of office productivity suites, web browsers and their extensions, email
ISM-1470Unneeded components, services and functionality of office productivity suites, web browser
ISM-1471When implementing application control using publisher certificate rules, publisher names a
ISM-1478The CISO oversees their organisation's cyber security program and ensures their organisati
ISM-1479Servers minimise communications with other servers at the network and file system level.
ISM-1480Evaluated peripheral switches used for sharing peripherals between SECRET or TOP SECRET sy
ISM-1482Personnel using organisation-owned mobile devices or desktop computers to access classifie
ISM-1483The latest release of internet-facing server applications are used.
ISM-1485Web browsers do not process web advertisements from the internet.
ISM-1486Web browsers do not process Java from the internet.
ISM-1491Unprivileged users are prevented from running script execution engines, including: - Windo
ISM-1492Operating system exploit protection functionality is enabled.
ISM-1493Software registers for workstations, servers, network devices and networked IT equipment a
ISM-1501Operating systems that are no longer supported by vendors are replaced.
ISM-1502Emails arriving via an external connection where the email source address uses an internal
ISM-1506The use of SSH version 1 is disabled for SSH connections.
ISM-1510A digital preservation policy is developed, implemented and maintained.
ISM-1517Equipment that is capable of reducing microform to a fine powder, with resultant particles
ISM-1520System administrators for gateways undergo appropriate employment screening, and where nec
ISM-1521CDSs implement protocol breaks at each network layer.
ISM-1522CDSs implement independent security-enforcing functions for upward and downward network pa
ISM-1523A sample of security-relevant events relating to data transfer policies are taken at least
ISM-1524Content filters used by CDSs undergo rigorous security testing to ensure they perform as e
ISM-1525System owners register each system with its authorising officer.
ISM-1526System owners continuously monitor the security of each system, and manage associated cybe
ISM-1528Evaluated firewalls are used between an organisation's networks and public network infrast
ISM-1529Only community or private clouds are used for outsourced SECRET and TOP SECRET cloud servi
ISM-1530Classified servers, network devices and cryptographic equipment are secured in security co
ISM-1532VLANs are not used to separate network traffic between an organisation's networks and publ
ISM-1533A mobile device management policy is developed, implemented and maintained.
ISM-1534Printer ribbons in printers and MFDs are removed and destroyed.
ISM-1535Processes, and supporting procedures, are developed, implemented and maintained to prevent
ISM-1536All queries to databases from software that are initiated by users, and any resulting cras
ISM-1537Security-relevant events for databases are centrally logged, including: - access or modifi
ISM-1540DMARC records are configured for an organisation's domains (including subdomains) such tha
ISM-1542Microsoft Office is configured to prevent activation of Object Linking and Embedding packa
ISM-1543An authorised RF and IR device register for SECRET and TOP SECRET areas is developed, impl
ISM-1546Users are authenticated before they are granted access to a system and its resources.
ISM-1547Data backup processes, and supporting data backup procedures, are developed, implemented a
ISM-1548Data restoration processes, and supporting data restoration procedures, are developed, imp
ISM-1549A media management policy is developed, implemented and maintained.
ISM-1550IT equipment disposal processes, and supporting IT equipment disposal procedures, are deve
ISM-1551An IT equipment management policy is developed, implemented and maintained.
ISM-1552All web application content is offered exclusively using HTTPS.
ISM-1553TLS compression is disabled for TLS connections.
ISM-1554If travelling overseas with mobile devices to high or extreme risk countries, personnel ar
ISM-1555Before travelling overseas with mobile devices, personnel take the following actions: - re
ISM-1556If returning from travelling overseas with mobile devices to high or extreme risk countrie
ISM-1557Passwords used for single-factor authentication on SECRET systems are a minimum of 17 char
ISM-1558Passwords using a sequence of words for single-factor authentication are not constructed u
ISM-1559Passwords used for multi-factor authentication on non-classified, OFFICIAL: Sensitive and
ISM-1560Passwords used for multi-factor authentication on SECRET systems are a minimum of 8 charac
ISM-1561Passwords used for multi-factor authentication on TOP SECRET systems are a minimum of 10 c
ISM-1562Video conferencing and IP telephony infrastructure is hardened.
ISM-1563At the conclusion of a security assessment for a system, a security assessment report is p
ISM-1564At the conclusion of a security assessment for a system, a plan of action and milestones i
ISM-1565Tailored privileged user training is undertaken annually by all privileged users.
ISM-1566Use of unprivileged access is centrally logged.
ISM-1567Suppliers identified as high risk by a cyber supply chain risk assessment are not used.
ISM-1568Operating systems, applications, IT equipment, OT equipment and services are procured from
ISM-1569A shared responsibility model is created, documented and shared between suppliers and thei
ISM-1570Outsourced cloud service providers and their non-classified, OFFICIAL: Sensitive, PROTECTE
ISM-1571The right to verify compliance with security requirements is documented in contractual arr
ISM-1572The regions or availability zones where data will be processed, stored and communicated, a
ISM-1573Access to all logs relating to an organisation's data and services is documented in contra
ISM-1574The storage of data in a portable manner that allows for backups, service migration and se
ISM-1575A minimum notification period of one month for the cessation of any services by a service
ISM-1576If an organisation's systems are accessed or administered by a service provider in an unau
ISM-1577An organisation's networks are segregated from their service providers' networks.
ISM-1579Cloud service providers' ability to dynamically scale resources in response to a genuine s
ISM-1580Where a high availability requirement exists for online services, the services are archite
ISM-1581Continuous real-time monitoring of the capacity and availability of online services is per
ISM-1583Personnel who are contractors are identified as such.
ISM-1584Unprivileged users are prevented from bypassing, disabling or modifying security functiona
ISM-1585Web browser security settings cannot be changed by users.
