Controls library.

1,382 controls across 4 frameworks

Comparing to global GRC platforms? See Control Stack vs Drata, Vanta and Scytale.

ISO 27001:202293ISO 42001:202338Essential Eight149Information Security Manual (ISM)1102

Annex A 10.2 · ISO 42001Allocating Responsibilities
Decide and write down which party (your organisation, your partners, suppliers, customers or other t
Annex A 10.3 · ISO 42001Manage Suppliers to Support Responsible AI Use
Set up a process so that the services, products and materials you buy from suppliers support the res
Annex A 10.4 · ISO 42001Consider Customer Expectations and Needs When Using AI
Make sure your responsible approach to building and using artificial intelligence (AI) takes account
Annex A 2.2 · ISO 42001AI Policy
The organisation writes down an approved policy that sets the rules for how it builds and uses AI sy
Annex A 2.3 · ISO 42001Alignment with Other Organisational Policies
Work out which of your existing organisational policies are affected by, or already apply to, your g
Annex A 2.4 · ISO 42001Review the AI Policy at Planned Intervals to Keep It Effective
Your organisation regularly reviews its artificial intelligence (AI) policy, and reviews it again wh
Annex A 3.2 · ISO 42001Define and Allocate AI Roles and Responsibilities
Your organisation must clearly decide who is responsible for each part of managing artificial intell
Annex A 3.3 · ISO 42001Process for Reporting Concerns About AI Systems
Set up a clear, accessible way for people to raise concerns about your organisation's role in any AI
Annex A 4.2 · ISO 42001Resource Documentation
The organisation identifies and documents the resources needed for each stage of an AI system's life
Annex A 4.3 · ISO 42001Document the Data Resources Used by Your AI System
Your organisation must keep a written record of the data resources used by each artificial intellige
Annex A 4.4 · ISO 42001Document the Tooling Resources Used for AI Systems
Your organisation must keep written records of the tools used to build, run and support each AI (art
Annex A 4.5 · ISO 42001Document System and Computing Resources Used by AI Systems
Your organisation keeps a written record of the system and computing resources used to run each arti
Annex A 4.6 · ISO 42001Document the People and Skills Running Your AI System
The organisation must record who works on its AI system across its whole life and the competences th
Annex A 5.1 · ISO 27001Policies for information security
Have clear, approved security policies that everyone knows about and follows.
Annex A 5.10 · ISO 27001Acceptable Use Policies for Information and Assets
Create and communicate rules for how information and assets should be used to ensure security.
Annex A 5.11 · ISO 27001Return of Organisation's Assets upon Departure
Ensure that employees and external parties return all company assets when their job or contract ends
Annex A 5.12 · ISO 27001Information Classification Policy and Practices
Classify data based on security needs so everyone handles it correctly.
Annex A 5.13 · ISO 27001Labelling of Information
Create and use clear labels to show how sensitive information is, so it is correctly handled.
Annex A 5.14 · ISO 27001Information Transfer Policies and Procedures
Ensure secure and controlled transfer of information within and outside the organisation.
Annex A 5.15 · ISO 27001Access Control Policies and Procedures
Set and apply rules for who can access information and systems based on their security needs.
Annex A 5.16 · ISO 27001Identity life cycle management
Ensure all user and system identities are managed from creation to deactivation.
Annex A 5.17 · ISO 27001Management of Authentication Information
Ensure secure and proper handling of passwords and authentication details.
Annex A 5.18 · ISO 27001Managing Access Rights to Information Assets
Regularly check and adjust who can access sensitive information based on business rules.
Annex A 5.19 · ISO 27001Managing Information Security in Supplier Relationships
Ensure suppliers of products/services do not pose security risks through defined processes.
Annex A 5.2 · ISO 42001AI System Impact Assessment Process
A repeatable method for working out who an AI system could affect and how badly, covering single peo
Annex A 5.2 · ISO 27001Defining Information Security Roles and Responsibilities
Clearly assign security roles and duties to ensure nothing is overlooked.
Annex A 5.20 · ISO 27001Integrating security clauses in supplier agreements
Ensure suppliers meet agreed security requirements relevant to their relationship.
Annex A 5.21 · ISO 27001Managing Information Security in the ICT Supply Chain
Ensure ICT supply chain security by managing risks with processes and procedures.
Annex A 5.22 · ISO 27001Monitoring and Managing Supplier Services
Keep track of and adapt to changes in how suppliers handle security and service delivery.
Annex A 5.23 · ISO 27001Cloud Service Security Management
Ensure secure cloud service use with proper procedures for acquisition, management, and exit.
Annex A 5.24 · ISO 27001Information security incident management planning and preparation
Ensure your organisation is ready to manage security incidents with clear processes and responsible
Annex A 5.25 · ISO 27001Assessment and decision on information security events
Evaluate security events to determine which are serious enough to be called incidents.
Annex A 5.26 · ISO 27001Response to Information Security Incidents
Ensure security incidents are handled quickly and effectively following set procedures.
Annex A 5.27 · ISO 27001Learning from information security incidents
Use knowledge from past incidents to boost security and prevent future issues.
Annex A 5.28 · ISO 27001Procedures for Collecting and Preserving Evidence
Set up clear steps to gather and maintain evidence of security incidents securely.
Annex A 5.29 · ISO 27001Maintain information security during disruptions
Plan to keep information secure even when normal operations are interrupted.
Annex A 5.3 · ISO 42001Document and Retain AI Impact Assessment Results
Your organisation must write down the results of every AI (artificial intelligence) system impact as
Annex A 5.3 · ISO 27001Segregation of Duties
Ensure no one person can perform conflicting duties alone to prevent misuse.
Annex A 5.30 · ISO 27001ICT Readiness for Business Continuity
Ensure ICT systems are ready to support business goals during disruptions through proper planning an
Annex A 5.31 · ISO 27001Compliance with Information Security Legal Requirements
Identify and stay updated on information security legal obligations to avoid breaches.
Annex A 5.32 · ISO 27001Intellectual Property Rights Protection
Develop procedures to safeguard intellectual property rights to avoid legal issues.
Annex A 5.33 · ISO 27001Protection of Records
Ensure records are safe from loss, damage, falsification, and unauthorised access.
Annex A 5.34 · ISO 27001Privacy and Protection of Personally Identifiable Information
Ensure privacy and PII protection according to laws and contracts.
Annex A 5.35 · ISO 27001Independent review of information security
Ensure independent reviews of information security management at regular intervals or after signific
Annex A 5.36 · ISO 27001Review compliance with information security policies
Regularly check if your organisation's security policies and rules are being followed.
Annex A 5.37 · ISO 27001Documented Operating Procedures for Information Processing
Ensure procedures are written down and accessible to those who need them.
Annex A 5.4 · ISO 42001Assess and Document AI Impacts on Individuals and Groups
The organisation must assess and document how its artificial intelligence (AI) systems could affect
Annex A 5.4 · ISO 27001Management responsibilities for information security
Managers must ensure everyone follows and supports the organisation's security policies.
Annex A 5.5 · ISO 42001Assess and Document AI Societal Impacts Across the Life Cycle
Your organisation must assess and write down how each artificial intelligence (AI) system could affe
Annex A 5.5 · ISO 27001Establish and Maintain Contact with Authorities
Ensure you can quickly contact authorities like police or regulators for security issues.
Annex A 5.6 · ISO 27001Contact with special interest groups
Maintain ties with security groups to stay updated on threats and best practices.
Annex A 5.7 · ISO 27001Threat Intelligence Collection and Analysis
Gather and study threat information to improve your security measures and readiness.
Annex A 5.8 · ISO 27001Information security in project management
Include security checks in all projects to prevent risks from new systems.
Annex A 5.9 · ISO 27001Inventory management of information and associated assets
Keep an updated list of information and assets, specifying who owns and manages each.
Annex A 6.1 · ISO 27001Personnel Background Verification
Conduct background checks on all job candidates before hiring to manage risks.
Annex A 6.1.2 · ISO 42001Objectives for Responsible Development of AI Systems
Write down the responsible-development goals your AI systems must meet, then build checkpoints into
Annex A 6.1.3 · ISO 42001Processes for Responsible AI System Design and Development
Write down the specific step-by-step processes your teams follow to design and build each AI (artifi
Annex A 6.2 · ISO 27001Terms and conditions of employment for security
Ensure job agreements state everyone's info security duties clearly.
Annex A 6.2.2 · ISO 42001AI System Requirements and Specification
Before building a new AI system or materially changing an existing one, write down exactly what it m
Annex A 6.2.3 · ISO 42001Documentation of AI System Design and Development
Write down how each AI system was designed and built, and show that those design choices trace back
Annex A 6.2.4 · ISO 42001AI System Verification and Validation
Define and document how you will verify (confirm the AI system is built correctly) and validate (con
Annex A 6.2.5 · ISO 42001AI System Deployment
Before an AI system goes live, write down how it will be deployed and confirm that the conditions fo
Annex A 6.2.6 · ISO 42001Defining and Documenting Ongoing AI System Operation Requirements
Your organisation must define and write down what is needed to keep each artificial intelligence (AI
Annex A 6.2.7 · ISO 42001Provide AI System Technical Documentation to Interested Parties
The organisation decides what technical documentation each group needs about its AI (artificial inte
Annex A 6.2.8 · ISO 42001AI System Recording of Event Logs
Your organisation decides, and writes down, at which stages of an AI system's life its event logs (a
Annex A 6.3 · ISO 27001Information security awareness, education and training program
Ensure everyone gets regular training and updates on information security relevant to their job.
Annex A 6.4 · ISO 27001Disciplinary Process for Information Security Violations
Ensure staff understand consequences for breaking security rules to prevent violations.
Annex A 6.5 · ISO 27001Responsibilities after employment termination or role change
Ensure security responsibilities are clear when employment ends or roles change.
Annex A 6.6 · ISO 27001Confidentiality and Non-disclosure Agreements
Ensure all relevant parties sign agreements to protect confidential information.
Annex A 6.7 · ISO 27001Remote Working Security Measures
Implement security measures to protect company info when working outside the office.
Annex A 6.8 · ISO 27001Mechanisms for Reporting Security Events
Ensure staff can quickly report security problems through official channels to prevent bigger issues
Annex A 7.1 · ISO 27001Physical Security Perimeters
Define clear physical boundaries to protect sensitive areas and assets from unauthorized access.
Annex A 7.10 · ISO 27001Secure Management of Storage Media
Manage storage media safely from purchase to disposal based on your risk policies.
Annex A 7.11 · ISO 27001Protection from Utility Failures
Make sure key equipment is safe from power and utility failures to avoid data loss.
Annex A 7.12 · ISO 27001Secure Cabling for Power and Data
Ensure cables are protected from interception, damage, or interference to prevent security risks.
Annex A 7.13 · ISO 27001Proper Maintenance of Equipment
Ensure all equipment is regularly maintained to prevent failures and protect data.
Annex A 7.14 · ISO 27001Secure disposal or re-use of equipment
Ensure device data is erased or secured before disposal or reuse to prevent data breaches.
Annex A 7.2 · ISO 27001Physical access controls for secure areas
Ensure only authorised people can enter secure areas and prevent unauthorised access.
Annex A 7.2 · ISO 42001Data for Development and Enhancement of AI System
Set up, write down and actually follow clear processes for managing the data you use to build and im
Annex A 7.3 · ISO 42001Acquisition and Selection of Data
Write down where each dataset feeding your AI came from and the criteria you used to decide it was t
Annex A 7.3 · ISO 27001Physical Security for Offices and Facilities
Ensure physical security to prevent unauthorized access to offices and facilities.
Annex A 7.4 · ISO 27001Continuous monitoring of physical access to premises
Use systems like CCTV and alarms to detect unauthorized physical entry.
Annex A 7.4 · ISO 42001Quality of Data for AI Systems
Write down what "good enough" data means for each AI system: things like accuracy, completeness, how
Annex A 7.5 · ISO 27001Protecting against physical and environmental threats
Plan and implement actions to prevent damage from natural and human threats to physical infrastructu
Annex A 7.5 · ISO 42001Data Provenance
The organisation must define and document a process that records the provenance (the origin and hist
Annex A 7.6 · ISO 42001Data Preparation
Write down how your organisation decides which data-preparation steps to apply and which methods to
Annex A 7.6 · ISO 27001Security Measures for Working in Secure Areas
Implement security measures to control and protect activities in secure areas.
Annex A 7.7 · ISO 27001Clear desk and clear screen policies
Ensure desks and screens are clear of sensitive info to prevent unauthorized access.
Annex A 7.8 · ISO 27001Equipment Siting and Protection
Ensure equipment is placed safely to prevent damage or unauthorised access.
Annex A 7.9 · ISO 27001Security of Off-Site Assets
Ensure assets used outside the office are protected from theft or loss.
Annex A 8.1 · ISO 27001Protection of User Endpoint Devices
Ensure all laptops, mobiles, and tablets are secure to protect stored information.
Annex A 8.10 · ISO 27001Secure deletion of information when no longer needed
Delete data you don't need anymore to reduce risk and comply with laws.
Annex A 8.11 · ISO 27001Data Masking for Sensitive Information
Use data masking to hide sensitive info based on policy requirements and legal obligations.
Annex A 8.12 · ISO 27001Data Leakage Prevention Measures
Implement measures to stop sensitive data from being leaked or stolen from your systems.
Annex A 8.13 · ISO 27001Backup and Recovery Procedures for Data
Keep and test backups of data and systems regularly as per backup policy.
Annex A 8.14 · ISO 27001Redundancy of Information Processing Facilities
Ensure systems have backups to avoid downtime and data loss.
Annex A 8.15 · ISO 27001Logging of Activities and Events
Keep detailed logs of activities and events to detect attacks and ensure accountability.
Annex A 8.16 · ISO 27001Monitoring Networks and Systems for Anomalous Behaviour
Regularly check networks and systems for unusual activity to address potential security threats.
Annex A 8.17 · ISO 27001Clock synchronisation for information systems
Ensure all system clocks are set to the same time source to aid in event tracking and investigations
Annex A 8.18 · ISO 27001Use of Privileged Utility Programs
Restrict and control programs that can override system controls to prevent unauthorised access.
Annex A 8.19 · ISO 27001Secure Software Installation Procedures
Ensure software installations are controlled to prevent security risks.
Annex A 8.2 · ISO 42001Provide Users the Information They Need to Use the AI System
Your organisation must work out and give users the information they need to understand and use the a
Annex A 8.2 · ISO 27001Management of Privileged Access Rights
Control and limit who gets special access to sensitive systems to keep them secure.
Annex A 8.20 · ISO 27001Network and Network Devices Security
Secure and manage networks to prevent unauthorized access to your information.
Annex A 8.21 · ISO 27001Security of Network Services
Ensure network services are secure, reliable, and meet agreed-upon standards.
Annex A 8.22 · ISO 27001Network Segregation for Security
Separate network groups to limit risks and control access between services, users, and systems.
Annex A 8.23 · ISO 27001Web Filtering to Reduce Malicious Website Exposure
Limit access to risky websites to avoid malware and phishing threats.
Annex A 8.24 · ISO 27001Effective Use of Cryptography and Key Management
Create and enforce rules for using cryptography and managing keys effectively.
Annex A 8.25 · ISO 27001Secure Development Lifecycle
Set rules for secure software and system development to avoid costly production issues.
Annex A 8.26 · ISO 27001Defining Security Requirements for Applications
Ensure security needs are clear and approved when creating or buying applications.
Annex A 8.27 · ISO 27001Secure system architecture and engineering principles
Create and use guidelines for building secure systems in all development projects.
Annex A 8.28 · ISO 27001Secure Coding Practices in Software Development
Ensure software is built securely to prevent vulnerabilities.
Annex A 8.29 · ISO 27001Security testing in development and acceptance
Ensure security tests are part of the development process to find issues early.
Annex A 8.3 · ISO 27001Restrict access to information and assets
Limit access to information based on set policies to prevent unauthorised use.
Annex A 8.3 · ISO 42001External Reporting
Give people outside your organisation, not just your own customers, a clear and public way to report
Annex A 8.30 · ISO 27001Management of Outsourced System Development
Ensure your organisation oversees and checks outsourced development to maintain security.
Annex A 8.31 · ISO 27001Separation of Development, Test, and Production Environments
Ensure development, testing, and production systems are separate to avoid disrupting live services.
Annex A 8.32 · ISO 27001Change management procedures for information systems
Ensure all system changes follow a formal, approved process to prevent issues.
Annex A 8.33 · ISO 27001Test Information Selection and Protection
Choose and protect test data carefully to avoid exposing sensitive information.
Annex A 8.34 · ISO 27001Protection of information systems during audits
Ensure audit activities are planned and agreed with management to prevent system disruptions.
Annex A 8.4 · ISO 42001Document a Plan for Communicating Incidents to AI System Users
Your organisation must create and write down a plan for how it will tell users of the AI (artificial
Annex A 8.4 · ISO 27001Access management for source code and tools
Control who can read and change source code to avoid risks and maintain security.
Annex A 8.5 · ISO 27001Secure authentication technologies and procedures
Use secure methods to confirm identities and control access to systems and data.
Annex A 8.5 · ISO 42001Determine and Document AI Reporting Obligations to Interested Parties
Your organisation must identify and write down every obligation it has to report information about i
Annex A 8.6 · ISO 27001Capacity Management for Resource Use
Ensure resources are monitored and adjusted to meet current and future needs to prevent system slowd
Annex A 8.7 · ISO 27001Protection against malware
Implement measures and train users to prevent and detect malware threats.
Annex A 8.8 · ISO 27001Management of Technical Vulnerabilities
Identify and address software vulnerabilities to prevent exploitation and security risks.
Annex A 8.9 · ISO 27001Configuration Management for Secure IT Systems
Set and keep secure settings for all IT systems and watch for changes.
Annex A 9.2 · ISO 42001Define and Document Processes for Responsible Use of AI Systems
Your organisation must define and write down the processes that govern how artificial intelligence (
Annex A 9.3 · ISO 42001Objectives for Responsible Use of AI System
Write down the specific goals your organisation wants its AI use to live up to (things like fairness
Annex A 9.4 · ISO 42001Intended Use of the AI System
Make sure each AI system is only used for the purposes it was actually designed and approved for, an
E8-AC-ML1.1 · Essential 8Application control is implemented on workstations.
Make sure only approved software can run on office computers.