ISM-1586Data transfer logs are used to record all data imports and exports from systems.
ISM-1587System owners report the security status of each system to its authorising officer at leas
ISM-1588SOEs are reviewed and updated at least annually.
ISM-1589MTA-STS is enabled to prevent the unencrypted transfer of emails between email servers.
ISM-1590Credentials for user accounts are changed if: - they are compromised - they are suspected
ISM-1591Access to systems and their resources are removed or suspended as soon as practicable when
ISM-1592Unprivileged users do not have the ability to install unapproved applications.
ISM-1593Users provide sufficient evidence to verify their identity when requesting new credentials
ISM-1594Credentials are provided to users via a secure communications channel or, if not possible,
ISM-1595Credentials provided to users are changed on first use.
ISM-1596Credentials are not reused by users across different systems.
ISM-1597Credentials are obscured as they are entered into systems.
ISM-1598Following maintenance or repair activities for IT equipment, the IT equipment is inspected
ISM-1599IT equipment is handled in a manner suitable for its sensitivity or classification.
ISM-1600Media is sanitised before it is used for the first time.
ISM-1601Microsoft's attack surface reduction rules are implemented.
ISM-1602Cyber security documentation, including notification of subsequent changes, is communicate
ISM-1603Authentication methods susceptible to replay attacks are disabled.
ISM-1604When using a software-based isolation mechanism to share a physical server's hardware, the
ISM-1605When using a software-based isolation mechanism to share a physical server's hardware, the
ISM-1606When using a software-based isolation mechanism to share a physical server's hardware, pat
ISM-1607When using a software-based isolation mechanism to share a physical server's hardware, int
ISM-1608SOEs provided by third parties are scanned for malicious code and configurations.
ISM-1609System owners are consulted before allowing intrusion activity to continue on a system for
ISM-1610A method of emergency access to systems and their resources is documented and tested at le
ISM-1611Break glass accounts are only used when normal authentication processes cannot be used.
ISM-1612Break glass accounts are only used for specific authorised activities.
ISM-1613Use of break glass accounts is centrally logged.
ISM-1614Break glass account credentials are changed by the account custodian after they are access
ISM-1615Break glass accounts are tested after credentials are changed.
ISM-1616A vulnerability disclosure program is implemented to assist with the secure development an
ISM-1617The CISO regularly reviews and updates their organisation's cyber security program to ensu
ISM-1618The CISO oversees their organisation's response to cyber security incidents.
ISM-1619Service accounts are created as group Managed Service Accounts.
ISM-1620Privileged user accounts are members of the Protected Users security group.
ISM-1621Windows PowerShell 2.0 is disabled or removed.
ISM-1622PowerShell is configured to use Constrained Language Mode.
ISM-1623PowerShell module logging, script block logging and transcription events are centrally log
ISM-1624PowerShell script block logs are protected by Protected Event Logging functionality.
ISM-1625An insider threat mitigation program is developed, implemented and maintained.
ISM-1626Legal advice is sought regarding the development and implementation of an insider threat m
ISM-1627Inbound network connections from anonymity networks are blocked.
ISM-1628Outbound network connections to anonymity networks are blocked.
ISM-1629When using DH for agreeing on encryption session keys, a modulus and associated parameters
ISM-1631Suppliers of operating systems, applications, IT equipment, OT equipment and services asso
ISM-1632Operating systems, applications, IT equipment, OT equipment and services are procured from
ISM-1633System owners, in consultation with each system's authorising officer, determine the syste
ISM-1634System owners, in consultation with each system's authorising officer, select controls for
ISM-1635System owners implement controls for each system and its operating environment.
ISM-1636System owners, in consultation with each system's authorising officer, ensure controls for
ISM-1637An outsourced cloud service register is developed, implemented, maintained and verified on
ISM-1638An outsourced cloud service register contains the following for each outsourced cloud serv
ISM-1639Building management cables are labelled with their purpose in black writing on a yellow ba
ISM-1640Cables for foreign systems installed in Australian facilities are labelled at inspection p
ISM-1641Following the use of a degausser, magnetic media is physically damaged by deforming any in
ISM-1642Media is sanitised before it is reused in a different security domain.
ISM-1643Software registers contain versions and patch histories of applications, drivers, operatin
ISM-1644Sensitive or classified phone calls and conversations are not conducted in public location
ISM-1645Floor plan diagrams are developed, implemented, maintained and verified on a regular basis
ISM-1646Floor plan diagrams contain the following: - cable paths (including ingress and egress poi
ISM-1647Privileged access to systems and their resources are disabled after 12 months unless reval
ISM-1648Privileged access to systems and their resources are disabled after 45 days of inactivity.
ISM-1654Internet Explorer 11 is disabled or removed.
ISM-1655.NET Framework 3.5 (includes .NET 2.0 and 3.0) is disabled or removed.
ISM-1667Microsoft Office is blocked from creating child processes.
ISM-1668Microsoft Office is blocked from creating executable content.
ISM-1669Microsoft Office is blocked from injecting code into other processes.
ISM-1670PDF applications are blocked from creating child processes.
ISM-1685Credentials for break glass accounts, local administrator accounts and service accounts ar
ISM-1686Credential Guard functionality is enabled.
ISM-1687Privileged operating environments are not virtualised within unprivileged operating enviro
ISM-1688Unprivileged user accounts cannot logon to privileged operating environments.
ISM-1689Privileged user accounts (excluding local administrator accounts) cannot logon to unprivil
ISM-1690Patches, updates or other vendor mitigations for vulnerabilities in online services are ap
ISM-1691Patches, updates or other vendor mitigations for vulnerabilities in office productivity su
ISM-1692Patches, updates or other vendor mitigations for vulnerabilities in office productivity su
ISM-1693Patches, updates or other vendor mitigations for vulnerabilities in applications other tha
ISM-1694Patches, updates or other vendor mitigations for vulnerabilities in operating systems of i
ISM-1695Patches, updates or other vendor mitigations for vulnerabilities in operating systems of w
ISM-1696Patches, updates or other vendor mitigations for vulnerabilities in operating systems of w
ISM-1697Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied wi
ISM-1698A vulnerability scanner is used at least daily to identify missing patches or updates for
ISM-1699A vulnerability scanner is used at least weekly to identify missing patches or updates for
ISM-1700A vulnerability scanner is used at least fortnightly to identify missing patches or update
ISM-1701A vulnerability scanner is used at least daily to identify missing patches or updates for
ISM-1702A vulnerability scanner is used at least fortnightly to identify missing patches or update
ISM-1703A vulnerability scanner is used at least fortnightly to identify missing patches or update
ISM-1704Office productivity suites, web browsers and their extensions, email clients, PDF applicat
ISM-1710Settings for wireless access points are hardened.
ISM-1711User identity confidentiality is used if available with EAP-TLS implementations.
ISM-1712The use of FT (802.11r) is disabled unless authenticator-to-authenticator communications a
ISM-1713A removable media register is developed, implemented, maintained and verified on a regular
ISM-1717A 'security.txt' file is hosted for each of an organisation's internet-facing website doma
ISM-1718SECRET cables are coloured salmon pink.
ISM-1719TOP SECRET cables are coloured red.
ISM-1720SECRET wall outlet boxes are coloured salmon pink.
ISM-1721TOP SECRET wall outlet boxes are coloured red.
ISM-1722Electrostatic memory devices are destroyed using a furnace/incinerator, hammer mill, disin
ISM-1723Magnetic floppy disks are destroyed using a furnace/incinerator, hammer mill, disintegrato
ISM-1724Magnetic hard disks are destroyed using a furnace/incinerator, hammer mill, disintegrator,
ISM-1725Magnetic tapes are destroyed using a furnace/incinerator, hammer mill, disintegrator, dega
ISM-1726Optical disks are destroyed using a furnace/incinerator, hammer mill, disintegrator, grind
ISM-1727Semiconductor memory is destroyed using a furnace/incinerator, hammer mill or disintegrato
ISM-1728The resulting media waste particles from the destruction of SECRET media is stored and han
ISM-1729The resulting media waste particles from the destruction of TOP SECRET media is stored and
ISM-1730A software bill of materials is produced and made available to consumers of software.
ISM-1731Planning and coordination of intrusion remediation activities are conducted on a separate
ISM-1732To the extent possible, all intrusion remediation activities are conducted in a coordinate
ISM-1735Media that cannot be successfully sanitised is destroyed prior to its disposal.
ISM-1736A managed service register is developed, implemented, maintained and verified on a regular
ISM-1737A managed service register contains the following for each managed service: - managed serv
ISM-1738The right to verify compliance with security requirements documented in contractual arrang
ISM-1739A system's security architecture is approved prior to the development of the system.
ISM-1740Personnel dealing with banking details and payment requests are advised of what business e
ISM-1741IT equipment destruction processes, and supporting IT equipment destruction procedures, ar
ISM-1742IT equipment that cannot be sanitised is destroyed.
ISM-1743Vendors that have demonstrated a commitment to Secure by Design and Secure by Default prin
ISM-1745Early Launch Antimalware, Secure Boot, Trusted Boot and Measured Boot functionality is ena
ISM-1746When implementing application control using path rules, only approved users can change fil
ISM-1748Email client security settings cannot be changed by users.
ISM-1749Cached credentials are limited to one previous logon.
ISM-1750Administrative infrastructure for critical servers, high-value servers and regular servers
ISM-1751Patches, updates or other vendor mitigations for vulnerabilities in operating systems of I
ISM-1752A vulnerability scanner is used at least fortnightly to identify missing patches or update
ISM-1753Internet-facing network devices that are no longer supported by vendors are replaced.
ISM-1754Vulnerabilities identified in software are resolved in a timely manner.
ISM-1755A vulnerability disclosure policy is developed, implemented and maintained.
ISM-1756Vulnerability disclosure processes, and supporting vulnerability disclosure procedures, ar
ISM-1759When using DH for agreeing on encryption session keys, a modulus of at least 3072 bits is
ISM-1761When using ECDH for agreeing on encryption session keys, NIST P-256, P-384 or P-521 curves
ISM-1762When using ECDH for agreeing on encryption session keys, NIST P-384 or P-521 curves are us
ISM-1763When using ECDSA for digital signatures, NIST P-256, P-384 or P-521 curves are used, prefe
ISM-1764When using ECDSA for digital signatures, NIST P-384 or P-521 curves are used, preferably t
ISM-1765When using RSA for digital signatures, and transporting encryption session keys (and simil
ISM-1766When using SHA-2 for hashing, an output size of at least 224 bits is used, preferably SHA-
ISM-1767When using SHA-2 for hashing, an output size of at least 256 bits is used, preferably SHA-
ISM-1768When using SHA-2 for hashing, an output size of at least 384 bits is used, preferably SHA-
ISM-1769When using AES for encryption, AES-128, AES-192 or AES-256 is used, preferably AES-256.
ISM-1770When using AES for encryption, AES-192 or AES-256 is used, preferably AES-256.
ISM-1771AES is used for encrypting IPsec connections, preferably ENCR_AES_GCM_16.
ISM-1772PRF_HMAC_SHA2_256, PRF_HMAC_SHA2_384 or PRF_HMAC_SHA2_512 is used for IPsec connections, p
ISM-1773System administrators for gateways that connect to Australian Government Access Only netwo
ISM-1774Gateways are managed via a secure path isolated from all connected networks.