E8-AC-ML1.2 · Essential 8Application control is applied to user profiles and temporary folders
Ensure application control covers user and temporary folders to block unapproved software.
E8-AC-ML1.3 · Essential 8Ensure only approved applications and scripts can run
Allow only company-approved applications and scripts to run on work computers.
E8-AC-ML2.1 · Essential 8Application control is implemented on internet-facing servers
Ensure only approved applications can run on servers accessible from the internet.
E8-AC-ML2.10 · Essential 8Report cyber security incidents to ASD quickly
Notify ASD promptly when cyber security incidents occur or are discovered.
E8-AC-ML2.11 · Essential 8Cybersecurity incident response plan is enacted after incident identification
Activate the cybersecurity response plan as soon as an incident is identified.
E8-AC-ML2.2 · Essential 8Application control excludes user profiles and temporary folders
Ensure application control is in place everywhere except user profiles and temp folders.
E8-AC-ML2.3 · Essential 8Microsoft's recommended application blocklist is implemented
Implement Microsoft's recommended blocklist to enhance security.
E8-AC-ML2.4 · Essential 8Annual validation of application control rulesets
Check once a year or more that rules for allowing or blocking software are accurate.
E8-AC-ML2.5 · Essential 8Allowed and blocked application control events are centrally logged
Ensure all application control events are logged in a central location for monitoring.
E8-AC-ML2.6 · Essential 8Event logs are protected from unauthorised modification and deletion
Ensure that event logs are secure from being changed or deleted by unauthorized users.
E8-AC-ML2.7 · Essential 8Event logs from internet-facing servers are analysed to detect cybersecurity events
Review logs from internet servers quickly to spot any security issues.
E8-AC-ML2.8 · Essential 8Cybersecurity events are analysed in a timely manner
Timely analysis of events to spot and manage security incidents.
E8-AC-ML2.9 · Essential 8Cyber security incidents are reported promptly to CISO
Report security incidents quickly to the security chief or their team.
E8-AC-ML3.1 · Essential 8Application control is implemented on non-internet-facing servers
Ensure only approved software can run on internal servers.
E8-AC-ML3.2 · Essential 8Application control restricts driver execution to an approved set
Ensure only approved drivers can run to prevent malicious code execution.
E8-AC-ML3.3 · Essential 8Microsoft's vulnerable driver blocklist is implemented
Use Microsoft's blocklist to stop vulnerable drivers from running.
E8-AC-ML3.4 · Essential 8Event logs from non-internet-facing servers are analysed
Check server logs regularly to find security issues early.
E8-AC-ML3.5 · Essential 8Workstation event logs are promptly analysed for security events
Quickly check workstation logs to find any security events.
E8-AH-ML1.1 · Essential 8Disable or remove Internet Explorer 11
Ensure Internet Explorer 11 is not used to increase security.
E8-AH-ML1.2 · Essential 8Web browsers must not execute Java content from the internet
Ensure web browsers block Java content from the internet to reduce security risks.
E8-AH-ML1.3 · Essential 8Web browsers block web ads from the internet
Ensure web browsers do not display internet ads to prevent potential security risks.
E8-AH-ML1.4 · Essential 8Web browser security settings locked down to users
Users should not be able to change web browser security settings.
E8-AH-ML2.1 · Essential 8Web browsers are hardened with the most restrictive guidance
Harden web browsers using the strictest security settings from ASD or vendor guides.
E8-AH-ML2.10 · Essential 8PDF software security settings cannot be changed by users
Prevent users from changing PDF software security settings to enhance safety.
E8-AH-ML2.11 · Essential 8Centrally log PowerShell module, script block, and transcription events
Ensure logging of PowerShell activities is centralised for monitoring.
E8-AH-ML2.12 · Essential 8Command line process creation logging is centralised
Log all command line processes in a central location for monitoring.
E8-AH-ML2.13 · Essential 8Protect event logs from unauthorised changes or deletion
Ensure event logs cannot be tampered with or erased without permission.
E8-AH-ML2.14 · Essential 8Timely Analysis of Event Logs from Internet-Facing Servers
Regularly review event logs from internet-facing servers to spot security issues quickly.
E8-AH-ML2.15 · Essential 8Timely Analysis of Cyber Security Events to Identify Incidents
Quickly review cyber events to find and manage security threats.
E8-AH-ML2.16 · Essential 8Cybersecurity incidents must be reported immediately to the CISO
Report any cybersecurity incidents to the Chief Information Security Officer as soon as they happen.
E8-AH-ML2.17 · Essential 8Report cyber security incidents to ASD promptly
Report cyber security incidents to ASD as soon as they're found.
E8-AH-ML2.18 · Essential 8Cyber incident response plan is enacted after identification
Activate the response plan immediately after identifying a cyber incident.
E8-AH-ML2.2 · Essential 8Block Microsoft Office from creating child processes
Prevent Microsoft Office from starting other programs or activities on its own.
E8-AH-ML2.3 · Essential 8Block Microsoft Office from creating executable content
Prevent Microsoft Office from making executable files to stop malware.
E8-AH-ML2.4 · Essential 8Block Microsoft Office from injecting code into other processes
Stop Microsoft Office from putting code into other programs to prevent security risks.
E8-AH-ML2.5 · Essential 8Configure Microsoft Office to prevent activation of OLE packages
Ensure Microsoft Office is set up to stop risky linking and embedding features.
E8-AH-ML2.6 · Essential 8Office productivity suites are hardened using ASD and vendor guidance
Ensure office suites follow the strictest security guidelines to reduce risks.
E8-AH-ML2.7 · Essential 8Office productivity suite settings are immutable by users
Ensure users cannot change security settings in office applications.
E8-AH-ML2.8 · Essential 8Block PDF software from creating child processes
Prevent PDF programs from running other programs to improve security.
E8-AH-ML2.9 · Essential 8Ensure PDF software is securely configured using guidance.
Secure PDF applications based on guidance to protect against hacks.
E8-AH-ML3.1 · Essential 8.NET Framework 3.5, 3.0, 2.0 is disabled or removed
Ensure older versions of .NET Framework (3.5, 3.0, 2.0) are turned off or uninstalled.
E8-AH-ML3.2 · Essential 8Ensure Windows PowerShell 2.0 is disabled or removed
Disable or remove Windows PowerShell 2.0 to enhance security.
E8-AH-ML3.3 · Essential 8PowerShell is configured to use Constrained Language Mode
Limit PowerShell's capabilities to reduce security risks.
E8-AH-ML3.4 · Essential 8Analyse event logs from non-internet-facing servers for cyber threats
Regularly check server logs not exposed to the internet for signs of hacking.
E8-AH-ML3.5 · Essential 8Timely Analysis of Workstation Event Logs for Cybersecurity
Quickly analyse workstation logs to detect security issues.
E8-MF-ML1.1 · Essential 8Require multi-factor authentication for sensitive online services
Ensure users use multiple ways to verify their identity when accessing sensitive company data online
E8-MF-ML1.2 · Essential 8Multi-factor authentication for third-party services handling sensitive data
Use multi-factor authentication for third-party services with sensitive data to prevent unauthorized
E8-MF-ML1.3 · Essential 8Use multi-factor authentication for non-sensitive third-party services
Use a second form of verification for accounts on services handling non-sensitive org data.
E8-MF-ML1.4 · Essential 8Use multi-factor authentication for online services handling customer data
Ensure users use multi-factor logins for online services with sensitive customer data.
E8-MF-ML1.5 · Essential 8Multi-factor authentication for third-party services with sensitive customer data
Use multi-factor authentication to secure accounts on third-party services that handle your sensitiv
E8-MF-ML1.6 · Essential 8Multi-factor authentication for customer access to online services handling sensitive data
Require multiple forms of ID for customer logins to protect sensitive online data.
E8-MF-ML1.7 · Essential 8Multi-factor authentication combines two factors like a device and a PIN
Use something you have and something you know to secure access to important data.
E8-MF-ML2.1 · Essential 8Multi-factor authentication for privileged users of systems
Ensure privileged users use more than just a password to access systems.
E8-MF-ML2.10 · Essential 8Report cyber security incidents to the Chief Information Security Officer promptly
Notify the Chief Information Security Officer quickly after discovering cyber attacks.
E8-MF-ML2.11 · Essential 8Report cybersecurity incidents to ASD immediately
Notify ASD quickly when a cybersecurity incident occurs or is discovered.
E8-MF-ML2.12 · Essential 8Cybersecurity incident response plan enacted after incident identification
Activate the response plan immediately once a cyber incident is detected.
E8-MF-ML2.2 · Essential 8Use multi-factor authentication for unprivileged user access
Require additional authentication methods for regular system users.
E8-MF-ML2.3 · Essential 8Multi-factor authentication online services must be phishing-resistant
Ensure two-factor authentication can't be bypassed by phishing attacks.
E8-MF-ML2.5 · Essential 8Multi-factor authentication used for system access is phishing-resistant
Ensure system login methods resist phishing attacks using multiple authentication factors.
E8-MF-ML2.6 · Essential 8MFA success and failure events are centrally logged
Ensure all successful and failed MFA attempts are logged in one central location.
E8-MF-ML2.7 · Essential 8Protect event logs from unauthorised changes
Ensure event logs cannot be changed or deleted without permission.
E8-MF-ML2.8 · Essential 8Timely analysis of event logs from internet-facing servers
Regularly check logs from online servers to quickly spot security issues.
E8-MF-ML2.9 · Essential 8Cybersecurity events are analysed to identify incidents timely
Timely analyse cybersecurity events to identify incidents quickly.
E8-MF-ML3.1 · Essential 8Multi-factor authentication is used to authenticate users of data repositories
Use multiple verification methods to authorise access to data storage systems.
E8-MF-ML3.2 · Essential 8Phishing-resistant multi-factor authentication for online customer services
Use multi-factor authentication that resists phishing for customers accessing online services.
E8-MF-ML3.3 · Essential 8Phishing-resistant multi-factor authentication for data repositories
Use secure multi-factor authentication methods to protect data repositories against phishing attacks
E8-MF-ML3.4 · Essential 8Analyse event logs from non-internet-facing servers timely to detect security events
Regularly check event logs from internal servers to catch security issues quickly.
E8-MF-ML3.5 · Essential 8Timely analysis of workstation event logs for cybersecurity events
Ensure workstation event logs are reviewed quickly to spot cybersecurity issues.
E8-PA-ML1.1 · Essential 8Automated asset discovery at least fortnightly
Use automated tools every two weeks to find all devices for security checks.
E8-PA-ML1.2 · Essential 8Up-to-date vulnerability scanner used for scanning activities
Use a current vulnerability scanner to check for security issues in your apps.
E8-PA-ML1.3 · Essential 8Daily vulnerability scanning for missing patches in online services
Use a daily scanner to find missing security updates for online services.
E8-PA-ML1.4 · Essential 8Weekly scanning for missing patches or updates in key software
Use a tool every week to check and update key software like browsers and office apps to fix security
E8-PA-ML1.5 · Essential 8Apply Critical Online Service Patches Within 48 Hours
Apply critical patches or vendor mitigations for online services within 48 hours of release.
E8-PA-ML1.6 · Essential 8Apply non-critical patches for online services within two weeks
Install updates for online services within two weeks if not critical and no exploits exist.
E8-PA-ML1.8 · Essential 8Unsupported online services are removed by the organisation
Remove online services that the vendor no longer supports to enhance security.
E8-PA-ML1.9 · Essential 8Removal of unsupported software and applications
Remove office, browser, and security software that is no longer supported by the vendor.
E8-PA-ML2.1 · Essential 8Fortnightly vulnerability scanning for non-core applications
Use a vulnerability scanner every two weeks to find missing patches in non-core applications.
E8-PA-ML2.2 · Essential 8Timely Patching of Non-Critical Application Vulnerabilities
Apply patches for non-critical apps within a month to fix vulnerabilities.
E8-PA-ML3.1 · Essential 8Patch critical vulnerabilities in applications within 48 hours
Apply critical patches to important software within 48 hours of release.
E8-PA-ML3.2 · Essential 8Apply patches for non-critical vulnerabilities within two weeks
Ensure software patches for non-critical flaws are installed within two weeks if no exploits exist.
E8-PA-ML3.3 · Essential 8Remove unsupported applications excluding certain categories
Ensure unsupported non-critical applications are removed for security.
E8-PO-ML1.1 · Essential 8Automated bi-weekly asset discovery for vulnerability scanning
Use an automated tool to find all system assets every two weeks for security checks.
E8-PO-ML1.2 · Essential 8Use a vulnerability scanner with an updated database
Ensure a vulnerability scanner with current data is used to check for security issues.
E8-PO-ML1.3 · Essential 8Use a daily vulnerability scanner for internet-facing systems
Use a tool every day to find and fix missing updates on servers and network devices facing the inter
E8-PO-ML1.4 · Essential 8Use a vulnerability scanner fortnightly to find missing OS patches
Use a vulnerability scanner every two weeks to check for missing OS updates on internal systems.
E8-PO-ML1.5 · Essential 8Apply critical patches to internet-facing OS within 48 hours
Apply critical updates to internet-facing systems within 48 hours to prevent exploitation.
E8-PO-ML1.6 · Essential 8Timely application of non-critical patches for internet-facing OS vulnerabilities
Apply non-critical patches to internet-facing systems within two weeks if no exploits exist.
E8-PO-ML1.8 · Essential 8Replace unsupported operating systems
Ensure that all outdated and unsupported operating systems are replaced with supported versions.
E8-PO-ML3.1 · Essential 8Vulnerability scanner used fortnightly to identify missing driver patches
Use a vulnerability scanner every two weeks to find missing driver updates.
E8-PO-ML3.2 · Essential 8At least fortnightly use of a vulnerability scanner for firmware
Use a vulnerability scanner every two weeks to find and update missing firmware patches.
E8-PO-ML3.3 · Essential 8Apply critical patches to non-internet-facing OS within 48 hours
Quickly install critical updates on internal systems to fix security vulnerabilities.
E8-PO-ML3.4 · Essential 8Non-critical OS patches applied within one month if no exploits exist
Apply OS patches on internal devices within a month if they aren't critical and have no known exploi
E8-PO-ML3.5 · Essential 8Apply critical driver patches within 48 hours
Ensure critical security updates for drivers are applied within 48 hours to prevent exploitation.
E8-PO-ML3.6 · Essential 8Apply non-critical driver patches within one month
Ensure drivers are updated within a month if the vulnerabilities are non-critical and no exploits ex
E8-PO-ML3.7 · Essential 8Apply critical firmware patches within 48 hours
Ensure firmware vulnerabilities are fixed quickly, within 48 hours if critical.
E8-PO-ML3.8 · Essential 8Firmware vulnerabilities patched within one month if non-critical and no exploits
Apply patches for non-critical firmware vulnerabilities within a month if no exploits exist.
E8-PO-ML3.9 · Essential 8The latest or previous OS release is used
Ensure your operating system is up-to-date with the latest or previous version.
E8-RA-ML1.1 · Essential 8Validating privileged access requests upon initial request
Check and approve requests for admin access to systems and data at the start.
E8-RA-ML1.2 · Essential 8Dedicated privileged accounts for admin tasks
Ensure admins use special accounts only for their admin work.
E8-RA-ML1.3 · Essential 8Prevent privileged accounts from accessing internet, email, and web services
Block admin accounts from internet and email to enhance security.
E8-RA-ML1.4 · Essential 8Limit privileged accounts to essential online service access
Only allow privileged accounts the minimum access needed for online duties.
E8-RA-ML1.5 · Essential 8Privileged users use separate privileged and unprivileged environments
Ensure privileged users have separate work environments for admin tasks and regular tasks.
E8-RA-ML1.6 · Essential 8Unprivileged accounts restricted from logging into privileged environments
Ensure that non-admin accounts cannot access admin-level systems.
E8-RA-ML1.7 · Essential 8Prevent privileged accounts from accessing unprivileged environments
Ensure privileged accounts can't be used in unsecured setups to limit risk.
E8-RA-ML2.1 · Essential 8Disable privileged access after 12 months without revalidation
Ensure privileged access is reviewed and renewed annually for continued access.
E8-RA-ML2.10 · Essential 8Timely analysis of cyber security events to identify incidents
Quickly review cyber events to spot security incidents.
E8-RA-ML2.11 · Essential 8Report cyber incidents to the CISO promptly
Report security incidents to the security officer quickly after finding them.
E8-RA-ML2.12 · Essential 8Report cyber security incidents to ASD promptly
Notify ASD quickly about any cyber attacks or breaches.
E8-RA-ML2.13 · Essential 8Enact cyber incident response plan after an incident is identified
Start the response plan immediately after a cyber incident is detected.
E8-RA-ML2.2 · Essential 8Privileged access is disabled after 45 days of inactivity
Disable admin accounts if unused for 45 days to improve security.
E8-RA-ML2.3 · Essential 8Privileged environments are not virtualised within unprivileged environments
Ensure that secure environments are not run within less secure ones.
E8-RA-ML2.4 · Essential 8Conduct administrative activities through jump servers
Require admins to use secure jump servers for management tasks.
E8-RA-ML2.5 · Essential 8Long, unique, and managed credentials for admin accounts
Ensure admin account credentials are strong, unique, and well-managed.
E8-RA-ML2.6 · Essential 8Privileged access events are centrally logged.
Keep logs of admin actions in a central place to monitor for misuse.
E8-RA-ML2.7 · Essential 8Centrally log privileged account and group management events
Ensure logs of admin account and group changes are stored in one place.
E8-RA-ML2.8 · Essential 8Event logs are protected from unauthorised changes and losses
Ensure event logs cannot be changed or deleted without authorisation.
E8-RA-ML2.9 · Essential 8Event logs are analysed promptly for security events
Quickly check logs from servers open to the internet for security issues.
E8-RA-ML3.1 · Essential 8Limit privileged access to what is necessary for duties
Ensure privileged access is granted only when needed to perform specific duties.
E8-RA-ML3.2 · Essential 8Use Secure Admin Workstations for Administrative Tasks
Conduct admin activities on secure, dedicated workstations only.
E8-RA-ML3.3 · Essential 8Just-in-time administration is used for administering systems and applications.
Grant high-level access only when needed and for limited times to enhance security.
E8-RA-ML3.4 · Essential 8Memory integrity functionality is enabled
Ensure features that protect memory from exploits are enabled to prevent unauthorized code execution
E8-RA-ML3.5 · Essential 8Local Security Authority protection functionality is enabled
Ensure LSA protection is on to prevent malware from stealing credentials.