ISM-1778When manually importing data to systems, all data that fails security checks is quarantine
ISM-1779When manually exporting data from systems, all data that fails security checks is quaranti
ISM-1780SecDevOps practices are used for software development.
ISM-1781All data communicated over network infrastructure is encrypted.
ISM-1782A protective DNS service is used to block access to known malicious domain names.
ISM-1783Public IP addresses controlled by, or used by, an organisation are signed by valid ROA rec
ISM-1784The cyber security incident management policy, including the associated cyber security inc
ISM-1785A supplier relationship management policy is developed, implemented and maintained.
ISM-1786An approved supplier list is developed, implemented and maintained.
ISM-1787Operating systems, applications, IT equipment, OT equipment and services are sourced from
ISM-1788Multiple potential suppliers are identified for sourcing critical operating systems, appli
ISM-1789Sufficient spares of critical IT equipment and OT equipment are sourced and kept in reserv
ISM-1790Operating systems, applications, IT equipment, OT equipment and services are delivered in
ISM-1791The integrity of operating systems, applications, IT equipment, OT equipment and services
ISM-1792The authenticity of operating systems, applications, IT equipment, OT equipment and servic
ISM-1793Managed service providers and their non-classified, OFFICIAL: Sensitive, PROTECTED and SEC
ISM-1794A minimum notification period of one month by service providers for significant changes to
ISM-1795Credentials for built-in Administrator accounts, break glass accounts, local administrator
ISM-1796Files containing executable content are digitally signed by a certificate with a verifiabl
ISM-1797Installers, patches and updates are digitally signed or provided with cryptographic checks
ISM-1798Secure configuration guidance, in the form of a hardening guide or loosening guide, is pro
ISM-1799Incoming emails are rejected if they do not pass DMARC checks.
ISM-1800Network devices are flashed with trusted firmware before they are used for the first time.
ISM-1801Network devices are restarted on at least a monthly basis.
ISM-1802HACE are issued an Approval for Use by ASD and operated in accordance with the latest vers
ISM-1803A cyber security incident register contains the following for each cyber security incident
ISM-1804Break clauses associated with failure to meet security requirements are documented in cont
ISM-1805A denial of service response plan for video conferencing and IP telephony services contain
ISM-1806Default user accounts or credentials for user applications, including for any pre-configur
ISM-1807An automated method of asset discovery is used at least fortnightly to support the detecti
ISM-1808A vulnerability scanner with an up-to-date vulnerability database is used for vulnerabilit
ISM-1809When applications, operating systems, network devices or networked IT equipment that are n
ISM-1815Event logs are protected from unauthorised modification and deletion.
ISM-1816Unauthorised modification of the authoritative source for software is prevented.
ISM-1817Authentication and authorisation of clients is performed when clients call network APIs th
ISM-1818Authentication and authorisation of clients is performed when clients call network APIs th
ISM-1819Following the identification of a cyber security incident, the cyber security incident res
ISM-1820Cables for individual systems use a consistent colour.
ISM-1821TOP SECRET cables, when bundled together or run in conduit, are run exclusively in their o
ISM-1822Wall outlet boxes for individual systems use a consistent colour.
ISM-1823Office productivity suite security settings cannot be changed by users.
ISM-1824PDF application security settings cannot be changed by users.
ISM-1825Security product security settings cannot be changed by users.
ISM-1826Vendors that have demonstrated a commitment to Secure by Design and Secure by Default prin
ISM-1827Microsoft AD DS domain controllers are administered using dedicated domain administrator u
ISM-1828The Print Spooler service is disabled on Microsoft AD DS domain controllers.
ISM-1829Passwords are not stored in Group Policy Preferences.
ISM-1830Security-relevant events for Microsoft AD DS domain controllers, Microsoft AD CS CA server
ISM-1832Only service accounts and computer accounts are configured with Service Principal Names (S
ISM-1833User accounts are provisioned with the minimum privileges required.
ISM-1834Duplicate SPNs do not exist within the domain.
ISM-1835Privileged user accounts are configured as sensitive and cannot be delegated.
ISM-1836User accounts require Kerberos pre-authentication.
ISM-1838The UserPassword attribute for user accounts is not used.
ISM-1839Account properties accessible by unprivileged users are not used to store passwords.
ISM-1840User account passwords do not use reversible encryption.
ISM-1841Unprivileged user accounts cannot add machines to the domain.
ISM-1842Dedicated privileged service accounts are used to add machines to the domain.
ISM-1843User accounts with unconstrained delegation are reviewed at least annually, and those with
ISM-1844Computer accounts that are not Microsoft AD DS domain controllers are not trusted for dele
ISM-1845When a user account is disabled, it is removed from all security group memberships.
ISM-1846The Pre-Windows 2000 Compatible Access security group does not contain user accounts.
ISM-1847Credentials for the Kerberos Key Distribution Center's service account (KRBTGT) are change
ISM-1848When using a software-based isolation mechanism to share a physical server's hardware, the
ISM-1849The OWASP Top 10 Proactive Controls are used in the development of web applications.
ISM-1850The OWASP Top 10 are mitigated in the development of web applications.
ISM-1851The OWASP API Security Top 10 are mitigated in the development of web APIs.
ISM-1852Unprivileged access to systems and their resources is limited to only what is required for
ISM-1854Users authenticate to MFDs before they can print, scan or copy documents.
ISM-1855Use of MFDs for printing, scanning and copying purposes, including the capture of shadow c
ISM-1858IT equipment is hardened using ASD and vendor hardening guidance, with the most restrictiv
ISM-1859Office productivity suites are hardened using ASD and vendor hardening guidance, with the
ISM-1860PDF applications are hardened using ASD and vendor hardening guidance, with the most restr
ISM-1861Local Security Authority protection functionality is enabled.
ISM-1862If using a WAF, disclosing the IP addresses of web servers under an organisation's control
ISM-1863Networked management interfaces for IT equipment are not directly exposed to the internet.
ISM-1864A system usage policy is developed, implemented and maintained.
ISM-1865Personnel agree to abide by system usage policies before being granted access to systems a
ISM-1866Personnel using privately-owned mobile devices or desktop computers to access OFFICIAL: Se
ISM-1867Mobile devices that access OFFICIAL: Sensitive or PROTECTED systems or data use mobile pla
ISM-1868SECRET and TOP SECRET mobile devices do not use removable media unless approved beforehand
ISM-1869A non-networked IT equipment register is developed, implemented, maintained and verified o
ISM-1875Networks are scanned at least monthly to identify any credentials that are being stored in
ISM-1876Patches, updates or other vendor mitigations for vulnerabilities in online services are ap
ISM-1877Patches, updates or other vendor mitigations for vulnerabilities in operating systems of i
ISM-1878Patches, updates or other vendor mitigations for vulnerabilities in operating systems of I
ISM-1879Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied wi
ISM-1880Cyber security incidents that involve customer data are reported to customers and the publ
ISM-1881Cyber security incidents that do not involve customer data are reported to customers and t
ISM-1882Operating systems, applications, IT equipment, OT equipment and services are procured from
ISM-1884Emanation security doctrine produced by ASD for the management of emanation security matte
ISM-1885Recommended actions contained within emanation security mitigation advice issued for syste
ISM-1886Mobile devices are configured to operate in a supervised (or equivalent) mode.
ISM-1887Mobile devices are configured with remote locate and wipe functionality.
ISM-1888Mobile devices are configured with secure password-based lock screens.
ISM-1889Command line process creation events are centrally logged.
ISM-1895Successful and unsuccessful single-factor authentication events are centrally logged.
ISM-1896Memory integrity functionality is enabled.
ISM-1897Remote Credential Guard functionality is enabled.
ISM-1898Secure Admin Workstations are used in the performance of administrative activities.
ISM-1899Network devices that do not belong to administrative infrastructure cannot initiate connec
ISM-1900A vulnerability scanner is used at least fortnightly to identify missing patches or update
ISM-1901Patches, updates or other vendor mitigations for vulnerabilities in office productivity su
ISM-1902Patches, updates or other vendor mitigations for vulnerabilities in operating systems of w
ISM-1903Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied w
ISM-1904Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied w
ISM-1905Online services that are no longer supported by vendors are removed.
ISM-1906Event logs from internet-facing servers are analysed in a timely manner to detect cyber se
ISM-1907Event logs from non-internet-facing servers are analysed in a timely manner to detect cybe
ISM-1908Vulnerabilities identified in software are publicly disclosed in a responsible and timely
ISM-1909In resolving vulnerabilities, root cause analysis is performed and, to the greatest extent
ISM-1910Network API calls that facilitate modification of data, or access to data not authorised f
ISM-1911Security-relevant usage, error messages and crashes for software are centrally logged.
ISM-1912Network documentation includes device settings for all critical servers, high-value server
ISM-1913Approved configurations for IT equipment are developed, implemented and maintained.
ISM-1914Approved configurations for operating systems are developed, implemented and maintained.
ISM-1915Approved configurations for user applications are developed, implemented and maintained.
ISM-1916Approved configurations for server applications are developed, implemented and maintained.
ISM-1917The development and procurement of new cryptographic equipment, applications and libraries
ISM-1918The CISO regularly reports directly to their organisation's audit, risk and compliance com
ISM-1919When multi-factor authentication is used to authenticate users or customers to online serv
ISM-1920When multi-factor authentication is used to authenticate users to online services, online
ISM-1921The likelihood of system compromise is frequently assessed when working exploits exist for
ISM-1922The OWASP Mobile Application Security Verification Standard is used in the development of
ISM-1924Generative artificial intelligence applications evaluate user prompts to detect and mitiga
ISM-1926Microsoft AD DS domain controllers, Microsoft AD CS CA servers, Microsoft AD FS servers an
ISM-1927Access to Microsoft AD DS domain controllers, Microsoft AD CS CA servers, Microsoft AD FS
ISM-1928Backups of Microsoft AD DS domain controllers, Microsoft AD CS CA servers, Microsoft AD FS
ISM-1929Lightweight Directory Access Protocol signing is enabled on Microsoft AD DS domain control
ISM-1930Passwords are prevented from being stored in Group Policy Preferences.
ISM-1931SID Filtering is enabled for domain and forest trusts.
ISM-1932The number of service accounts configured with an SPN is minimised.
ISM-1933Service accounts configured with an SPN do not have DCSync permissions.
ISM-1934User accounts with DCSync permissions are reviewed at least annually, and those without an
ISM-1935Computer accounts are not configured for unconstrained delegation.
ISM-1936The sIDHistory attribute for user accounts is not used.
ISM-1937User accounts are checked at least weekly for the presence of the sIDHistory attribute.
ISM-1938The Domain Computers security group does not have write or modify permissions to any Micro
ISM-1939The number of user accounts that are members of the Domain Admins, Enterprise Admins or ot
ISM-1940Service accounts are not members of the Domain Admins, Enterprise Admins or other highly-p
ISM-1941Computer accounts are not members of the Domain Admins, Enterprise Admins or other highly-
ISM-1942The Domain Computers security group is not a member of any privileged or highly-privileged
ISM-1943Strong mapping between certificates and users is enforced.
ISM-1944The EDITF_ATTRIBUTESUBJECTALTNAME2 flag is removed from Microsoft AD CS CA configurations.
ISM-1945The CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag is removed from certificate templates.
ISM-1946Unprivileged user accounts do not have write access to certificate templates.
ISM-1947Extended Key Usages that enable user authentication are removed.