E8-RA-ML3.6 · Essential 8Enable Credential Guard for secure credential storage
Enable Credential Guard to protect credentials from attacks by isolating them.
E8-RA-ML3.7 · Essential 8Enable Remote Credential Guard functionality
Prevent admin credentials from being exposed during remote logins.
E8-RA-ML3.8 · Essential 8Timely analysis of event logs from non-internet-facing servers
Review logs of internal servers promptly to spot security threats.
E8-RA-ML3.9 · Essential 8Timely analysis of workstation event logs for security events
Regularly check logs on office computers to find security issues early.
E8-RB-ML1.1 · Essential 8Backups aligned with business continuity needs
Ensure backups match business needs and help restore data after incidents.
E8-RB-ML1.2 · Essential 8Ensure backups are synchronised for restoration to a common point in time
Ensure data, applications, and settings are backed up together to restore them to the same point in
E8-RB-ML1.3 · Essential 8Backups retained securely and resiliently
Ensure backups are kept securely and can withstand failures.
E8-RB-ML1.4 · Essential 8Test backup restoration to a common point during disaster recovery
Ensure data and apps can be restored to a common point using backups in disaster scenarios.
E8-RB-ML1.5 · Essential 8Unprivileged accounts cannot access others' backups
Ensure that unprivileged accounts can't access other users' backups.
E8-RB-ML1.6 · Essential 8Prevent unprivileged accounts from modifying and deleting backups
Ensure non-admin users cannot change or remove backup files.
E8-RB-ML2.1 · Essential 8Prevent privileged accounts from accessing others' backups
Ensure only backup administrators can access all backup data.
E8-RB-ML2.2 · Essential 8Privileged accounts cannot modify or delete backups.
Ensure privileged users can't change or remove backups, except backup admins.
E8-RB-ML3.1 · Essential 8Unprivileged accounts cannot access their own backups
Ensure basic user accounts are unable to access or manage their backup data.
E8-RB-ML3.2 · Essential 8Privileged accounts cannot access their own backups
Ensure accounts with special access cannot view their own backup data.
E8-RB-ML3.3 · Essential 8Backup administrators cannot modify or delete backups during retention
Ensure backup admins can't change or remove backups until retention ends.
E8-RM-ML1.1 · Essential 8Disable Microsoft Office macros for users without a business need
Ensure only users with a specific business need can run Microsoft Office macros.
E8-RM-ML1.2 · Essential 8Block Microsoft Office macros from the internet
Prevent macros in files from the internet from being opened in Microsoft Office.
E8-RM-ML1.3 · Essential 8Enable antivirus scanning for Microsoft Office macros
Ensure antivirus scanning is active for macros in Microsoft Office documents.
E8-RM-ML1.4 · Essential 8Prevent users from changing Microsoft Office macro security settings
Ensure users cannot alter macro settings in Microsoft Office applications.
E8-RM-ML2.1 · Essential 8Microsoft Office macros are blocked from making Win32 API calls
Block Office macros from running code that interacts directly with Windows.
E8-RM-ML3.1 · Essential 8Restrict Microsoft Office macros to only trusted or sandboxed environments
Allow only macros from trusted locations, sandboxes, or signed by trusted publishers.
E8-RM-ML3.2 · Essential 8Check Microsoft Office macros for malicious code before signing or trusting
Ensure Office macros are safe from malicious code before trusting or signing.
E8-RM-ML3.3 · Essential 8Only privileged users can modify content in Trusted Locations
Ensure that only specific users can edit trusted macro locations to prevent malicious code.
E8-RM-ML3.4 · Essential 8Untrusted Publisher Macros Cannot Be Enabled via Message Bar or Backstage View
Block untrusted Microsoft Office macros from being enabled using standard interface warnings.
E8-RM-ML3.5 · Essential 8Block enabling of non-V3 signed Microsoft Office macros via Message Bar
Prevent enabling of macros not signed with V3 signatures using standard Office UI controls.
E8-RM-ML3.6 · Essential 8Validate list of trusted publishers in Microsoft Office annually
Regularly check and confirm trusted publishers in Microsoft Office to prevent unauthorized macro use
ISM-0009 · ASD ISMIdentify Supplementary Controls for System Security
System owners consult officers to add extra security controls based on system specifics and organisa
ISM-0027 · ASD ISMMandatory Authorisation for System Operation
System owners must get permission from an authorising officer to operate certain systems.
ISM-0039 · ASD ISMDevelop and Maintain a Cyber Security Strategy
Ensure there is a continuous and effective plan for safeguarding cyber activities and data.
ISM-0041 · ASD ISMDevelop a Detailed System Security Plan
Create a security plan detailing system purpose, management, and additional controls.
ISM-0042 · ASD ISMMaintain Effective System Administration Practices
Ensure systems are managed effectively with developed and maintained procedures.
ISM-0043 · ASD ISMCyber Security Incident Response Plan Requirements
Create a plan detailing how to handle and report cyber security incidents effectively.
ISM-0047 · ASD ISMApproval Process for Cyber Security Documentation
Cyber security documents need approval from the chief security officer or system officer based on th
ISM-0072 · ASD ISMDocument Security Requirements in Contractual Arrangements
Include security needs in contracts with service providers and review them to ensure they meet curre
ISM-0078 · ASD ISMAustralian Supervision of AUSTEO/AGAO Data Systems
Only Australian nationals should control systems handling sensitive Australian data.
ISM-0100 · ASD ISMRegular IRAP Assessment of Sensitive Gateways
Sensitive gateways must have an IRAP assessment at least every two years using the latest ISM standa
ISM-0109 · ASD ISMTimely Analysis of Workstation Event Logs
Workstation event logs must be checked promptly to find any cybersecurity issues.
ISM-0120 · ASD ISMAccess to Tools for Detecting Security Events
Ensure cyber security staff have tools to detect and identify security threats and incidents.
ISM-0123 · ASD ISMReport Cyber Security Incidents Promptly
Inform the chief information security officer quickly after any cyber incident is found.
ISM-0125 · ASD ISMMaintaining a Cyber Security Incident Register
Create and keep a log of any cyber security incidents that occur.
ISM-0133 · ASD ISMResponding to Data Spills by Restricting Access
When a data spill occurs, notify the data owner and limit access to protect information.
ISM-0137 · ASD ISMSeek Legal Advice for Intrusion Evidence Collection
Before collecting evidence of cyber intrusions, get legal advice.
ISM-0138 · ASD ISMMaintaining Integrity of Evidence in Investigations
Investigators keep evidence intact by documenting actions, ensuring custody, and following law enfor
ISM-0140 · ASD ISMPrompt Reporting of Cyber Incidents to ASD
Report cyber incidents to ASD immediately when they're identified.
ISM-0141 · ASD ISMReport Cyber Incidents Promptly to Designated Contacts
Service providers must report cyber incidents quickly to a specified contact as part of their contra
ISM-0142 · ASD ISMReport Cryptographic Equipment Compromises Promptly
Notify security officers quickly if cryptographic equipment or keys might be compromised.
ISM-0161 · ASD ISMEnsure Security of Unused IT Equipment and Media
IT equipment and media are protected against unauthorized access when not actively being used.
ISM-0164 · ASD ISMPrevent Unauthorised Viewing of System Displays
Ensure that unauthorised individuals can't see computer screens or keyboards in secure areas.
ISM-0181 · ASD ISMEnsure Cabling Meets Australian Standards
Install cables according to Australian Standards as required by the communications authority.
ISM-0187 · ASD ISMExclusive Secret Cable Bundling in Infrastructure
SECRET cables must be kept separate in their own bundles or conduits to enhance security.
ISM-0194 · ASD ISMSealing Conduit Joints in Shared Facilities
Use visible glue to seal plastic and TOP SECRET conduit joints in shared spaces.
ISM-0195 · ASD ISMSeal Removable Covers on TOP SECRET Cables
Use special seals to secure TOP SECRET cable covers in shared spaces to prevent tampering.
ISM-0198 · ASD ISMConsultation for Penetrating Audio Secure Rooms
Before entering top secret audio rooms, consult ASIO and follow their guidance.
ISM-0201 · ASD ISMLabelling Requirements for TOP SECRET Conduits
TOP SECRET conduits must have labels every 5 metres, marked 'TS RUN', and be at least 2.5 cm by 1 cm
ISM-0206 · ASD ISMDevelop and Maintain Cable Labelling Processes
Ensure cables are labelled correctly by setting up and following specific procedures.
ISM-0208 · ASD ISMMaintain a Comprehensive Cable Register
Keep a detailed record of each cable, including ID, colour, and location, to ensure proper cable man
ISM-0211 · ASD ISMDevelop and Verify a Cable Register
Maintain a detailed record of cables and regularly check it for accuracy.
ISM-0213 · ASD ISMSegregate Patch Panels for Secret-Level Cables
Secret and top secret cables must be connected to separate patch panels for security.
ISM-0216 · ASD ISMEnsure Separate Cabinets for TOP SECRET Patch Panels
TOP SECRET patch panels must be within their own separate cabinets to enhance security.
ISM-0217 · ASD ISMSecure Separation of Non-TOP SECRET and TOP SECRET Panels
Install barriers and restrict access to mix different security level patch panels in cabinets.
ISM-0218 · ASD ISMLabel and Protect Long TS Fibre-Optic Leads
Ensure long TS fibre-optic cables are protected, easy to inspect, and labelled at the equipment end.
ISM-0225 · ASD ISMPrevent Unauthorised RF and IR Device Entry
Ensure no unauthorised RF or IR devices are brought into high-security areas.
ISM-0229 · ASD ISMGuidelines for Discussing Sensitive Information Over Phones
Staff are informed about what sensitive information can be talked about on phone calls.
ISM-0230 · ASD ISMAdvising on Risks of Non-Secure Telephone Systems
Staff are informed about security dangers of using unsecured phones for sensitive talks.
ISM-0231 · ASD ISMVisual Indication for Secure Telephone Connections
Telephone systems must show a visual cue for the security level of a call when using encryption.
ISM-0232 · ASD ISMEncrypt External Traffic for Sensitive Calls
Sensitive phone calls should be encrypted to prevent eavesdropping when using outside systems.
ISM-0233 · ASD ISMUse Encrypted Cordless Systems for Sensitive Conversations
Do not use cordless phones for sensitive talks unless they use ASD-approved encryption.
ISM-0235 · ASD ISMUse of Speakerphones in TOP SECRET Areas
Speakerphones can only be used in secure rooms when discussing TOP SECRET matters.
ISM-0236 · ASD ISMImplement Off-hook Audio Protection on Telephones
Use features to prevent phone conversations being heard in sensitive areas.
ISM-0240 · ASD ISMPrevent Sensitive Data in Messaging Services
Do not send sensitive information using paging or messaging apps.
ISM-0245 · ASD ISMPrevent MFD Connections to Digital Phone Systems
Do not connect multifunction devices (MFDs) to digital telephone systems.
ISM-0246 · ASD ISMContact ASD for Emanation Security Assessment
When an emanation security risk assessment is required, it is sought as early as possible in a syste
ISM-0249 · ASD ISMRequest ASD Emanation Security Assessments for Deployed Classified Systems
System owners deploying SECRET or TOP SECRET systems in mobile platforms or as a deployable capabili
ISM-0250 · ASD ISMEnsure IT Equipment Meets EMI/EMC Standards
IT equipment is required to comply with standards to prevent electromagnetic interference.
ISM-0252 · ASD ISMAnnual Cyber Security Awareness for Personnel
All staff receive yearly training on using and protecting systems, and reporting incidents.
ISM-0258 · ASD ISMEstablish and Maintain a Web Usage Policy
Develop and maintain a policy to manage how the web is used and accessed.
ISM-0260 · ASD ISMEnsure All Web Access Uses Proxies
All web access must go through web proxies to control and monitor internet use.
ISM-0261 · ASD ISMLog Web Proxy Activity for Security Analysis
Record details of websites accessed through web proxies, including web address and user info, for se
ISM-0263 · ASD ISMInspect and Decrypt TLS Traffic through Gateways
Gateways decrypt and check TLS internet traffic for safety reasons.
ISM-0264 · ASD ISMDevelop and Maintain an Email Usage Policy
Create and uphold a policy to guide the use of email communications.
ISM-0267 · ASD ISMBlocking Access to Unapproved Webmail Services
Prevent access to webmail services that haven't been approved by the organisation.
ISM-0269 · ASD ISMRestrict Sensitive Emails to Verified Recipients
Sensitive emails must not go to groups unless all recipients' nationalities are confirmed.
ISM-0270 · ASD ISMApply Protective Markings to Emails Based on Sensitivity
Emails must be marked to show their highest confidentiality level based on content.
ISM-0271 · ASD ISMPrevent Automatic Email Marking by Protective Tools
Protective tools for emails don't automatically add security labels to your messages.
ISM-0272 · ASD ISMPrevent Unauthorised Protective Marking Selection
Ensure users cannot choose classification levels the system cannot handle.
ISM-0280 · ASD ISMChoose PP-evaluated Products Over EAL-based Ones
Prefer products evaluated against protection profiles over those with EAL evaluations for procuremen
ISM-0285 · ASD ISMEnsuring Evaluated Products Follow Delivery Procedures
Products must be delivered according to any specified delivery methods in evaluation documents.
ISM-0286 · ASD ISMConsult ASD for High Assurance IT Delivery Procedures
Contact ASD for delivery procedures when buying high-security IT equipment.
ISM-0289 · ASD ISMImplement and Manage Evaluated Products Correctly
Ensure evaluated products are set up and run correctly following vendor instructions and evaluated s
ISM-0290 · ASD ISMSecure Configuration of High Assurance IT Equipment
Ensure high-grade IT gear is set up and operated per ASD standards for security.
ISM-0293 · ASD ISMClassify IT Equipment by Data Sensitivity
Label IT equipment based on the sensitivity of the data it handles.
ISM-0294 · ASD ISMLabel IT Equipment with Sensitivity Markings
Label IT equipment, except high assurance, with appropriate sensitivity or classification markings.
ISM-0296 · ASD ISMApproval Required for High Assurance IT Equipment Labelling
Seek approval before labelling high assurance IT equipment to ensure security standards.
ISM-0298 · ASD ISMCentralised System Patch and Update Management
Ensure patches and updates are applied correctly using a centralised system for better security.
ISM-0300 · ASD ISMApply System Security Patches with Approval
Security patches for critical IT must be approved and applied as directed by ASD.
ISM-0304 · ASD ISMRemove Unsupported Applications for System Security
Applications no longer supported by vendors, except some key types, should be removed for security.
ISM-0305 · ASD ISMOn-Site IT Equipment Maintenance by Cleared Technicians
Ensure IT equipment maintenance is done onsite by technicians with proper clearance.
ISM-0306 · ASD ISMEscort Uncleared Technicians During IT Equipment Maintenance or Repairs
When a technician who lacks the required security clearance works on your IT equipment, a suitable c
ISM-0307 · ASD ISMSanitise Equipment When Not Using Cleared Technician
Sanitise IT equipment if repairs are made by non-cleared technicians.
ISM-0310 · ASD ISMOff-Site IT Equipment Handling Approvals
Off-site IT repairs must be at approved facilities matching the equipment's classification level.
ISM-0311 · ASD ISMEnsuring Sanitisation of IT Equipment Media
Remove or clean media from IT equipment to ensure data is not left on the device.
ISM-0312 · ASD ISMReturn Overseas Equipment for Destruction
Sensitive IT gear overseas must be sent back to Australia for destruction if it can't be cleaned the
ISM-0313 · ASD ISMDevelop and Maintain IT Equipment Sanitisation Procedures
Organisations must create and uphold processes for properly cleaning and disposing of IT equipment.
ISM-0315 · ASD ISMEnsure Destruction of High Assurance IT Equipment
High assurance IT equipment must be destroyed before disposal to prevent data leaks.
ISM-0316 · ASD ISMFormal Decision on IT Equipment Disposal
Before IT equipment is publicly released, it must be sanitised and authorised after a formal decisio
ISM-0317 · ASD ISMEnsuring Data Erasure on Printer Cartridges and Drums
Print three full pages of random text to ensure no data remains on printer cartridges or drums.
ISM-0318 · ASD ISMSafely Disposing of Unsanitised Printer Components
Destroy printer cartridges or print drums if they can't be sanitised, like other memory devices.
ISM-0321 · ASD ISMContact ASD for Guidance on Secure IT Disposal
Ensure secure disposal of certain IT equipment by consulting the ASD for requirements.
ISM-0323 · ASD ISMClassifying Media by Data Sensitivity
Media should be classified by the highest level of data sensitivity it contains.
ISM-0325 · ASD ISMReclassify Media to Higher Sensitivity
Media connected to more sensitive systems is upgraded to match the highest security level.
ISM-0330 · ASD ISMProper Sanitisation and Reclassification of Media
Before lowering media classification, it must be cleaned or destroyed and a formal decision made.
ISM-0332 · ASD ISMLabel Media With Protective Markings Reflecting Sensitivity Or Classification
All media, apart from fixed drives built inside equipment, must carry a label showing how sensitive
ISM-0336 · ASD ISMDevelop and Maintain Networked IT Equipment Register
Keep a regularly checked list of IT equipment connected to the network.
ISM-0337 · ASD ISMEnsure Media is Used with Authorised Systems
Media must only be used with systems that are authorised for its sensitivity level.
ISM-0341 · ASD ISMDisable Automatic Execution for Removable Media
Ensure removable media cannot run programs automatically when inserted.
ISM-0343 · ASD ISMDisabling Unnecessary Access to Removable Media
Disable writing to removable media unless it's necessary for business.
ISM-0345 · ASD ISMDisable External Interfaces for Direct Memory Access
Disable external communication ports that could directly access system memory to prevent unauthorise
ISM-0347 · ASD ISMUse Write-Once Media for Secure Data Transfers
When moving data between different security levels, make sure to use media that can't be changed, un
ISM-0348 · ASD ISMDevelop and Maintain Media Sanitisation Procedures
Organisations must create, apply, and keep up media sanitisation methods and procedures.
ISM-0350 · ASD ISMDestroy Unsanitizable Media Before Disposal
Media that can't be cleaned of data must be destroyed before getting rid of it.
ISM-0351 · ASD ISMProper Method for Volatile Media Sanitisation
Turn off power to the storage device for 10 minutes to fully clear data.
ISM-0352 · ASD ISMSecure Volatile Media by Overwriting with Random Data
Ensure SECRET and TOP SECRET media are made unreadable by overwriting with random data and verifying
ISM-0354 · ASD ISMEnsuring Proper Sanitisation of Magnetic Media
Erase non-volatile magnetic media by overwriting with random data, ensuring old data cannot be acces
ISM-0356 · ASD ISMClassify Magnetic Media After Sanitisation
After cleaning, classified magnetic media must still be treated as classified.
ISM-0357 · ASD ISMSanitising Non-volatile EPROM Media
Erase and overwrite EPROM with UV exposure and a random pattern to ensure data is completely removed
ISM-0358 · ASD ISMClassification Retention for Sanitised EPROM and EEPROM
Even after erasure, certain memory devices stay classified as SECRET or TOP SECRET.
ISM-0359 · ASD ISMProper Sanitisation of Non-Volatile Flash Memory
Non-volatile flash memory is wiped by overwriting it twice with random data, then checked to ensure
ISM-0360 · ASD ISMClassification Retention After Flash Memory Sanitisation
Even after being sanitised, flash drives for SECRET and TOP SECRET still need to be treated as class
ISM-0361 · ASD ISMUsing Degaussers for Magnetic Media Destruction
Magnetic media is destroyed by ensuring the degausser has the right strength and orientation of the
ISM-0362 · ASD ISMFollow Manufacturer's Directions for Degaussing
Ensure magnetic media is degaussed according to the manufacturer's instructions to properly erase da
ISM-0363 · ASD ISMDevelop and Maintain Media Destruction Processes
Ensure your organisation creates and follows proper media destruction procedures to securely dispose
ISM-0368 · ASD ISMEnsuring Media Particles Are No Larger Than 9 mm
Destroy media so resulting particles are no bigger than 9 mm to prevent data recovery.
ISM-0370 · ASD ISMSupervise Media Destruction with Cleared Personnel
Ensure destroyed media is supervised by a qualified person for security purposes.
ISM-0371 · ASD ISMEnsure Proper Supervision of Media Destruction
Staff must oversee media destruction to ensure it is done correctly and completely.
ISM-0372 · ASD ISMSupervision of Media Destruction Procedures
Media destruction must be overseen by at least two security-cleared staff members.
ISM-0373 · ASD ISMSupervise and Certify Accountable Material Destruction
Supervisors ensure accountable material is destroyed properly and sign a certificate to confirm it.
ISM-0374 · ASD ISMDevelop and Maintain Media Disposal Procedures
Organisations must create and uphold procedures for securely disposing of media.
ISM-0375 · ASD ISMDecide on Public Release of Data Storage Media
After data is erased or destroyed, a formal decision allows media to be sent to the public.
ISM-0378 · ASD ISMRemove Labels from Media Before Disposal
Remove all identifying labels from media before throwing it away to ensure no information can be tra
ISM-0380 · ASD ISMDisable Unneeded OS Accounts and Services
Remove or turn off unnecessary user accounts and services on operating systems to improve security.
ISM-0382 · ASD ISMRestrict Unprivileged User Actions on Applications
Ordinary users cannot remove or turn off approved apps on their own.
ISM-0383 · ASD ISMChange Default OS User Accounts During Setup
Change or disable default OS user accounts during setup to enhance security.
ISM-0385 · ASD ISMMaintain Effective Functional Separation Between Servers
Each server should perform its own distinct function and not share a machine or operating environmen
ISM-0393 · ASD ISMClassify Databases Based on Data Sensitivity
Databases should be classified according to how sensitive the data they contain is.
ISM-0400 · ASD ISMSegregation of Environments in Software Development
Development areas are kept separate to enhance security and efficiency in software projects.
ISM-0401 · ASD ISMImplement Secure by Design in Software Development
Follow Secure by Design practices throughout software development to ensure security.
ISM-0402 · ASD ISMSoftware Vulnerability Testing Using SAST, DAST and SCA
Software is regularly tested for security vulnerabilities using various testing methods before and a
ISM-0405 · ASD ISMValidation for Unprivileged System Access Requests
Requests for basic system access are checked when they are first made.
ISM-0407 · ASD ISMMaintain Secure User Access Records
Keep a secure record of who accessed the system, who authorised it, and details of their access leve
ISM-0408 · ASD ISMSystem Login Security Reminder Banner
A login message that reminds users of their security duties when accessing the system.
ISM-0409 · ASD ISMRestrict Foreign Nationals' Access to Sensitive Data
Foreign nationals can't access certain sensitive data unless security measures prevent it.
ISM-0411 · ASD ISMRestrict System Access for Foreign Nationals
Foreign nationals need strict controls to access systems handling AGAO data.
ISM-0414 · ASD ISMEnsure Unique Identification for System Access
People accessing systems must have unique identifiers to ensure accountability.
ISM-0415 · ASD ISMStrict Control of Shared User Accounts
Ensure shared user accounts are used carefully, with each user clearly identified to maintain securi
ISM-0417 · ASD ISMUse Passwords When Multi-Factor Authentication Isn't Supported
If systems can't use multi-factor authentication, they should use passwords for single-factor authen
ISM-0418 · ASD ISMKeep Physical Credentials Separate from Systems
Store physical credentials away from systems except when logging in.
ISM-0420 · ASD ISMIdentify Nationality of Foreign Personnel in System
Ensure foreign nationals using the system are identified by their nationality for sensitive data sec
ISM-0421 · ASD ISMRequire Minimum 15-Character Passwords for Security
Passwords for sensitive systems must have at least 15 characters to enhance security.
ISM-0422 · ASD ISMEnsuring Strong Passwords for TOP SECRET Systems
Passwords on TOP SECRET systems should be at least 20 characters to ensure strong security.
ISM-0428 · ASD ISMEnforcement of Secure Session Locking Measures
Sessions lock after inactivity or maximum duration, blocking access until users re-authenticate with
ISM-0430 · ASD ISMImmediate Suspension of Unneeded System Access
Revoke system access for individuals as soon as it's no longer needed.
ISM-0432 · ASD ISMDocument System Access Requirements in Security Plans
System access rules must be documented in each system's security plan to ensure proper access manage
ISM-0434 · ASD ISMEnsure Personnel Employment Screening and Security Clearance
Staff need job screening and security clearance for system access.
ISM-0435 · ASD ISMPre-Access Briefings for System Resources
Staff must be briefed before accessing system resources.
ISM-0441 · ASD ISMEnsuring Limited Access for Temporary System Use
When given temporary system access, personnel can only see data needed for their job.
ISM-0443 · ASD ISMRestrict Temporary Access to Secure Systems
Temporary access is not allowed for systems handling highly sensitive information.
ISM-0445 · ASD ISMDedicated Accounts for Privileged User Activities
Privileged users must have separate accounts for administrative tasks to enhance security.
ISM-0446 · ASD ISMRestrict Privileged Access for Foreign Nationals
Foreign nationals can't access Australian systems with sensitive data privileges.
ISM-0447 · ASD ISMRestrict Privileged Access for Foreign Nationals
Foreign nationals can't have privileged access to systems handling AGAO data except if seconded.
ISM-0455 · ASD ISMEnable Data Recovery for Encrypted Data
Ensure encrypted data can be accessed if the encryption key is lost or damaged.
ISM-0457 · ASD ISMUse Evaluated Crypto for Sensitive Data Encryption
Use approved cryptographic tools to encrypt sensitive or protected data to ensure security.
ISM-0459 · ASD ISMImplement Full or Partial Disk Encryption
Use encryption to protect data on disks, ensuring all writings are to encrypted areas only.
ISM-0460 · ASD ISMUse HACE for Encrypting Sensitive Media
HACE ensures the encryption of media with SECRET or TOP SECRET data is secure.
ISM-0462 · ASD ISMManaging Encryption Access for IT Equipment and Media
IT systems are treated according to their original sensitivity when accessed using encryption.
ISM-0465 · ASD ISMUse Evaluated Cryptographic Tools for Sensitive Data
Use evaluated cryptographic tools to protect sensitive data on insecure or public networks.
ISM-0467 · ASD ISMUsing HACE for Secure Communication of Data
Use HACE to secure SECRET and TOP SECRET data on less secure networks.
ISM-0469 · ASD ISMUse Approved Cryptographic Protocols When Encrypting Data In Transit
When data moves across networks, encrypt it using an approved (AACP) or high assurance cryptographic
ISM-0471 · ASD ISMUse Only High Assurance Cryptographic Algorithms
Ensure cryptographic tools use only ASD-approved or high-assurance algorithms for security.
ISM-0472 · ASD ISMUsing Proper Modulus Size for Diffie-Hellman Keys
Ensure Diffie-Hellman encryption uses at least a 2048 bits modulus for secure key agreements.
ISM-0474 · ASD ISMUsing Secure Elliptic Curve Diffie-Hellman Encryption
Use ECDH with a base point order and key size of at least 224 bits, preferably NIST P-384, for secur
ISM-0475 · ASD ISMUse P-384 Curve for Secure Digital Signatures
Ensure stronger digital signature security by using ECDSA with a key size of at least 224 bits, idea
ISM-0476 · ASD ISMEnsuring Strong RSA Modulus for Digital Security
Use a minimum 2048-bit RSA modulus for better security in digital signatures and key transport.
ISM-0477 · ASD ISMSeparate RSA Key Pairs for Different Functions
Use separate RSA key pairs for signing and key transportation to enhance security.
ISM-0479 · ASD ISMAvoid Using ECB Mode for Symmetric Encryption
Symmetric encryption should not use ECB mode as it is less secure.
ISM-0481 · ASD ISMEnsure Use of High Assurance Cryptographic Protocols
Ensure only approved secure cryptographic protocols are used in equipment and software.
ISM-0484 · ASD ISMConfigure SSH for Secure Server Access
Ensure SSH settings enhance security by limiting access, disabling risky features, and ensuring safe
ISM-0485 · ASD ISMUse Public Key Authentication for SSH Access
Ensure SSH connections use public key authentication for enhanced security.
ISM-0487 · ASD ISMDisable Certain Features for Passwordless SSH Logins
When logging in without a password via SSH, certain access features like port forwarding and X11 are
ISM-0488 · ASD ISMUse Forced Commands for SSH Without Passwords
Ensure SSH without passwords uses specific commands and checks parameters for security.
ISM-0489 · ASD ISMSSH-Agent Key Expiry and Screen Lock Requirements
SSH-agent caches must be used on systems with screen locks and expire after 4 hours of inactivity.
ISM-0490 · ASD ISMEnsure S/MIME 3.0 or Later is Used
Only use S/MIME version 3.0 or later for secure email communications.
ISM-0494 · ASD ISMUse of IPsec Tunnel and Transport Modes
IPsec connections should use tunnel mode; if using transport mode, ensure an IP tunnel is used.
ISM-0496 · ASD ISMUse ESP Protocol for Secure IPsec Connections
ESP protocol is needed to securely encrypt and authenticate IPsec connections.
ISM-0498 · ASD ISMEnsure Short Lifetimes for IPsec Associations
IPsec connections should expire in less than four hours to maintain security.
ISM-0499 · ASD ISMEnsure Compliance with ASD Communication Security Policies
Follow ASD's security rules for operating and managing communication systems safely.
ISM-0501 · ASD ISMTransport of Keyed Cryptographic Equipment
Cryptographic equipment is moved securely depending on the sensitivity of its keys.
ISM-0507 · ASD ISMDevelop and Maintain Cryptographic Key Management Processes
Ensure systems have established processes for managing cryptographic keys securely and efficiently.
ISM-0516 · ASD ISMComprehensive Network Diagrams for Critical Components
Create network diagrams showing connections, critical servers, and security devices for proper docum
ISM-0518 · ASD ISMMaintain Comprehensive Network Documentation
Ensure that network documentation is regularly created, updated, and kept available to support netwo
ISM-0520 · ASD ISMPrevent Unauthorised Network Device Connections
Ensure only approved devices can connect to the network, blocking unauthorised access.
ISM-0521 · ASD ISMDisable Unused IPv6 on Dual-Stack Devices
Turn off IPv6 capabilities on network devices unless they are actively being used.
ISM-0529 · ASD ISMAvoid Using VLANs for Different Security Domains
Do not use VLANs to separate networks with different security levels.
ISM-0530 · ASD ISMAdminister VLANs from Trusted Security Domains
VLANs must be managed from the most secure and trusted part of the network.
ISM-0534 · ASD ISMDisable Unused Network Device Ports
Network devices should have any unused physical ports turned off to prevent unauthorized access.
ISM-0535 · ASD ISMPrevent VLAN Trunk Sharing Across Security Domains
Ensure network devices do not use shared paths for VLANs from different security areas.
ISM-0536 · ASD ISMSegregate Public Wireless Networks from Organisation Networks
Ensure public wireless networks are separate from organisation networks for security.
ISM-0546 · ASD ISMUse Video and Voice-Aware Firewalls at Gateways
Ensure firewalls and proxies can handle video and voice data for secure conferencing and calls.
ISM-0547 · ASD ISMSecure Protocols for Video and IP Telephony
Video and IP calls must use secure protocols to keep communications private and safe.
ISM-0548 · ASD ISMEnsure Secure Protocols for Video and IP Calls
Video and IP calls must use secure protocols to protect communication.
ISM-0549 · ASD ISMSeparate Video Conferencing and IP Telephony Traffic From Other Data
Keep video conferencing and internet phone (IP telephony) traffic separated, either by physical cabl
ISM-0551 · ASD ISMEnsure Secure IP Telephony Device Authentication
Ensure only authorised IP phones can register and use the network, blocking unauthorised and unused
ISM-0553 · ASD ISMAuthenticate Video Calls and Manage Settings
Ensure all video call actions and settings changes are verified with authentication and authorisatio
ISM-0554 · ASD ISMSecure Two-Way Authentication for Video Calls
Video calls must use secure two-way authentication to ensure calls are encrypted and cannot be reuse
ISM-0555 · ASD ISMEnsure Authentication for IP Telephony Actions
Users must be verified for all actions such as registering phones and accessing voicemail on IP tele
ISM-0556 · ASD ISMEnsure Traffic Separation for Video Conferencing and Telephony
Keep video conferencing and IP phone data separate from other data using VLANs or similar methods.
ISM-0558 · ASD ISMRestrict IP Phone Network Access in Public Areas
Public area IP phones cannot connect to data networks or access voicemail and directories.
ISM-0559 · ASD ISMRestrict Microphone and Webcam Use in SECRET Areas
Don't use microphones or webcams on non-classified computers in areas handling SECRET projects.
ISM-0565 · ASD ISMEmail Security for Protective Markings
Email servers stop and track emails with wrong markings to prevent mistakes.
ISM-0567 · ASD ISMRestrict Email Relay to Specific Domains
Ensure email servers only relay emails within their own domains to prevent misuse.
ISM-0569 · ASD ISMCentralise Email Routing via Gateways
Emails are processed through central gateways for improved control and security.
ISM-0570 · ASD ISMMaintain Backup Email Gateways to Primary Standards
Alternative email gateways must be kept to the same standards as the main gateway to ensure consiste
ISM-0571 · ASD ISMEnsure Secure Email Transmission via Gateways
Emails should be sent through secure and encrypted channels using central gateways.
ISM-0572 · ASD ISMEnable Opportunistic TLS for Email Server Encryption
Ensure email servers use encryption to protect emails sent over public networks.
ISM-0574 · ASD ISMUse SPF to Authorise Email Servers
SPF helps confirm which email servers are allowed to send emails for your organisation's domain.
ISM-0576 · ASD ISMDevelop and Maintain Cyber Security Incident Plans
Organisations must create and keep an updated cyber security incident management and response plan.
ISM-0580 · ASD ISMDevelop, Implement and Maintain a Security Monitoring Policy
A security monitoring policy must be developed (written down), implemented (actually put into practi
ISM-0582 · ASD ISMCentral Logging of Windows Security Events
Important Windows security events are collected in a central location to monitor system activities.
ISM-0585 · ASD ISMCapture Detailed Information in Event Logs
Record details like time, user, and equipment for each logged event.
ISM-0588 · ASD ISMDevelop and Maintain MFD Usage Policy
Establish a policy to guide the proper use of multifunction devices.
ISM-0589 · ASD ISMLimit Document Sensitivity on MFDs Based on Network Classification
Multifunction devices should not scan or copy documents that are more sensitive than the network the
ISM-0590 · ASD ISMEnsure Strong Authentication for Multi-Function Devices
Multi-function devices should have security measures as strong as those for computers they connect t
ISM-0591 · ASD ISMUse Evaluated Peripheral Switches Securely
Use verified switches to safely share devices between different computer systems.
ISM-0597 · ASD ISMConsult ASD Before Changing CDS Connectivity
Consult ASD when adding connections to cross domain systems and follow their guidance.
ISM-0610 · ASD ISMTrain Users on Secure Use of CDSs
Users must be trained on securely using CDSs before they can access them.
ISM-0611 · ASD ISMRestrict Privileges for Gateway Administrators
Gateway admins have only the necessary access permissions for their tasks.
ISM-0612 · ASD ISMTraining for Gateway System Administrators
Gateway system admins must be formally trained to operate and manage the gateways effectively.
ISM-0613 · ASD ISMRequirement for Gateway System Administrators Nationality
Only Australian nationals can manage gateways to certain secure networks.
ISM-0616 · ASD ISMEnsure Separation of Duties for Gateway Admins
Different people handle administrative tasks for gateways to reduce security risks.
ISM-0619 · ASD ISMUser Authentication for Network Gateway Access
Ensure users verify their identity before accessing networks through gateways.
ISM-0622 · ASD ISMEnsuring Network Authentication via Gateways
IT devices must prove their identity to access networks through gateways.
ISM-0626 · ASD ISMImplementing CDS for Secure Network Segmentation
Cross Domain Solutions connect SECRET or TOP SECRET networks with other networks securely.
ISM-0628 · ASD ISMImplementing Secure Network Gateways
Set up gateways to securely connect networks from different security levels.
ISM-0629 · ASD ISMManage Gateways Between Different Security Domains
Secure shared network components by assigning management to higher security system admins or a trust
ISM-0631 · ASD ISMRestrict Data Flows with Authorised Gateways
Gateways should block any data transfers not specifically approved.