ISM-1948CA Certificate Manager approval is required for certificate templates that allow a Subject
ISM-1949Microsoft AD FS servers are administered using a dedicated service account that is not use
ISM-1950Soft matching between Microsoft AD DS and Microsoft Entra ID is disabled following initial
ISM-1951Hard match takeover is disabled for Microsoft Entra Connect servers.
ISM-1952Privileged user accounts are not synchronised between Microsoft AD DS and Microsoft Entra
ISM-1953Credentials for the built-in Administrator account in each domain are long, unique, unpred
ISM-1954Credentials for built-in Administrator accounts, break glass accounts, local administrator
ISM-1955Credentials for computer accounts are changed if they are compromised, they are suspected
ISM-1956Microsoft AD FS token-signing and encryption certificates are changed twice in quick succe
ISM-1957Private keys for Microsoft AD CS CA servers are protected by a hardware security module.
ISM-1958User accounts with DCSync permissions cannot logon to unprivileged operating environments.
ISM-1959To the extent possible, event logs are captured and stored in a consistent and structured
ISM-1960Event logs from internet-facing network devices are analysed in a timely manner to detect
ISM-1961Event logs from non-internet-facing network devices are analysed in a timely manner to det
ISM-1962SMB version 1 is not used on networks.
ISM-1963Security-relevant events for internet-facing network devices are centrally logged.
ISM-1964Security-relevant events for non-internet-facing network devices are centrally logged.
ISM-1965Files imported or exported via gateways or CDSs undergo content checking.
ISM-1966The CISO develops, implements, maintains and verifies on a regular basis a register of sys
ISM-1967System owners, in consultation with each system's authorising officer, ensure controls for
ISM-1968System owners obtain an authorisation to operate for each TOP SECRET system, including for
ISM-1969Malicious code, when stored or communicated, is treated beforehand to prevent accidental e
ISM-1970Malicious code processed for cyber security incident response or research purposes is done
ISM-1971Managed service providers and their TOP SECRET managed services, including sensitive compa
ISM-1972Outsourced cloud service providers and their TOP SECRET cloud services, including sensitiv
ISM-1973Non-classified systems are secured in suitably secure facilities.
ISM-1974Non-classified servers, network devices and cryptographic equipment are secured in suitabl
ISM-1975Non-classified servers, network devices and cryptographic equipment are secured in suitabl
ISM-1976Security-relevant events for Apple macOS operating systems are centrally logged.
ISM-1977Security-relevant events for Linux operating systems are centrally logged.
ISM-1978Security-relevant events for server applications on internet-facing servers are centrally
ISM-1979Security-relevant events for server applications on non-internet-facing servers are centra
ISM-1980Credential hint functionality is not used for systems.
ISM-1981Non-internet-facing network devices that are no longer supported by vendors are replaced.
ISM-1982Networked IT equipment that is no longer supported by vendors is replaced.
ISM-1983Event logs sent to a centralised event logging facility are done so as soon as possible af
ISM-1984Event logs sent to a centralised event logging facility are encrypted in transit.
ISM-1985Event logs are protected from unauthorised access.
ISM-1986Event logs from critical servers are analysed in a timely manner to detect cyber security
ISM-1987Event logs from security products are analysed in a timely manner to detect cyber security
ISM-1988Event logs are retained in a searchable manner for at least 12 months.
ISM-1989Event logs are retained as per minimum retention requirements for various classes of recor
ISM-1990When using ML-DSA and ML-KEM, as per FIPS 204 and FIPS 203 respectively, adherence to pre-
ISM-1991When using ML-DSA for digital signatures, ML-DSA-65 or ML-DSA-87 is used, preferably ML-DS
ISM-1992When using ML-DSA for digital signatures, the hedged variant is used whenever possible.
ISM-1993Pre-hashed variants of ML-DSA-65 and ML-DSA-87 are only used when the performance of defau
ISM-1994When the pre-hashed variants of ML-DSA-65 and ML-DSA-87 are used, at least SHA-384 and SHA
ISM-1995When using ML-KEM for encapsulating encryption session keys (and similar keys), ML-KEM-768
ISM-1996When a post-quantum traditional hybrid scheme is used, either the post-quantum cryptograph
ISM-1997The board of directors or executive committee defines clear roles and responsibilities for
ISM-1998The board of directors or executive committee ensures that cyber security is integrated th
ISM-1999The board of directors or executive committee ensures the cyber security strategy for thei
ISM-2000The board of directors or executive committee seeks regular briefings or reporting on the
ISM-2001The board of directors or executive committee champions a positive cyber security culture
ISM-2002The board of directors or executive committee maintains a sufficient level of cyber securi
ISM-2003The board of directors or executive committee maintains awareness of key cyber security re
ISM-2004The board of directors or executive committee supports the development of cyber security s
ISM-2005The board of directors or executive committee understands the business criticality of thei
ISM-2006The board of directors or executive committee plans for major cyber security incidents, in
ISM-2007An authorised medical device register for SECRET and TOP SECRET areas is developed, implem
ISM-2008Medical devices that are authorised to be brought into SECRET and TOP SECRET areas meet, a
ISM-2009Unauthorised medical devices are not brought into SECRET and TOP SECRET areas.
ISM-2010Service accounts configured with an SPN use the Advanced Encryption Standard for encryptio
ISM-2011When phishing-resistant multi-factor authentication is used by user accounts, other non-ph
ISM-2012Systems are configured with a screen lock that: - activates after a maximum of 15 minutes
ISM-2013Authentication and authorisation of clients is performed when clients call network APIs th
ISM-2014Authentication and authorisation of clients is performed when clients call network APIs th
ISM-2015Network API calls that facilitate modification of data, or access to data not authorised f
ISM-2016Validation and sanitisation are performed on all input received over a local network by so
ISM-2017DNS traffic is encrypted by clients and servers wherever supported.