ISM-0634 · ASD ISMCentral Logging for Gateway Security Events
Log gateway events and alerts to monitor data flows and detect intrusion attempts.
ISM-0635 · ASD ISMEnsure Network Paths are Isolated in CDSs
Systems manage separate and secure network paths for upward and downward data movements to prevent s
ISM-0637 · ASD ISMImplementing Demilitarised Zones in Gateways
Gateways use demilitarised zones to safely allow outside parties access to organisational services.
ISM-0639 · ASD ISMUse Evaluated Firewalls Between Security Domains
Firewalls that have been independently evaluated are deployed between networks belonging to differen
ISM-0643 · ASD ISMUse of Diodes for Unidirectional Gateway Security
Use special devices (diodes) to ensure data flows one way only between networks, enhancing security.
ISM-0645 · ASD ISMHigh Assurance Evaluation of Unidirectional Gateways
Ensure diodes used between secure and public networks are highly evaluated for safety.
ISM-0649 · ASD ISMFilter Gateway Files for Allowed Types
Ensure only permitted file types are imported or exported through gateways.
ISM-0651 · ASD ISMBlock Malicious or Uninspectable Files
Block files flagged as harmful or that cannot be scanned to prevent threats.
ISM-0652 · ASD ISMQuarantine Suspicious Files for Review
Files flagged as risky are held until checked and cleared or blocked.
ISM-0657 · ASD ISMScanning Data for Threats Before Manual Import
Ensure data is checked for viruses and threats before being imported into systems.
ISM-0659 · ASD ISMFiltering Content of Gateway and CDS Files
Files passing through gateways or security systems are checked for unwanted or harmful content.
ISM-0660 · ASD ISMMonthly Verification of Data Transfer Logs for SECRET Systems
Check logs every month to ensure safe data transfers in top-secret systems.
ISM-0661 · ASD ISMUser Accountability for Data Transfers
Users are responsible for the data they move between systems.
ISM-0663 · ASD ISMDevelop and Maintain Data Transfer Procedures
Ensure data transfers are securely conducted with proper procedures in place.
ISM-0664 · ASD ISMAuthorisation of Secret Data Exports
Ensure data from high-security systems is checked and approved before export.
ISM-0665 · ASD ISMVerification Required for Exporting Secret Data
Only verified and authorised people or services can handle SECRET or TOP SECRET data exports.
ISM-0669 · ASD ISMSecurity Measures for Manual Data Export
Check signatures and keywords when exporting data at SECRET or TOP SECRET levels.
ISM-0670 · ASD ISMCentral Logging of CDS Security Events
Ensure all key security events of Cross Domain Solutions are logged centrally for monitoring.
ISM-0675 · ASD ISMEnsure Data Exports are Digitally Signed
Data from SECRET and TOP SECRET systems must be signed by a trusted source before export.
ISM-0677 · ASD ISMEnsure File Integrity Through Signature Validation
Files with digital signatures or checksums must be verified at system boundaries to ensure integrity
ISM-0682 · ASD ISMDisable Bluetooth on SECRET/TS Mobile Devices
Bluetooth must be turned off on mobile devices with SECRET or TOP SECRET information to prevent data
ISM-0687 · ASD ISMUse Approved Platforms for Secure Mobile Access
Use only ASD-approved mobile platforms for accessing SECRET or TOP SECRET data.
ISM-0694 · ASD ISMBlock Privately Owned Devices From SECRET and TOP SECRET Systems
Personally owned mobile devices and desktop computers must never be used to access SECRET or TOP SEC
ISM-0701 · ASD ISMEstablish Mobile Device Emergency Sanitisation Processes and Procedures
The organisation develops, implements and maintains processes and supporting procedures to rapidly s
ISM-0702 · ASD ISMUsing Cryptographic Sanitisation on Mobile Devices
Ensures cryptographic keys are erased on SECRET or TOP SECRET devices in emergencies.
ISM-0705 · ASD ISMDisable Split Tunnelling for VPN Connections
Ensure that devices accessing the organisation's network through VPN do not use split tunnelling for
ISM-0714 · ASD ISMAppoint a CISO to Lead Cyber Security Across IT and OT
The organisation must appoint a Chief Information Security Officer (CISO) who provides cyber securit
ISM-0717 · ASD ISMCISO Oversight of Cyber Security Personnel
The CISO is in charge of managing the organisation's cyber security staff.
ISM-0718 · ASD ISMCISO Reporting to Board on Cyber Security
The CISO must regularly update the board or executive committee on cyber security issues.
ISM-0720 · ASD ISMDevelop and Maintain a Cyber Security Communication Strategy
The CISO creates and updates a strategy to share the organisation's cyber security goals effectively
ISM-0724 · ASD ISMImplement Cyber Security Metrics and KPIs
The CISO sets up metrics and indicators to measure and track cyber security performance in the organ
ISM-0725 · ASD ISMCyber Security Steering Committee Coordination
The CISO aligns cyber security with business by regularly meeting with a dedicated committee of key
ISM-0726 · ASD ISMCoordinate Security Risk Management Activities
The CISO ensures business and security teams work together effectively on managing security risks.
ISM-0731 · ASD ISMCISO Oversight of Cyber Supply Chain Risks
The CISO is responsible for managing risks in their organisation's cyber supply chain.
ISM-0732 · ASD ISMManage and Allocate Cyber Security Budget
The CISO is responsible for handling the organisation's dedicated cyber security funds.
ISM-0733 · ASD ISMEnsure CISO Awareness of Cyber Incidents
The CISO should be informed about all cyber security incidents in the organisation.
ISM-0734 · ASD ISMCISO Role in Disaster Recovery Planning
The CISO helps to ensure recovery plans are in place to maintain essential services during a disaste
ISM-0735 · ASD ISMCISO Oversees the Cyber Security Awareness Training Program
The CISO oversees the development, implementation and maintenance of the organisation's cyber securi
ISM-0810 · ASD ISMSecure Facilities Based on System Classification
Ensure classified systems are in facilities suitable for their security needs.
ISM-0813 · ASD ISMEnsure Secure Access to Critical Infrastructure
Make sure rooms with servers and security equipment are always locked or secured.
ISM-0817 · ASD ISMReporting Suspicious Online Contact Awareness
Staff learn to recognise and report suspicious online contact.
ISM-0820 · ASD ISMAvoid Posting Work Data on Unauthorised Online Services
Staff should not share work info on unauthorised sites and must report if such info is found online.
ISM-0821 · ASD ISMAdvise on Risks of Posting Personal Information Online
Employees should be aware of the dangers of posting their personal info on the internet.
ISM-0824 · ASD ISMAvoid Using Unauthorised Online File Services
Staff should not use online services for files unless approved to avoid security risks.
ISM-0829 · ASD ISMDetect Unauthorised RF Devices in Secure Areas
Use security measures to find and handle unauthorised RF devices in secure zones.
ISM-0831 · ASD ISMEnsure Proper Handling of Sensitive Media
Handle media carefully based on its sensitivity to keep information safe.
ISM-0835 · ASD ISMTOP SECRET Volatile Media Retains Classification After Sanitisation
Volatile media (memory that normally loses its contents when power is removed, such as RAM modules)
ISM-0836 · ASD ISMOverwriting EEPROM for Complete Data Sanitisation
Erase EEPROM data by overwriting it with random data and checking it to ensure it's properly wiped.
ISM-0839 · ASD ISMProhibit Outsourcing of Media Destruction
Do not allow external companies to destroy media with sensitive data.
ISM-0840 · ASD ISMCertified Services for Outsourced Media Destruction
Use certified services for destroying non-accountable material to ensure security and compliance wit
ISM-0843 · ASD ISMEnsure Workstation Security with Application Control
Application control is used to secure workstations by managing which programs can run.
ISM-0846 · ASD ISMPrevent Users Disabling, Bypassing or Exempting Application Control
Application control is a security feature that only lets approved software run on a computer, blocki
ISM-0853 · ASD ISMTerminate User Sessions and Restart Workstations Daily
Ensure that all user sessions end and computers are restarted every day.
ISM-0854 · ASD ISMAccess Restrictions for AUSTEO and AGAO Data
AUSTEO and AGAO data is only accessible via government-controlled systems within authorised faciliti
ISM-0861 · ASD ISMEnable DKIM Signing for Organisational Emails
Ensure emails from your organisation's domains use DKIM to verify authenticity and prevent forgery.
ISM-0863 · ASD ISMPrevent Installation of Unapproved Mobile Apps
Mobile devices block users from installing apps that are not approved by the organisation.
ISM-0864 · ASD ISMPrevent Modifications to Security Settings on Mobile Devices
Mobile devices ensure users cannot change or disable security features once set up.
ISM-0866 · ASD ISMEnsure Privacy While Viewing Data in Public
Don't look at sensitive data on mobile devices in public unless you can shield your screen from othe
ISM-0869 · ASD ISMEncrypt Storage on Mobile Devices
Mobile devices must use ASD-approved encryption for both internal and external storage.
ISM-0870 · ASD ISMSecure Storage and Handling of Mobile Devices
Ensure mobile devices are secure when not in use to prevent unauthorized access.
ISM-0871 · ASD ISMSupervise Mobile Devices During Active Use
Ensure mobile devices are watched carefully whenever they are in use to avoid loss or theft.
ISM-0874 · ASD ISMEnsure Internet Access via Organisation's Gateway
Mobile devices and desktop computers access the internet via an organisation's internet gateway rath
ISM-0888 · ASD ISMAnnual Review of Cyber Security Documentation
Cyber security documentation is reviewed at least annually and includes a 'current as at \[date\]' o
ISM-0912 · ASD ISMEstablish and Manage System Configuration Changes
Ensure systems have a plan for managing changes, including approvals and notifications for both rout
ISM-0917 · ASD ISMProcedures for Handling Malicious Code Infections
Systems with malware are isolated, scanned, cleansed, or restored to stop the infection.
ISM-0926 · ASD ISMEnsure Cables Are Not Salmon Pink or Red
Do not use salmon pink or red for non-classified, sensitive, or protected cables.
ISM-0931 · ASD ISMOff-hook Audio Protection Using Push-to-Talk Devices
In SECRET and TOP SECRET areas, special handsets or headsets are used to prevent unintended audio tr
ISM-0938 · ASD ISMSelect Secure-by-Design Committed Vendors
Choose vendors who prioritise secure design and development in their applications.
ISM-0947 · ASD ISMSanitise Media After Data Transfers Between Domains
Clean rewriteable media after transferring data between systems of different security levels.
ISM-0955 · ASD ISMImplementing Application Control Measures
Ensure applications are controlled using secure hashing, valid certificates, or designated paths.
ISM-0958 · ASD ISMImplement Domain Name Allow and Block Lists
Create a list of approved or blocked domains for secure web traffic management.
ISM-0961 · ASD ISMRestrict Active Content with Web Filters
Web filters block active content from unapproved websites.
ISM-0963 · ASD ISMImplementing Web Content Filters for Safety
Web filters help block harmful content from the internet.
ISM-0971 · ASD ISMUse OWASP Standards in Web Application Development
Developers must use OWASP standards for building secure web applications.
ISM-0974 · ASD ISMImplement Multi-factor Authentication for User Access
Unprivileged system users must use multi-factor authentication to log in to enhance security.
ISM-0988 · ASD ISMEnsure Accurate Time Source for Event Logs
Logs must use a reliable time source for accuracy and consistency.
ISM-0994 · ASD ISMUse ECDH for Secure Key Exchanges
ECDH is preferred over DH for secure data exchanges.
ISM-0998 · ASD ISMUsing Integrity Algorithms for IPsec Connections
Use specific algorithms for authenticating IPsec connections, preferring none if AES-GCM is used.
ISM-0999 · ASD ISMUse DH or ECDH for Secure Key Establishment
For IPsec connections, use DH/ECDH methods to securely establish keys with specific group sizes for
ISM-1000 · ASD ISMUtilising Perfect Forward Secrecy for IPsec
Use PFS to ensure past IPsec keys can't be used if current ones are compromised.
ISM-1006 · ASD ISMPrevent Unauthorised Access to Network Traffic
Security measures are in place to ensure that only authorised users can access network management sy
ISM-1013 · ASD ISMLimit Wireless Range with RF Shielding
RF shielding is used to control the wireless signal range and keep it limited to an organisation's s
ISM-1014 · ASD ISMImplement Individual Logins for Secure IP Phone Use
Ensure each user has a unique login when using IP phones for secret conversations.
ISM-1019 · ASD ISMDevelop a Denial of Service Response Plan
Create and maintain a plan to handle service disruptions for video calls and IP telephony.
ISM-1023 · ASD ISMNotify Parties of Blocked Emails
Notify people if their sent or received emails are blocked due to marking issues.
ISM-1024 · ASD ISMVerify Senders for Email Failure Notifications
Only verified senders get notified if their email cannot be delivered.
ISM-1026 · ASD ISMVerification of DKIM Signatures on Incoming Emails
Ensure that DKIM signatures on received emails are checked to identify legitimate sources.
ISM-1027 · ASD ISMConfigure Email Distribution Lists to Preserve DKIM Signatures
Ensure email lists don't invalidate DKIM signatures from external senders.
ISM-1028 · ASD ISMUse NIDS/NIPS for Gateway Network Security
Install systems at network gateways to monitor and protect against unauthorised access or threats fr
ISM-1030 · ASD ISMDeploy NIDS/NIPS for Gateway Traffic Monitoring
Install and configure systems to detect and alert on unauthorized network traffic past the main fire
ISM-1034 · ASD ISMDeploy HIPS or EDR on Critical and High-Value Servers
A host-based intrusion prevention system (HIPS) or endpoint detection and response (EDR) solution is
ISM-1036 · ASD ISMPlace Multifunction Devices Where Their Use Can Be Observed
Multifunction devices (combined printers, scanners, copiers and fax machines) are located in open, v
ISM-1037 · ASD ISMRegular Testing of Gateway Security Configurations
Gateways are tested every six months or after changes to ensure they meet security standards.
ISM-1053 · ASD ISMSecure Physical Access for Classified Equipment
Ensure physical security for critical equipment based on its classification.
ISM-1055 · ASD ISMDisable Insecure LAN Manager Authentication
Systems must disable outdated LAN Manager and NT LAN Manager authentication to enhance security.
ISM-1059 · ASD ISMEncrypt All Data Stored on Media Using ASD-Approved Cryptography
All data held on storage media must be encrypted using cryptography approved by the Australian Signa
ISM-1065 · ASD ISMReset Device Settings Before Media Sanitisation
Reset hidden and configuration settings on hard drives before erasing them to ensure nothing is over
ISM-1067 · ASD ISMSecure Erase for Non-Volatile Magnetic Media
Use secure erase plus software to fully overwrite data on hard drives, including hidden areas.
ISM-1071 · ASD ISMAssign System Ownership for Better Oversight
Every system should have a specific person responsible for managing it.
ISM-1073 · ASD ISMEnsure Provider Contracts for System Access
Service providers need a contract before accessing or managing your systems.
ISM-1074 · ASD ISMControlling Access to Critical IT Infrastructure
Ensure keys to server and communication rooms are securely managed.
ISM-1076 · ASD ISMSanitise Screen Burn-In With a Solid White Image
Televisions and computer monitors that show minor burn-in or image persistence must be sanitised by
ISM-1078 · ASD ISMDevelop and Maintain Telephone System Usage Policy
Create and keep a policy for how phones should be used within the organisation.
ISM-1079 · ASD ISMSeek Approval for High Assurance IT Repairs
Get ASD's approval before repairing sensitive IT systems.
ISM-1080 · ASD ISMUse AACA or High Assurance Algorithms for Data Encryption
Ensure that data at rest is encrypted using strong cryptographic algorithms like AACA for high secur
ISM-1082 · ASD ISMDevelop and Maintain Mobile Device Usage Policy
Ensure a policy is in place to guide how mobile devices are used in the organisation.
ISM-1083 · ASD ISMAdvise Personnel on Mobile Communication Sensitivity
Personnel are informed about what levels of classified communication are allowed on mobile devices.
ISM-1084 · ASD ISMTransporting Mobile Devices Securely
If you can't secure a mobile device, it must be carried in a security bag or similar for safe transp
ISM-1085 · ASD ISMEncrypt Sensitive Data Over Public Networks
Mobile devices must encrypt sensitive data sent over public networks using approved cryptography.
ISM-1088 · ASD ISMReport Potential Compromises of Mobile Devices Overseas
Inform your employer immediately if your mobile device is compromised or shows unusual behaviour whi
ISM-1089 · ASD ISMPrevent Lower Email Protective Marking Selection
Email reply or forward tools must not allow reducing security markings from the original.
ISM-1091 · ASD ISMChange Keying Material When Compromised
Change encryption keys if they are compromised to maintain security.
ISM-1095 · ASD ISMProper Labelling of Wall Outlet Boxes
Label wall outlet boxes with system, cable, and box identifiers for easy identification.
ISM-1096 · ASD ISMEnsure Proper Labelling of Cables for Identification
Label cables on both ends for easy identification and inspection of where they start and end.
ISM-1098 · ASD ISMTerminate Cable Systems at Cabinet Boundaries
In TOP SECRET areas, cables connecting to cabinets outside server rooms stop at the cabinet edge.
ISM-1100 · ASD ISMTerminating TOP SECRET Cables in Cabinets
TOP SECRET cables must be connected only in designated TOP SECRET cabinets for security purposes.
ISM-1101 · ASD ISMTerminate Cabling Closely in Top Secret Areas
In TOP SECRET areas, ensure cables are terminated very close to cabinets for security.
ISM-1102 · ASD ISMTerminate Cable Reticulation Close to Cabinet
Ensure cables are ended near cabinets to improve connection and organisation.
ISM-1103 · ASD ISMTerminate Cables Outside Cabinets in Secure Areas
In top secret areas, cables must end at the cabinet's edge unless in server or communications rooms.
ISM-1105 · ASD ISMEnsure Wall Outlets Have Appropriate Cable Security
Wall outlets for SECRET and TOP SECRET should only have cables that match these classifications.
ISM-1107 · ASD ISMColour Restrictions for Wall Outlet Boxes
Wall outlet boxes must not be coloured salmon pink or red to ensure proper classification.
ISM-1109 · ASD ISMEnsure Clear Plastic Covers for Wall Outlets
Wall outlet covers must be transparent plastic to visually inspect without obstruction.
ISM-1111 · ASD ISMEnsure Fibre-Optic Cables Replace Copper Cables
Use fibre-optic cables instead of copper to improve data security and efficiency in cabling infrastr
ISM-1112 · ASD ISMEnsure Cables Are Inspectable Every Five Metres
Cables outside TOP SECRET areas should be easy to inspect every five metres for security checks.
ISM-1114 · ASD ISMEnsure Separation in Cable Reticulation Systems
Cables and conduits in shared spaces must be visibly separated or partitioned to ensure safety and o
ISM-1115 · ASD ISMEnsure Cables Use Conduits in Walls
Ensures cables in walls are protected by running through flexible or plastic conduits.
ISM-1116 · ASD ISMEnsure Separation Between Top Secret and Other Cabinets
Ensure there's a visible gap between top secret and other cabinets for security reasons.
ISM-1119 · ASD ISMEnsure Cables in TOP SECRET Areas are Inspectable
Cables in highly secure areas must be checked along their entire length for any issues.
ISM-1122 · ASD ISMSecure TOP SECRET Cable Wall Exits
Ensure TOP SECRET cables that pass through walls to lower security areas are protected by conduits a
ISM-1123 · ASD ISMEnsure UPS Powers All Top Secret IT Equipment
All Top Secret IT equipment must use power from a board with a UPS to maintain functionality during
ISM-1130 · ASD ISMUse Enclosed Systems for Shared Facility Cables
Ensure cables in shared buildings are placed in closed pathways to prevent tampering.
ISM-1133 · ASD ISMPrevent Installation of TOP SECRET Cables in Shared Walls
In shared buildings, do not place TOP SECRET cables within walls shared with other spaces.
ISM-1137 · ASD ISMRequest Risk Assessment for Emanation Security
System owners must ask for a security risk assessment when setting up SECRET or TOP SECRET systems.
ISM-1139 · ASD ISMRequire Latest Version of TLS for Security
Ensure only the latest TLS version is used to secure connections.
ISM-1143 · ASD ISMDevelop and Maintain Patch Management Procedures
Ensure patches for systems are regularly updated and processes are in place to manage this.
ISM-1145 · ASD ISMApply Privacy Filters to Protect Device Screens
Privacy filters help keep sensitive information on mobile screens private in public spaces.
ISM-1146 · ASD ISMSeparate Personal and Work Accounts for Online Services
Keep your personal and work user accounts separate when using online services.
ISM-1151 · ASD ISMVerify Email Authenticity Using SPF
SPF helps confirm if an email really comes from who it claims to, preventing fake emails.
ISM-1157 · ASD ISMUse Evaluated Diodes to Control Unidirectional Gateway Data Flow
Unidirectional gateways between networks must use evaluated diodes to control the direction of data
ISM-1158 · ASD ISMHigh Assurance Evaluation for Network Diodes
Diodes ensure secure, one-way data flow between secret and other networks.
ISM-1160 · ASD ISMUse NSA-evaluated Degaussers for Media Destruction
Only use NSA-approved degaussers to securely erase data from storage media.
ISM-1163 · ASD ISMContinuous Monitoring Plan to Find and Fix Vulnerabilities
Each system must have a written continuous monitoring plan that covers three things: (1) running sec
ISM-1164 · ASD ISMUse Clear Plastic for Shared Facility Cabling Covers
In shared spaces, use clear plastic for cables on ceilings, floors, and walls to ensure visibility.
ISM-1171 · ASD ISMBlock Direct IP Access to Websites
Web filters prevent website access if using an IP address instead of a domain name.
ISM-1173 · ASD ISMUse Multi-Factor Authentication for Privileged Users
Privileged users must verify their identity using multiple forms of identification to log into syste
ISM-1175 · ASD ISMRestrict Privileged Users from Internet Access
Privileged accounts can't access the internet or web services unless explicitly allowed.
ISM-1178 · ASD ISMLimit Network Documentation for Third Parties
When sharing network details, only provide what's needed for others to fulfil their contracts.
ISM-1181 · ASD ISMSegregate Networks by Server Criticality
Networks have separate zones based on the importance of servers, services, and data.
ISM-1182 · ASD ISMImplement Network Traffic Control Measures
Restrict network traffic flow to ensure it only supports business needs.
ISM-1183 · ASD ISMImplement Hard Fail SPF Records for Email Security
Use a strict SPF record to ensure only authorised servers send emails on behalf of the organisation.
ISM-1186 · ASD ISMEnsure IPv6 Network Security Appliances Are Used
Use network security devices that support IPv6 to protect networks using IPv6 or both IPv6 and IPv4.
ISM-1187 · ASD ISMCheck Data for Improper Markings Before Export
When exporting data manually, ensure it doesn't have improper protective markings.
ISM-1192 · ASD ISMInspecting and Filtering Data with Gateways
Gateways check and filter data to ensure only safe data passes through the network.
ISM-1195 · ASD ISMEnforce Policy with Evaluated Mobile Device Management
Use certified management solutions to ensure mobile devices follow security policies.
ISM-1196 · ASD ISMKeep Mobile Devices Undiscoverable via Bluetooth
Bluetooth on mobile devices is only discoverable during pairing to protect sensitive information.
ISM-1198 · ASD ISMSecure Bluetooth Pairing for Mobile Devices
Ensure Bluetooth connections for devices are only made with intended, authorised equipment.
ISM-1199 · ASD ISMRemove Unnecessary Bluetooth Pairings on Devices
Remove Bluetooth pairings on certain mobile devices when they are no longer needed.
ISM-1200 · ASD ISMSecure Bluetooth Pairing for Mobile Devices
Use secure methods when pairing Bluetooth on sensitive mobile devices, like numeric comparison.
ISM-1203 · ASD ISMRisk Assessment for System Security
System owners work with authorising officers to assess threats and risks for each system.
ISM-1211 · ASD ISMSystem Admin Activities Follow Change Management Plan
Admins follow a defined plan for system changes to ensure proper management.
ISM-1213 · ASD ISMAnalyse Network Traffic Post-Intrusion Remediation
Capture and analyse network traffic for a week to ensure hackers are removed after an intrusion.
ISM-1216 · ASD ISMEnsure Correct Labelling of Non-conformant Cables
Non-standard cable colours for SECRET and TOP SECRET must be labelled correctly at inspection points
ISM-1217 · ASD ISMRemove Identifying Labels from IT Equipment Before Disposal
Before throwing away IT equipment, remove any labels that show ownership or use.
ISM-1218 · ASD ISMSanitise Overseas IT Equipment Handling Sensitive Data
Overseas IT equipment with sensitive data must be sanitised where it is located.
ISM-1219 · ASD ISMInspect and Destroy MFD Print Drums and Image Transfer Rollers
Inspect multifunction device print drums and image transfer rollers, and destroy any that still hold
ISM-1220 · ASD ISMInspect and Destroy Retained Images on Printer Platens
Check printer surfaces, and destroy them if they have any leftover text or images.
ISM-1221 · ASD ISMCheck Printers and MFDs for Trapped Pages
Printers and multifunction devices are checked to confirm no printed pages remain trapped in the pap
ISM-1222 · ASD ISMDestroy Unsanitised Televisions and Monitors
Televisions and monitors that can't be cleaned of data are to be physically destroyed.
ISM-1223 · ASD ISMMethods for Sanitising Network Device Memory
Network device memory is cleaned by following specific guidance or doing a reset and reinstalling fi
ISM-1227 · ASD ISMRandomly Generate User Account Credentials
User account passwords must be created randomly to enhance security.
ISM-1228 · ASD ISMAnalyse Cyber Security Events Promptly
Timely analysis of security events to spot incidents.
ISM-1233 · ASD ISMUse IKE Version 2 for IPsec Key Exchange
Ensure secure IPsec connection by using IKE version 2 for exchanging keys.
ISM-1234 · ASD ISMProtect Email Systems with Content Filtering
Checks emails for harmful content to keep systems safe.
ISM-1235 · ASD ISMRestrict User Application Extensions
Limit application extensions to those approved by the organisation.
ISM-1236 · ASD ISMBlocking Malicious and Anonymous Domain Names
Web filters block known harmful domains and those registered anonymously or for free.
ISM-1237 · ASD ISMImplement Web Content Filters for Outbound Traffic
Use web filters on outgoing internet traffic to block unsuitable content where necessary.
ISM-1238 · ASD ISMIncorporate Threat Modelling in Software Development
Use threat modelling to identify potential risks when developing software.
ISM-1239 · ASD ISMEnsure Use of Robust Web Application Frameworks
Develop web apps using strong frameworks to enhance security.
ISM-1240 · ASD ISMEnsure Input Validation and Sanitisation for Internet Data
All internet-received inputs for software must be validated and cleaned to prevent security issues.
ISM-1241 · ASD ISMEnsuring Secure Web Application Output Encoding
Web applications must correctly encode all their outputs to prevent security risks.
ISM-1243 · ASD ISMDevelop and Verify Database Register
Maintain an up-to-date list of databases and check it regularly to ensure accuracy.
ISM-1245 · ASD ISMRemove Temporary Files After Server Installation
Ensure temporary files are deleted after installing server applications to maintain system security.
ISM-1246 · ASD ISMApply Strict Server Application Hardening Guidelines
Servers are secured using the most restrictive guidance from ASD and vendors to protect against vuln
ISM-1247 · ASD ISMDisable or Remove Unneeded Server Features
Remove unnecessary accounts and features from servers to enhance security.
ISM-1249 · ASD ISMLimit Server Application User Privileges
Server apps must run separately with only the necessary permissions to operate.
ISM-1250 · ASD ISMLimit Server Application User Account Privileges
Server applications have restricted user account access to the server's file system.
ISM-1255 · ASD ISMRestrict Database User Access Based on Duties
Users can only access or change database information if it's part of their job.
ISM-1256 · ASD ISMImplement File-Based Access Controls for Databases
Use file permissions to safeguard database files from unauthorised access.
ISM-1260 · ASD ISMSecure Server Applications by Changing Default Credentials
Change or remove default user accounts and passwords in server apps to enhance security from the sta
ISM-1263 · ASD ISMEnforce Unique Accounts for Server Administration
Administrators must use unique accounts to manage each server application.
ISM-1268 · ASD ISMEnforce Need-to-Know Access in Databases
Only authorised users can access database contents by using specific privileges, roles, and techniqu
ISM-1269 · ASD ISMEnsure Databases and Web Servers are Separated
Databases and web servers should be kept separate to enhance security.
ISM-1270 · ASD ISMSeparate Network Segments for Database Servers
Databases should be on a different network than user computers to enhance security.
ISM-1271 · ASD ISMRestrict Network Access to Database Servers
Database server communications are limited to necessary network resources only.
ISM-1272 · ASD ISMDisable Database Networking for Local Access
If the database is only accessed locally, its network connection must be disabled or set to local on
ISM-1273 · ASD ISMSegregate Environments for Database Servers
Keep development and production database servers separate to ensure secure operations.
ISM-1274 · ASD ISMEnsure Non-Production Databases Match Production Security
Production data can only be used in non-production areas if they are secured equally as well.
ISM-1275 · ASD ISMEnsure Secure Database Queries in Software
Checks ensure database queries from software are legitimate and correctly formatted.
ISM-1276 · ASD ISMUse Safe Database Query Methods
Software should use parameterised queries or stored procedures to safely access databases.
ISM-1277 · ASD ISMEncrypt Database and Web Server Communications
Data exchanged between database and web servers must use approved encryption methods.
ISM-1278 · ASD ISMMinimise Database Error Information in Software
Software should reveal minimal database structure details in error messages.
ISM-1284 · ASD ISMEnsure Content Validation for Gateway Files
Check files coming in and out of gateways to ensure they meet security standards.
ISM-1286 · ASD ISMEnsure Content Conversion at Gateways
Files going through gateways must be converted to ensure security and compatibility.
ISM-1287 · ASD ISMEnsure Gateway and CDS File Content Sanitisation
Files passing through gateways or CDSs are cleaned to remove harmful content.
ISM-1288 · ASD ISMAntivirus Scanning of Gateway Files
Files going through gateways are checked with several antivirus programs for safety.
ISM-1289 · ASD ISMUnpack Archive Files for Content Filtering at Gateways
Archive files moving through gateways or Cross Domain Solutions are unpacked first so their contents
ISM-1290 · ASD ISMControlled Unpacking of Archive Files for Filtering
Ensure unpacked archive files do not disrupt system filters or cause unavailability.
ISM-1293 · ASD ISMDecrypt Encrypted Files for Content Filtering
Encrypted files must be decrypted to check their content when transferred through gateways.
ISM-1294 · ASD ISMPartial Monthly Verification of Data Transfer Logs
Data transfer logs are checked monthly to ensure some accuracy and compliance.
ISM-1296 · ASD ISMProtect Network Devices in Public Areas
Ensure network devices in public areas are secure from damage and unauthorised access.
ISM-1297 · ASD ISMSeek Legal Advice for Personal Device Access
Consult lawyers before allowing personal devices to access organisation's systems or data to prevent
ISM-1298 · ASD ISMAdvise Personnel on Overseas Mobile Device Security
Inform staff about privacy and security risks when taking mobile devices abroad.
ISM-1299 · ASD ISMPersonnel Awareness for Secure Mobile Device Usage
This guideline advises on secure mobile device use to prevent data theft or compromise.
ISM-1300 · ASD ISMMobile Device Security After Overseas Travel
Upon returning from overseas, clean your devices, reset any lost credentials, and report any securit
ISM-1304 · ASD ISMSecure Network Devices by Changing Default Credentials
During setup, change or remove default login details for network devices to enhance security.
ISM-1311 · ASD ISMPrevent Use of Insecure SNMP Versions on Networks
Avoid using SNMP versions 1 and 2, as they are insecure for network management.
ISM-1312 · ASD ISMChanging Default SNMP Community Strings on Devices
To enhance security, change default SNMP passwords and disable write access on network devices.
ISM-1314 · ASD ISMEnsure Wireless Devices are Wi-Fi Alliance Certified
All wireless devices must have Wi-Fi Alliance certification for security standards.
ISM-1315 · ASD ISMDisable Wireless Network Administrative Interfaces
Ensure that administrative access to wireless routers cannot be done through wireless connections.
ISM-1316 · ASD ISMEnsure Default Wireless SSIDs Are Changed
Change default wireless network names to enhance security.
ISM-1317 · ASD ISMSecure Naming of Non-Public Wireless Networks
Ensure non-public WiFi network names (SSIDs) don't reveal info about the organisation or location.
ISM-1318 · ASD ISMKeep SSID Broadcasting Enabled on Wireless Access Points
SSID broadcasting must be left enabled on wireless access points and not disabled, because hiding th
ISM-1319 · ASD ISMAvoid Static IP Addressing on Wireless Networks
Don't use fixed IP addresses for devices on wireless networks to enhance security.
ISM-1320 · ASD ISMAvoid Using MAC Filtering for Wireless Access Control
Do not use MAC address filtering to control devices connecting to your wireless network.
ISM-1321 · ASD ISMImplement EAP-TLS for Secure Wireless Authentication
Use secure EAP-TLS with certificates to authenticate devices and disable other methods.
ISM-1322 · ASD ISMAssessing 802.1X Components in Wireless Networks
Use evaluated devices and servers for secure wireless network authentication.
ISM-1323 · ASD ISMRequiring Certificates for Wireless Network Access
Devices and users must have certificates to connect to wireless networks.
ISM-1324 · ASD ISMCertificate Generation for Secure Authentication
Certificates must be created using approved secure tools to verify identities.
ISM-1327 · ASD ISMSecure Certificates for Network Authentication
Certificates must be secured using access controls, encryption, and authentication to prevent unauth
ISM-1330 · ASD ISMLimit PMK Caching Duration on Wireless Networks
Ensure that stored authentication data for networks isn't kept for more than a day.
ISM-1332 · ASD ISMEnsure Wireless Traffic is Secure with WPA3-Enterprise
Use WPA3-Enterprise 192-bit mode to secure information transferred over wireless networks.
ISM-1334 · ASD ISMEnsure Frequency Separation in Wireless Networks
Wireless networks should use different frequencies to avoid interference with each other.
ISM-1335 · ASD ISMEnabling 802.11w to Protect Wireless Management Frames
Ensure wireless networks use the 802.11w standard to secure management frames from tampering.
ISM-1338 · ASD ISMUse Lower-Powered Wireless Access Points for Coverage
Deploy many low-power wireless access points to cover an area instead of few high-power ones.
ISM-1341 · ASD ISMImplement HIPS or EDR on Workstations
Ensure your computers are protected by constantly monitoring for threats.
ISM-1359 · ASD ISMEstablish and Maintain Removable Media Policy
Organisations must create and uphold a policy for using removable media safely.
ISM-1361 · ASD ISMUse Approved Equipment for Media Destruction
Use officially approved devices for destroying media to ensure proper disposal.
ISM-1364 · ASD ISMSeparate VLANs by Security Domains
Ensure VLANs from different security domains use separate network interfaces to avoid cross-traffic.
ISM-1366 · ASD ISMEnsure Timely Security Updates for Mobile Devices
Apply security updates to mobile devices immediately upon availability to prevent security breaches.
ISM-1369 · ASD ISMEnsure TLS Connections Use AES-GCM Encryption
Use AES-GCM to securely encrypt information sent over TLS connections.
ISM-1370 · ASD ISMEnsure Only Server-Initiated TLS Renegotiation
Only the server can start secure renegotiation for TLS connections to maintain security.
ISM-1372 · ASD ISMSecure Key Establishment Using DH or ECDH in TLS
Use DH or ECDH methods to securely establish keys for encrypted internet connections.
ISM-1373 · ASD ISMEnsure TLS Connections do not use Anonymous DH
Do not use Anonymous Diffie-Hellman for secure connections to prevent security vulnerabilities.
ISM-1374 · ASD ISMUse SHA-2 Certificates for Secure TLS Connections
Use secure certificates to prevent eavesdropping on data sent over the internet.
ISM-1375 · ASD ISMUse SHA-2 for Secure TLS Connections
TLS connections must use SHA-2 for better security, acting as a key and message verifier.
ISM-1380 · ASD ISMUse Separate Privileged and Unprivileged Environments
Privileged users should work in distinct environments to increase security and reduce risks.
ISM-1385 · ASD ISMSegregation of Administrative Infrastructure from Networks
Administrative systems are isolated from the main network and internet to enhance security.