ISM-2018Routes for RPKI-registered IP addresses that are advertised from invalid Autonomous System
ISM-2019TOP SECRET gateways undergo a security assessment by ASD assessors (or their delegates), u
ISM-2020The CISO ensures sufficient cyber security personnel, with the right skills and experience
ISM-2021System owners implement and maintain data minimisation practices for each of their systems
ISM-2022A cyber security awareness training register is developed, implemented and maintained.
ISM-2023An authoritative source for software is established and maintained.
ISM-2024The authoritative source for software is used for all software development activities.
ISM-2025An issue tracking solution is used to link software development tasks to security issues a
ISM-2026All software artefacts are scanned for malicious content before being imported into the au
ISM-2027All software artefacts are verified by a digital signature, or a secure hash provided over
ISM-2028All software artefacts are tested to detect known weaknesses using static application secu
ISM-2029The authoritative source for software restricts the use and import of third-party librarie
ISM-2030Scanning is used during commits to identify plain text or encoded secrets and keys, which
ISM-2031Compilers, interpreters and build tools (including pipelines) that provide security featur
ISM-2032The build solution ensures that all automated testing is completed without warnings, alert
ISM-2033All software security requirements are documented, stored securely and maintained througho
ISM-2034Security design decisions are documented and reviewed throughout the software development
ISM-2035Security roles, responsibilities and knowledge requirements required to support the softwa
ISM-2036Security responsibilities for software developers are identified and documented.
ISM-2037Software developers that lack sufficient cyber security knowledge and skills required for
ISM-2038A software developer cyber security knowledge and skills register is implemented and maint
ISM-2039The software threat model is reviewed throughout the software development life cycle to en
ISM-2040Secure programming practices for the chosen programming language are used for software dev
ISM-2041Memory-safe programming languages, or less preferably memory-safe programming practices, a
ISM-2042Secure by Default principles and practices are followed throughout the software developmen
ISM-2043Software is architected and structured to support readability and maintainability.
ISM-2044Software has no default credentials; however, if credentials are required, they are create
ISM-2045Application backwards compatibility does not compromise any security measures or features.
ISM-2046Where software allows user impersonation, sensitive data is not logged and appropriate per
ISM-2047Where software allows an authentication factor to be reset, the user is notified of the re
ISM-2048Where software supports multiple user roles, non-administrative users are prevented from a
ISM-2049When user permissions or credentials are changed, software forces all impacted users to re
ISM-2050When digital signatures are processed by software, they are validated against a certificat
ISM-2051Software generates sufficient event logs to support the detection of cyber security events
ISM-2052Event logs produced by software ensure that any sensitive data is protected.
ISM-2053End of life procedures for software, covering how to remove the software and how to archiv
ISM-2054If a software bill of materials is available for imported third-party software components,
ISM-2055If a software build provenance is available for imported third-party software components,
ISM-2056A software build provenance is produced and made available to consumers of software.
ISM-2057All input validation rules are documented, matched in code and tested with both positive a
ISM-2058Data sources and serialised data inputs are validated before being deserialised.
ISM-2059File uploads or input are restricted to specific file types, with malicious content scanni
ISM-2060Code reviews are utilised to ensure software meets Secure by Design principles and practic
ISM-2061Software developer-supported security-focused peer reviews are conducted on all critical a
ISM-2062Unit testing and integration testing, covering both positive and negative use cases, are u
ISM-2063If supported, web application session cookies set the HttpOnly flag, Secure flag and the S
ISM-2064Web application session cookies contain only digitally signed opaque bearer tokens.
ISM-2065Web application session cookies using opaque bearer tokens that are not digitally signed u
ISM-2066Web application sessions are centrally managed server side.
ISM-2067Web applications that support Single Sign On equally support Single Logout.
ISM-2068Internet connectivity for networked devices is strictly limited to those that require acce
ISM-2069An authorised photographic and video recording device register for SECRET and TOP SECRET a
ISM-2070Unauthorised photographic and video recording devices are not brought into SECRET and TOP
ISM-2071Personnel dealing with user account details are advised of what social engineering attacks
ISM-2072Artificial intelligence models are stored in a non-executable file format that does not al
ISM-2073A post-quantum cryptography transition plan is developed, implemented and maintained.
ISM-2074A general-purpose artificial intelligence usage policy is developed, implemented and maint
ISM-2075Fax machines, and online fax services, are not used for sending or receiving fax messages.
ISM-2076Security questions are not used for authentication purposes.
ISM-2077Email is not used for out-of-band authentication purposes.
ISM-2078Passwords appearing in lists of commonly used passwords or lists of compromised passwords
ISM-2079Maximum length limits for passwords are not less than 64 characters.
ISM-2080Password complexity requirements are not imposed for passwords.
ISM-2081All ASCII printable characters are supported for passwords.
ISM-2082If a cryptographic bill of materials is available for imported third-party software compon
ISM-2083A cryptographic bill of materials is produced and made available to consumers of software.
ISM-2084Artificial intelligence-specific documentation, including model and system cards (or equiv
ISM-2085The exposure of exact artificial intelligence model confidence scores in API responses or
ISM-2086The source and integrity of artificial intelligence models, structures and weights are ver
ISM-2087The source and integrity of training data for artificial intelligence models is verified.
ISM-2088Data validation and verification techniques are used to ensure the reliability and accurac
ISM-2089Artificial intelligence model performance metrics are monitored and anomalies are investig
ISM-2090Rate limiting is applied to inference queries for artificial intelligence models.
ISM-2091Resource limits are enforced for artificial intelligence models.