ISM-1386 · ASD ISMRestrict Network Management Traffic Origin
Only authorised admin systems should manage network settings, ensuring security and control.
ISM-1387 · ASD ISMUse Jump Servers for Administrative Activities
Ensure all admin tasks are done through safer, intermediary servers to enhance security.
ISM-1389 · ASD ISMAnalyse Executable Files in Sandboxes
Files coming through gateways are tested in a safe environment to catch suspicious activities.
ISM-1392 · ASD ISMRestrict File Modifications via Path Rules
Only certain users can change files and folders as allowed by system rules.
ISM-1395 · ASD ISMEnsuring Data Protection by Service Providers
Service providers must protect any entrusted data adequately.
ISM-1400 · ASD ISMEnforce Data Separation on Personal Devices
Ensure work data and personal data are kept separate on employees' personal devices.
ISM-1401 · ASD ISMImplement Multi-Factor Authentication for Security
Users need to use multiple identification methods to ensure secure access.
ISM-1402 · ASD ISMProtecting Stored Credentials with Security Measures
Store credentials securely using a password manager, hardware module, or by enhancing them with tech
ISM-1403 · ASD ISMLock Accounts After Five Failed Logon Attempts
User accounts must lock after no more than five failed login attempts, with the lockout lasting inde
ISM-1404 · ASD ISMDisabling Inactive User Access After 45 Days
If a user doesn't use their system access for 45 days, it's disabled to keep the system secure.
ISM-1405 · ASD ISMImplement a Centralised Event Logging Facility
Ensure all event logs are collected and managed in one central location for analysis and security mo
ISM-1406 · ASD ISMUse SOEs for Workstations and Servers
Use pre-configured software setups for all computers and servers to ensure consistency and security.
ISM-1407 · ASD ISMEnsure Use of Current OS Versions
Use the latest or previous operating system version to keep systems up-to-date.
ISM-1408 · ASD ISMUse 64-bit Operating Systems Where Supported
Use 64-bit operating systems if they are supported by your computer.
ISM-1409 · ASD ISMImplement Restrictive OS Hardening Guidelines
Ensure operating systems follow strictest security guidelines from ASD or vendors.
ISM-1412 · ASD ISMWeb Browser Hardening with Strict Guidelines
Web browsers must be set with the strictest security settings per ASD and vendor guides.
ISM-1416 · ASD ISMImplement Firewalls to Control Network Connections
Use software firewalls to control what apps and services can connect to your network.
ISM-1417 · ASD ISMEnsure Antivirus Protection on Workstations and Servers
Install antivirus software on all computers and servers to detect and prevent malware and ransomware
ISM-1418 · ASD ISMDisable Unnecessary Removable Media Access
If you don't need to use removable devices for work, access to them should be blocked.
ISM-1419 · ASD ISMSoftware Development in Development Environments
Software development should only be done in dedicated development environments.
ISM-1420 · ASD ISMEnsure Non-Production Security Matches Production
Data from live systems can't be used in test setups unless test setups are just as secure.
ISM-1422 · ASD ISMPrevent Unauthorised Access to Software Source
Ensure only authorised users can access the main software source to keep it secure.
ISM-1424 · ASD ISMEnsure Web Security Through Response Headers
Web servers use security headers to protect web applications from attacks.
ISM-1427 · ASD ISMPrevent IP Source Address Spoofing in Gateways
Gateways block fake IP addresses to protect network entries.
ISM-1428 · ASD ISMDisable IPv6 Tunnelling Unless Necessary
IPv6 tunnelling on network devices should be disabled unless absolutely needed.
ISM-1429 · ASD ISMBlock IPv6 Tunnelling at Externally Connected Network Boundaries
Configure your network security appliances to block IPv6 tunnelling traffic at every point where you
ISM-1430 · ASD ISMConfigure IPv6 Addresses with DHCPv6 in Stateful Mode
Use DHCPv6 to manage and log IPv6 addresses centrally for enhanced network organisation.
ISM-1431 · ASD ISMStrategies for Mitigating Denial-of-Service Attacks
Discuss with cloud providers how to handle costs and actions for denial-of-service attacks to mainta
ISM-1432 · ASD ISMProtect Online Services from Domain Hijacking
Ensure online service domain security by locking registration and verifying details.
ISM-1436 · ASD ISMSegregate Critical Services to Prevent DoS Attacks
Critical online services are kept separate to reduce the risk of service disruption from attacks.
ISM-1437 · ASD ISMUtilising Cloud Providers for Hosting Online Services
Online services are hosted using cloud service providers for improved service continuity.
ISM-1438 · ASD ISMEnsure High Availability by Using CDNs
Use CDNs to keep websites running smoothly and available when needed.
ISM-1439 · ASD ISMRestrict IP Disclosure in CDNs
Avoid sharing web server IPs and limit access to them by CDNs and authorised networks for security.
ISM-1446 · ASD ISMUse Approved Elliptic Curves for Encryption
Ensure secure cryptography by using NIST-approved elliptic curves for encryption.
ISM-1448 · ASD ISMUse Ephemeral DH or ECDH for TLS Key Establishment
Use temporary DH or ECDH keys for secure TLS connections.
ISM-1449 · ASD ISMProtect SSH Private Keys with Passwords or Encryption
Ensure SSH keys have a password or are encrypted to prevent unauthorised access.
ISM-1450 · ASD ISMRestricting Devices in Top Secret Areas
Do not use microphones or webcams with non-Top Secret devices in Top Secret areas.
ISM-1451 · ASD ISMDocument Data Ownership in Service Contracts
Ensure contracts with service providers clearly state who owns the data.
ISM-1452 · ASD ISMPerform Supply Chain Risk Assessments for System Suppliers
Assess each supplier of operating systems, applications, IT and OT equipment, and services to unders
ISM-1453 · ASD ISMEnsure PFS is Enabled for TLS Connections
TLS connections must be set up to protect past data even if the server's private key is compromised.
ISM-1454 · ASD ISMEnhancing Security with Encrypted RADIUS Communications
Ensure RADIUS server communications are encrypted for increased security.
ISM-1457 · ASD ISMEvaluate Peripheral Switches for Security Domains
Ensure devices used to share equipment between classified systems meet high security standards.
ISM-1460 · ASD ISMSecure By Design Vendor Isolation Mechanisms
Use software isolation tools from vendors committed to secure design principles and practices.
ISM-1461 · ASD ISMSame Classification and Security Domain for Shared Isolation Hosts
When software isolation shares one physical server for SECRET or TOP SECRET work, the server and eve
ISM-1467 · ASD ISMUse Latest Releases of User Applications
Ensure all user applications like email and web browsers are updated to their latest versions.
ISM-1470 · ASD ISMDisable Unneeded Accounts, Components, Services and Application Functionality
Unneeded user accounts, components, services and functionality within user applications must be disa
ISM-1471 · ASD ISMUtilise Publisher and Product Names in App Control
Use known publisher and product names to control which applications can run on a system.
ISM-1478 · ASD ISMCISO Management of Cyber Security Compliance
The CISO is responsible for managing the organisation's cyber security and ensuring compliance with
ISM-1479 · ASD ISMMinimise Server-to-Server Communication
Servers should reduce interaction with each other to enhance security.
ISM-1480 · ASD ISMEnsure High Assurance for Peripheral Switches
Peripheral switches used between classified and unclassified systems must undergo a thorough securit
ISM-1482 · ASD ISMEnsure Separation of Classified and Personal Data on Devices
Organisation devices must keep classified and personal data separate to protect classified informati
ISM-1483 · ASD ISMUse Latest Release of Internet-Facing Server Applications
Ensure that internet-facing server applications always use the latest software version.
ISM-1485 · ASD ISMPrevent Web Browsers from Processing Ads
Block web browsers from displaying online ads to enhance security.
ISM-1486 · ASD ISMRestrict Java Processing in Web Browsers
Ensure web browsers are set to block Java from running online.
ISM-1487 · ASD ISMRestrict Macro Editing to Privileged Users
Only authorised users can edit trusted Microsoft Office macros to prevent malicious code.
ISM-1488 · ASD ISMBlocking Internet-Originating Macros in Office Files
Microsoft Office blocks macros from files downloaded from the internet to enhance security.
ISM-1489 · ASD ISMPrevent Users from Changing Office Macro Security Settings
Users cannot alter the security settings for Microsoft Office macros, ensuring consistent protection
ISM-1490 · ASD ISMImplement Application Control on Internet-Facing Servers
Ensure application security by using controls on servers exposed to the internet.
ISM-1491 · ASD ISMPrevent Script Execution by Unprivileged Users
Prevent users without admin rights from running scripts or commands that could pose security risks.
ISM-1492 · ASD ISMEnable Exploit Protection in Operating Systems
Ensure operating system settings are adjusted to block potential attacks.
ISM-1493 · ASD ISMMaintain and Verify Software Registers
Ensure software lists for all IT equipment are up-to-date and regularly checked.
ISM-1501 · ASD ISMReplace Unsupported Operating Systems
Replace operating systems that are no longer supported to maintain security.
ISM-1502 · ASD ISMBlock Inbound External Email Spoofing Internal Domains
Inbound email that arrives over an external connection with a source address using one of the organi
ISM-1504 · ASD ISMImplement Multi-factor Authentication
Users need multiple forms of ID to access sensitive online services, enhancing security.
ISM-1505 · ASD ISMImplement Multi-factor Authentication for Data Repositories
Require multi-factor authentication for accessing data storage to enhance security.
ISM-1506 · ASD ISMDisable SSH Version 1 for Security
SSH version 1 is turned off to improve security for SSH connections.
ISM-1507 · ASD ISMEnsure Requests for Privileged Access are Verified
Requests for special system access are checked before approval to prevent unauthorized use.
ISM-1508 · ASD ISMLimit Privileged Access to Essential Duties Only
Only grant system privileges necessary for users to perform their job roles.
ISM-1509 · ASD ISMLog Privileged Access Events Centrally for Monitoring
Keep records of high-level system access in one place to monitor and respond to potential issues.
ISM-1510 · ASD ISMDevelop and Maintain a Digital Preservation Policy
Organisations must create and keep up-to-date a policy for preserving digital information.
ISM-1511 · ASD ISMConduct and Maintain Regular Data Backups
Ensure data backups are done based on business importance and kept for future recovery needs.
ISM-1515 · ASD ISMTest Backup Restoration During Disaster Recovery
Backups should be restored regularly to ensure data can be retrieved in case of a disaster.
ISM-1517 · ASD ISMMicroform Destruction Using Fine Powder Method
Machines destroy microfiche by turning them into fine powder so no more than five characters remain
ISM-1520 · ASD ISMEmployment Screening for Gateway Administrators
Ensure appropriate screening and security clearance for gateway admins based on system sensitivity.
ISM-1521 · ASD ISMUse Protocol Breaks to Separate Network Layers
Ensure data flows are separated by breaking protocols at each network level for security.
ISM-1522 · ASD ISMEnsure CDSs Separate Upward and Downward Data Paths
CDSs have independent security controls for data going both up and down between networks.
ISM-1523 · ASD ISMRegular Assessment of Security Events in CDS
Every three months, security events are reviewed to ensure CDS are working correctly and follow data
ISM-1524 · ASD ISMEnsure Rigorous Testing of Content Filters
Content filters need thorough testing to make sure they work properly and can't be bypassed.
ISM-1525 · ASD ISMRegister Systems with Authorising Officers
System owners must register their systems with the designated authorising officer for oversight.
ISM-1526 · ASD ISMContinuously Monitor System Security and Manage Risks
System owners continuously monitor the security of each system and manage the associated cyber threa
ISM-1528 · ASD ISMUtilising Evaluated Firewalls for Network Security
Firewalls are installed to separate the organisation's networks from the public internet, enhancing
ISM-1529 · ASD ISMLimit Cloud Services to Community or Private for SECRETS
For SECRET or TOP SECRET services, only community or private clouds should be used to ensure securit
ISM-1530 · ASD ISMSecure Classified Equipment in Suitable Security Containers
Keep classified IT equipment in secure containers based on their classification and location's secur
ISM-1532 · ASD ISMAvoid Using VLANs for Network Separation
Do not use VLANs to separate internal networks from the public internet.
ISM-1533 · ASD ISMEstablish Mobile Device Management Policies
Create and maintain policies to manage and control mobile devices within the organisation.
ISM-1534 · ASD ISMRemove and Destroy Printer and MFD Ribbons
Printer ribbons in printers and multifunction devices are removed and destroyed to prevent recovery
ISM-1535 · ASD ISMPrevent Unsuitable Foreign Data Exports
Ensure processes are in place to block export of sensitive data to foreign systems.
ISM-1536 · ASD ISMCentrally Log User-Initiated Database Queries and Errors
All user-initiated database queries made by software, along with any resulting crash or error messag
ISM-1537 · ASD ISMLog Security-Relevant Database Events Centrally
Keep track of important activities in databases, like access, changes, and issues, to ensure securit
ISM-1540 · ASD ISMConfiguring DMARC for Email Security
Ensure emails from your domains are legitimate by rejecting ones that fail DMARC checks.
ISM-1542 · ASD ISMDisable OLE in Microsoft Office for Security
Microsoft Office is set to block OLE, a feature that could pose security risks.
ISM-1543 · ASD ISMRegister for RF and IR Devices in Secret Areas
Maintain a register of RF and IR devices for secure areas to ensure authorised use.
ISM-1544 · ASD ISMImplement Microsoft's Application Blocklist
Organisations must use Microsoft's blocklist to stop unauthorised applications from running.
ISM-1546 · ASD ISMEnsure User Authentication Before System Access
Verify user identities before they can access any system.
ISM-1547 · ASD ISMDevelop and Maintain Data Backup Procedures
Ensure data backup processes and procedures are created, used, and kept up to date.
ISM-1548 · ASD ISMDevelop and Maintain Data Restoration Processes
Organisations must create and keep updated processes for restoring data.
ISM-1549 · ASD ISMDevelop and Maintain Media Management Policy
Create and update a policy to manage media handling effectively.
ISM-1550 · ASD ISMDevelop and Maintain IT Equipment Disposal Procedures
Ensure IT equipment is disposed of properly by following established procedures.
ISM-1551 · ASD ISMDevelop and Maintain IT Equipment Management Policy
Organisations must create and sustain a policy for managing IT equipment.
ISM-1552 · ASD ISMSecure Web Content with HTTPS Only
Ensure all web content is delivered over a secure HTTPS connection.
ISM-1553 · ASD ISMDisable TLS Compression for Security
TLS connections should not use compression to prevent security risks.
ISM-1554 · ASD ISMGuidelines for Using Mobile Devices Abroad
Use specific work devices and avoid personal phones when going to high-risk countries.
ISM-1555 · ASD ISMPrepare Mobile Devices Before Overseas Travel
Before travelling overseas, ensure mobile devices are recorded, updated, reduced to essentials, and
ISM-1556 · ASD ISMSecurity Measures After Overseas Travel with Mobile Devices
Reset credentials and watch for suspicious account activity after travel to high-risk areas.
ISM-1557 · ASD ISMEnsure Strong Passwords for SECRET Systems
Passwords for SECRET systems must be at least 17 characters long to enhance security.
ISM-1558 · ASD ISMEnsure Secure Construction of Passwords
Passwords must not use predictable sequences, like quotes or sentences, and must meet minimum word c
ISM-1559 · ASD ISMMinimum Password Length for Secure Systems
Passwords for secure systems should have at least 6 characters to enhance security.
ISM-1560 · ASD ISMEnsure Strong Passwords for SECRET System Authentication
Passwords for SECRET systems using multi-factor authentication must be at least 8 characters.
ISM-1561 · ASD ISMEnsure Strong Passwords for TOP SECRET Systems
TOP SECRET systems must use passwords of at least 10 characters for added security.
ISM-1562 · ASD ISMSecure Video Conferencing and Telephony Systems
Ensure video and IP telephony systems are secured against threats.
ISM-1563 · ASD ISMGenerate Comprehensive Security Assessment Reports
Create a report detailing the scope, weaknesses, risks, and controls of a system after assessment.
ISM-1564 · ASD ISMDevelop Plan of Action Post Security Assessment
After assessing security, system owners create a plan to address and resolve issues.
ISM-1565 · ASD ISMAnnual Training for Privileged Users
Privileged users receive yearly customised cyber security training.
ISM-1566 · ASD ISMCentral Logging of Unprivileged System Access
System logs keep track of unprivileged user actions to monitor access and security.
ISM-1567 · ASD ISMAvoid High-Risk Suppliers in Cyber Supply Chain
Suppliers considered high risk are not chosen to ensure the security of the supply chain.
ISM-1568 · ASD ISMEnsure Security Commitment from Suppliers
Buy IT and OT products only from suppliers who show they care about product security.
ISM-1569 · ASD ISMDocument and Share a Supplier Customer Shared Responsibility Model
Create, write down and share a shared responsibility model so suppliers and customers each know whic
ISM-1570 · ASD ISMRegular IRAP Assessment of Cloud Service Providers
Cloud service providers must undergo an IRAP review at least every 24 months.
ISM-1571 · ASD ISMVerify Security Compliance in Service Contracts
Contracts with service providers must include clauses that allow security compliance checks.
ISM-1572 · ASD ISMDocument Service Provider Data Handling and Change Notifications
Ensure service contracts specify data regions and notify configuration changes ahead of time.
ISM-1573 · ASD ISMLog Access Documentation with Service Providers
Ensure contracts specify how organisations can access logs about their data from service providers.
ISM-1574 · ASD ISMData Portability in Service Contracts
Ensure service contracts cover data portability for backups, migration, and decommissioning.
ISM-1575 · ASD ISMOne-Month Notice for Service Termination
Service contracts require a one-month notice before a provider can stop services.
ISM-1576 · ASD ISMNotify Organisation of Unauthorised System Access
Service providers must alert organisations if they access systems without permission.
ISM-1577 · ASD ISMEnsure Network Segregation from Service Providers
Ensure that an organisation's network is kept separate from its service providers' networks for bett
ISM-1579 · ASD ISMDynamic Resource Scaling for Demand Spikes
Cloud services must be able to scale resources quickly to handle sudden increases in demand.
ISM-1580 · ASD ISMEnsure High Availability for Online Services
Online services should switch easily between zones to maintain availability.