ISM-2092Access control policies are implemented to enforce fine-grained permissions for artificial
ISM-2093Role-based access controls are implemented for artificial intelligence applications to res
ISM-2094Content filtering is implemented by artificial intelligence applications to detect and blo
ISM-2095Personnel using privately-owned mobile devices or desktop computers to access OFFICIAL: Se
ISM-2096Mobile devices are configured to enforce separation between organisational and personal mo
ISM-2097Mobile devices are configured with always on VPN functionality.
ISM-2098Mobile devices are configured to prevent data transfers over Universal Serial Bus connecti
ISM-2099Mobile devices are not connected to the infotainment systems of connected vehicles.
ISM-2100Sensitive or classified data is not viewed on mobile devices within or near connected vehi
ISM-2101Sensitive or classified phone calls and conversations are not conducted within or near con
ISM-2102Existing software artefacts in the authoritative source for software are periodically test
ISM-2103Organisational data generated, collected or processed by artificial intelligence applicati
Show the 57 you already have
ISM-0445Privileged users are assigned a dedicated privileged user account to be used solely for du
ISM-0843Application control is implemented on workstations.
ISM-0974Multi-factor authentication is used to authenticate unprivileged users of systems.
ISM-1173Multi-factor authentication is used to authenticate privileged users of systems.
ISM-1175Privileged user accounts (excluding those explicitly authorised to access online services)
ISM-1401Multi-factor authentication uses either: something users have and something users know, or
ISM-1487Only privileged users responsible for checking that Microsoft Office macros are free of ma
ISM-1488Microsoft Office macros in files originating from the internet are blocked.
ISM-1489Microsoft Office macro security settings cannot be changed by users.
ISM-1490Application control is implemented on internet-facing servers.
ISM-1504Multi-factor authentication is used to authenticate users to their organisation's online s
ISM-1505Multi-factor authentication is used to authenticate users of data repositories.
ISM-1507Requests for privileged access to systems and their resources are validated when first req
ISM-1508Privileged access to systems and their resources is limited to only what is required for u
ISM-1509Privileged access events are centrally logged.
ISM-1511Backups of data, applications and settings are performed and retained in accordance with b
ISM-1515Restoration of data, applications and settings from backups to a common point in time is t
ISM-1544Microsoft's recommended application blocklist is implemented.
ISM-1582Application control rulesets are validated on an annual or more frequent basis.
ISM-1649Just-in-time administration is used for the administration of systems and their resources.
ISM-1650Privileged user account and security group management events are centrally logged.
ISM-1656Application control is implemented on non-internet-facing servers.
ISM-1657Application control restricts the execution of executables, libraries, scripts, installers
ISM-1658Application control restricts the execution of drivers to an organisation-approved set.
ISM-1659Microsoft's vulnerable driver blocklist is implemented.
ISM-1660Allowed and blocked application control events are centrally logged.
ISM-1671Microsoft Office macros are disabled for users that do not have a demonstrated business re
ISM-1672Microsoft Office macro antivirus scanning is enabled.
ISM-1673Microsoft Office macros are blocked from making Win32 API calls.
ISM-1674Only Microsoft Office macros running from within a sandboxed environment, a Trusted Locati
ISM-1675Microsoft Office macros digitally signed by an untrusted publisher cannot be enabled via t
ISM-1676Microsoft Office's list of trusted publishers is validated on an annual or more frequent b
ISM-1679Multi-factor authentication is used to authenticate users to third-party online services t
ISM-1680Multi-factor authentication (where available) is used to authenticate users to third-party
ISM-1681Multi-factor authentication is used to authenticate customers to online customer services
ISM-1682Multi-factor authentication used for authenticating users of systems is phishing-resistant
ISM-1683Successful and unsuccessful multi-factor authentication events are centrally logged.
ISM-1705Privileged user accounts (excluding backup administrator accounts) cannot access backups b
ISM-1706Privileged user accounts (excluding backup administrator accounts) cannot access their own
ISM-1707Privileged user accounts (excluding backup administrator accounts) are prevented from modi
ISM-1708Backup administrator accounts are prevented from modifying and deleting backups during the
ISM-1810Backups of data, applications and settings are synchronised to enable restoration to a com
ISM-1811Backups of data, applications and settings are retained in a secure and resilient manner.
ISM-1812Unprivileged user accounts cannot access backups belonging to other user accounts.
ISM-1813Unprivileged user accounts cannot access their own backups.
ISM-1814Unprivileged user accounts are prevented from modifying and deleting backups.
ISM-1870Application control is applied to user profiles and temporary folders used by operating sy
ISM-1871Application control is applied to all locations other than user profiles and temporary fol
ISM-1872Multi-factor authentication used for authenticating users of online services is phishing-r
ISM-1873Multi-factor authentication used for authenticating customers of online customer services
ISM-1874Multi-factor authentication used for authenticating customers of online customer services
ISM-1883Privileged user accounts explicitly authorised to access online services are strictly limi
ISM-1890Microsoft Office macros are checked to ensure they are free of malicious code before being
ISM-1891Microsoft Office macros digitally signed by signatures other than V3 signatures cannot be
ISM-1892Multi-factor authentication is used to authenticate users to their organisation's online c
ISM-1893Multi-factor authentication is used to authenticate users to third-party online customer s
ISM-1894Multi-factor authentication used for authenticating users of data repositories is phishing
How this is calculated
Already covered means a mapping runs from a control in ACSC Essential Eight to that control. Likely
covered means no direct mapping exists but both frameworks map to the same control in a third
standard. New work means neither. We keep those separate rather than adding them into one
friendlier number, because blending them would present a two-hop inference as a verified
fact.
Coverage is not symmetric.
Run it the other way and you will get a
different number; both are correct.
From 332,959 cross-framework control
mappings across 723 frameworks, 531 of them verified against
their source documents. It does not tell you that you are compliant: a mapped control means
the two standards ask for the same thing, not that you have done it.
Try another pair ยท
Today's edition