ISM-1581 · ASD ISMMonitor Capacity and Availability of Online Services
Organisations monitor online services to ensure they can handle traffic and remain available at all
ISM-1582 · ASD ISMAnnual Validation of Application Control Rulesets
Check and approve application control rules once a year to ensure they are effective.
ISM-1583 · ASD ISMEnsure Contractors are Identified as Users
Ensure contractors are labelled distinctively from other personnel in systems.
ISM-1584 · ASD ISMPrevent Unauthorised Changes to Security Settings
Ensure non-admin users cannot change or disable security settings on operating systems.
ISM-1585 · ASD ISMPrevent User Changes to Browser Security Settings
Users cannot modify web browser security settings to ensure consistent protection.
ISM-1586 · ASD ISMRecord All Data Imports and Exports
Keep logs to track every time data is transferred into or out of the system.
ISM-1587 · ASD ISMAnnual Security Status Reporting for Systems
System owners must annually report each system's security status to an authorising officer.
ISM-1588 · ASD ISMAnnual Review of Standard Operating Environments
Standard Operating Environments must be reviewed and updated once every year.
ISM-1589 · ASD ISMEnable MTA-STS for Secure Email Transport
Ensure email is encrypted during transfer between servers to enhance security.
ISM-1590 · ASD ISMMandate Credential Changes Upon Compromise
Change user account credentials if they're compromised or potentially insecure.
ISM-1591 · ASD ISMSuspend User Access for Malicious Activity
Remove or pause access immediately if someone is found doing harmful activities on the system.
ISM-1592 · ASD ISMPrevent Unauthorised Application Installations by Users
Regular users cannot install apps unless they are approved, keeping systems secure.
ISM-1593 · ASD ISMVerifying User Identity for New Credentials
Users need to show proof of who they are before getting new login details.
ISM-1594 · ASD ISMSecure Delivery of User Account Credentials
Credentials are securely delivered to users, or split between users and supervisors if secure delive
ISM-1595 · ASD ISMEnsure Initial User Credentials Are Changed
Users must change their initial passwords the first time they log in to enhance security.
ISM-1596 · ASD ISMAvoid Reusing Credentials Across Systems
Users should not use the same passwords on different systems for better security.
ISM-1597 · ASD ISMEnsuring Credential Input Obscurity
Passwords and personal credentials are hidden when entered in systems to enhance security.
ISM-1598 · ASD ISMInspect IT Equipment Post-Maintenance for Unauthorised Changes
After maintenance, check IT equipment to ensure no unapproved changes were made.
ISM-1599 · ASD ISMProper Handling of Sensitive IT Equipment
Ensure IT equipment is handled based on how sensitive or classified it is.
ISM-1600 · ASD ISMEnsure Media is Sanitised Before Initial Use
Before using any media, clean it to ensure no unwanted data is present.
ISM-1601 · ASD ISMImplement Microsoft Attack Surface Reduction Rules
Apply Microsoft's rules to reduce potential weaknesses in user applications.
ISM-1602 · ASD ISMEnsure Cyber Security Docs Are Communicated
Make sure all stakeholders are informed about cyber security documents and their updates.
ISM-1603 · ASD ISMDisabling Vulnerable Authentication Methods
Turn off login methods that can be tricked into accepting false entries.
ISM-1604 · ASD ISMHarden Software Isolation Mechanisms Sharing Physical Computing Resources
A software-based isolation mechanism is software (such as a hypervisor or container engine) that let
ISM-1605 · ASD ISMHarden the Operating System Beneath Software Isolation Mechanisms
When you run a software-based isolation mechanism (software that separates different workloads, such
ISM-1606 · ASD ISMPatch Isolation Mechanisms and Underlying Operating Systems Promptly
When you run a software-based isolation mechanism that shares the same physical computing resources
ISM-1607 · ASD ISMIntegrity Monitoring and Logging for Isolation Mechanism
Ensure shared resources have integrity monitoring and logging for safety and transparency.
ISM-1608 · ASD ISMScan Third-Party SOEs for Malicious Code
Third-party standard operating environments must be checked for viruses and bad configurations.
ISM-1609 · ASD ISMConsult System Owners Before Continuing Intrusions
System owners must be asked before allowing intrusions to persist for collecting evidence.
ISM-1610 · ASD ISMDocument and Test Emergency System Access Procedures
Ensure emergency access to IT systems is documented and tested during major IT changes.
ISM-1611 · ASD ISMUse Break Glass Accounts Only in Emergencies
Break glass accounts should be used only if normal login methods fail.
ISM-1612 · ASD ISMRestricted Use of Break Glass Accounts for Emergencies
Use special accounts only for approved emergency activities to maintain system security.
ISM-1613 · ASD ISMCentral Logging of Break Glass Account Usage
Logging is used to track and monitor the use of emergency access accounts.
ISM-1614 · ASD ISMManage Emergency Account Access Changes
Change break glass account passwords after emergency access.
ISM-1615 · ASD ISMTesting Break Glass Accounts Post Credential Change
Ensure emergency accounts work properly after changing their passwords.
ISM-1616 · ASD ISMImplementing a Vulnerability Disclosure Program
Create a program to find and fix software issues to keep products secure.
ISM-1617 · ASD ISMRegular Review of Cyber Security Program
The CISO ensures the cyber security program stays relevant to combat threats and seize opportunities
ISM-1618 · ASD ISMCISO's Role in Cyber Security Incident Response
The CISO is responsible for managing the organisation's reactions to cyber security threats.
ISM-1619 · ASD ISMConfigure Service Accounts as Managed Service Accounts
Ensure service accounts are created as Managed Service Accounts for improved security.
ISM-1620 · ASD ISMEnsure Privileged Accounts are Secured in AD
Privileged user accounts must belong to a special security group for extra protection.
ISM-1621 · ASD ISMDisable or Remove Windows PowerShell 2.0
Ensure the outdated PowerShell 2.0 is disabled or uninstalled for security.
ISM-1622 · ASD ISMEnsure PowerShell Uses Constrained Language Mode
PowerShell should be setup to limit script execution and mitigate potential risks.
ISM-1623 · ASD ISMCentralised Logging of PowerShell Activities
Ensure PowerShell actions and logs are collected in a central place for monitoring.
ISM-1624 · ASD ISMProtect PowerShell Script Block Logs
PowerShell logs are safeguarded by secure event logging that ensures their protection.
ISM-1625 · ASD ISMDevelop Insider Threat Mitigation Programs
Create and manage a program to address threats from within the organisation.
ISM-1626 · ASD ISMSeek Legal Advice for Insider Threat Plans
Get legal advice when making and applying plans to handle insider threats.
ISM-1627 · ASD ISMBlock Inbound Traffic from Anonymity Networks
Block connections from anonymous networks to keep the organisation's network secure.
ISM-1628 · ASD ISMPrevent Anonymity Network Traffic in Outbound Connections
Ensure outbound connections to anonymous networks are blocked for security.
ISM-1629 · ASD ISMSelect Correct Modulus for Diffie-Hellman Encryption
Use NIST guidelines to choose secure parameters for Diffie-Hellman encryption to safely agree on ses
ISM-1631 · ASD ISMIdentify Suppliers in Cyber Supply Chain
Ensure all suppliers linked to IT and OT systems are identified for security management.
ISM-1632 · ASD ISMEnsure Secure Procurement from Reliable Suppliers
Buy technology from suppliers known for keeping their systems secure.
ISM-1633 · ASD ISMDetermine System Boundary, Criticality and Security Objectives
System owners, in consultation with the authorising officer, must define each system's boundary, bus
ISM-1634 · ASD ISMTailoring System Controls for Security and Resilience
System owners, in consultation with each system's authorising officer, select controls for each syst
ISM-1635 · ASD ISMEnsure Security Controls for System Environments
System owners must apply security measures to safeguard each system and its environment.
ISM-1636 · ASD ISMSecurity Assessment for System Controls
System owners ensure security checks for specific systems to verify proper setup and operation.
ISM-1637 · ASD ISMMaintain an Outsourced Cloud Service Register
Keep an up-to-date register of cloud services used, and regularly check it.
ISM-1638 · ASD ISMMaintain a Comprehensive Outsourced Cloud Service Register
Keep a detailed list of cloud services used, including provider details, service purpose, and securi
ISM-1639 · ASD ISMLabel Building Management Cables Clearly
Label cables with purpose clearly at intervals to ensure easy identification.
ISM-1640 · ASD ISMLabel Cables for Foreign Systems in Australia
Ensure all cables from foreign systems in Australia are labelled at check points.
ISM-1641 · ASD ISMEnsure Degaussed Media is Physically Damaged
After using a degausser, damage internal components of magnetic media to prevent data recovery.
ISM-1642 · ASD ISMEnsure Media is Sanitised Before Reuse
Clean media thoroughly before using it in a new security area to prevent data leaks.
ISM-1643 · ASD ISMMaintain Detailed Software Version and Patch Records
Keep a record of software versions and update histories for system security.
ISM-1644 · ASD ISMSecure Communication Practices in Public Areas
Avoid discussing sensitive topics on mobile phones in public to prevent eavesdropping.
ISM-1645 · ASD ISMMaintain and Verify Floor Plan Diagrams
Regularly update and review floor plans to ensure they are accurate and current.
ISM-1646 · ASD ISMDetail Cabling Paths and Points on Floor Plans
Floor plans should show cable paths, conduit systems, and key network component locations.
ISM-1647 · ASD ISMDisable Privileged Access After 12 Months
Privileged system access is disabled if not revalidated within a year.
ISM-1648 · ASD ISMDisabling Inactive Privileged Access to Systems
Access with special privileges is disabled if not used for 45 days to enhance system security.
ISM-1649 · ASD ISMImplement Just-in-Time Administration for System Access
Use just-in-time methods to manage who can access system resources, ensuring enhanced security.
ISM-1650 · ASD ISMLog Management of Privileged User Activities
Keep track of changes to privileged user accounts by logging them in one central place.
ISM-1654 · ASD ISMDisable or Remove Internet Explorer 11
Ensure Internet Explorer 11 is not used to enhance system security.
ISM-1655 · ASD ISMEnsure .NET Framework 3.5 is Disabled or Removed
.NET Framework 3.5 should be turned off or uninstalled for security reasons.
ISM-1656 · ASD ISMImplement Application Control on Secure Servers
Ensure servers not connected to the internet have application control for security.
ISM-1657 · ASD ISMRestrict Application Execution to Approved Set
Only approved software and scripts can run, enhancing system security.
ISM-1658 · ASD ISMRestrict Execution of Drivers via Application Control
Ensures only approved drivers are run on systems, enhancing security.
ISM-1659 · ASD ISMImplement Microsoft's Vulnerable Driver Blocklist
Use Microsoft's list to stop harmful drivers from running on systems.
ISM-1660 · ASD ISMCentral Logging of Application Events
All application events, whether allowed or blocked, must be recorded centrally.
ISM-1667 · ASD ISMPrevent Child Processes in Microsoft Office
Microsoft Office is configured to prevent it from starting other programs or processes.
ISM-1668 · ASD ISMPrevent Microsoft Office from Creating Executable Files
Microsoft Office is set to not produce executable files to enhance security.
ISM-1669 · ASD ISMPrevent Microsoft Office from Injecting Code
Microsoft Office is configured to not insert code into other programs for security reasons.
ISM-1670 · ASD ISMPrevent PDF Applications from Creating Child Processes
PDF software can't start other programs, stopping potential security threats.
ISM-1671 · ASD ISMDisabling Microsoft Office Macros for Unauthorised Users
Microsoft Office macros are turned off unless users have a proven need for them.
ISM-1672 · ASD ISMEnable Antivirus Scanning for Office Macros
Ensure Microsoft Office is set to scan macros for viruses to protect against malware.
ISM-1673 · ASD ISMPrevent Win32 API Calls by Office Macros
Microsoft Office macros cannot make direct calls to Windows APIs.
ISM-1674 · ASD ISMEnsuring Secure Execution of Microsoft Office Macros
Only safe Microsoft Office macros are allowed to run, using security measures like sandboxing or tru
ISM-1675 · ASD ISMPrevent Enabling Untrusted Microsoft Office Macros
Macros from untrusted sources in Microsoft Office can't be enabled through standard interfaces.
ISM-1676 · ASD ISMValidate Microsoft Office Trusted Publishers List At Least Annually
Check the list of trusted publishers in Microsoft Office at least once a year so only approved softw
ISM-1679 · ASD ISMUse Multi-factor Authentication for Third-party Services
Use multiple verification steps for accessing external services with sensitive data.
ISM-1680 · ASD ISMUse Multi-Factor Authentication for Online Services
Users must use multi-factor authentication for online services handling non-sensitive data.
ISM-1681 · ASD ISMMandating Multi-Factor Authentication for Customer Services
Customers must use multi-factor authentication when accessing sensitive online services.
ISM-1682 · ASD ISMEnhance User Security with Phishing-resistant MFA
Multi-factor authentication protects systems by not relying solely on passwords, reducing phishing r
ISM-1683 · ASD ISMCentral Logging of Multi-factor Authentication Events
Multi-factor authentication attempts, whether they succeed or not, are logged together in a central
ISM-1685 · ASD ISMStrengthening Passwords for Critical Accounts
Ensure passwords for high-risk accounts are strong, unique, and properly managed.
ISM-1686 · ASD ISMEnable Credential Guard for Credential Protection
Credential Guard is activated to better protect user credentials from unauthorised access.
ISM-1687 · ASD ISMPrevent Virtualisation of Privileged Environments
Privileged environments must not be virtualised within non-privileged ones to ensure security.
ISM-1688 · ASD ISMRestrict Privileged Environment Access
Users without privileges cannot access systems meant for privileged users.
ISM-1689 · ASD ISMRestrict Privileged Accounts Access to Non-Privileged Environments
Privileged users aren't allowed to log into standard environments to ensure security.
ISM-1690 · ASD ISMTimely Application of Non-Critical Vulnerability Patches
Apply non-critical patches to online services within two weeks to prevent unexploited vulnerabilitie
ISM-1691 · ASD ISMTimely Vulnerability Patching in Software Tools
Apply patches to major software tools like browsers and email clients within two weeks to prevent vu
ISM-1692 · ASD ISMQuick Apply Critical Patches for Vulnerabilities
Apply crucial software patches within 48 hours to prevent security breaches from known vulnerabiliti
ISM-1693 · ASD ISMTimely Application of Patches to Mitigate Vulnerabilities
Apply updates to non-generic software within a month to keep systems secure.
ISM-1694 · ASD ISMTimely Application of Non-Critical Security Patches
Apply patches for non-critical vulnerabilities on internet-facing devices within two weeks if no kno
ISM-1695 · ASD ISMTimely Application of System Security Patches
Ensure non-internet-facing systems are updated within a month to protect against known vulnerabiliti
ISM-1696 · ASD ISMApply Critical Patches Within 48 Hours
Apply critical security patches to certain systems within 48 hours to prevent exploits.
ISM-1697 · ASD ISMApply Non-Critical Patches Within One Month
Apply updates for driver vulnerabilities within a month if they are non-critical and have no known e
ISM-1698 · ASD ISMDaily Vulnerability Scanning for Missing Updates
Online services are checked daily for missing updates to prevent vulnerabilities.
ISM-1699 · ASD ISMWeekly Vulnerability Scanning for Software Updates
Every week, a scanner checks for software updates to fix security issues in commonly used applicatio
ISM-1700 · ASD ISMRegular Vulnerability Scanning for Applications
A scanner is used every two weeks to find missing updates in most applications.
ISM-1701 · ASD ISMDaily Vulnerability Scanning for Internet-Facing Systems
Use a daily scanner to find missing security updates on internet-facing systems to keep them secure.
ISM-1702 · ASD ISMRegularly Scan for Missing Security Patches
Regular checks detect missing updates on devices to fix security gaps.
ISM-1703 · ASD ISMRegular Vulnerability Scanning for Missing Patches
A scanner checks every two weeks to find missing security patches for drivers.
ISM-1704 · ASD ISMRemove Unsupported Software to Ensure Security
Unsupported software like browsers, productivity tools, and security apps should be removed to maint
ISM-1705 · ASD ISMRestrict Access to User Account Backups
Only backup administrators can access backups; other privileged users cannot access backups of diffe
ISM-1706 · ASD ISMPrevent Backup Access by Privileged Users
Privileged users cannot access their own data backups; only backup administrators can.
ISM-1707 · ASD ISMRestrict Backup Modifications by Privileged Users
Only backup admins can modify or delete backups; others are restricted.
ISM-1708 · ASD ISMPrevent Backup Modifications During Retention
Backup administrators cannot change or delete backups until the retention period ends.
ISM-1710 · ASD ISMSecure Default Settings for Wireless Access Points
Ensure wireless access points are secured by updating default settings for enhanced protection.
ISM-1711 · ASD ISMEnsure User Identity Confidentiality in EAP-TLS
Use available methods to keep user identities private when using EAP-TLS for wireless network authen
ISM-1712 · ASD ISMEnsure Secure Authenticator Communication for Wireless FT
802.11r is disabled unless secured by approved cryptographic protocol.
ISM-1713 · ASD ISMDevelop and Maintain a Removable Media Register
Ensure a register for tracking removable media is created, kept up-to-date, and routinely checked.
ISM-1717 · ASD ISMImplement Security.txt for Vulnerability Disclosure
Ensure a 'security.txt' file is available on each website to aid in reporting vulnerabilities.
ISM-1718 · ASD ISMColour Code for SECRET Cables
SECRET cables are identified by their salmon pink colour.
ISM-1719 · ASD ISMColour Code for TOP SECRET Cables
TOP SECRET cables must be red to ensure easy identification and compliance.
ISM-1720 · ASD ISMColour Coding for Secret Wall Outlet Boxes
Secret wall outlets must be salmon pink to ensure correct security level identification.
ISM-1721 · ASD ISMRed Colour Coding for TOP SECRET Outlet Boxes
TOP SECRET wall outlet boxes should be painted red for easy identification.
ISM-1722 · ASD ISMMethods for Destroying Electrostatic Memory Devices
Use specialised machines or incineration to securely destroy memory storage devices.
ISM-1723 · ASD ISMMethods for Destroying Magnetic Floppy Disks
Magnetic floppy disks should be destroyed by burning, grinding, degaussing, or cutting to prevent da
ISM-1724 · ASD ISMMethods for Destroying Magnetic Hard Disks
Magnetic hard drives must be destroyed using specific approved methods, like incinerating or degauss
ISM-1725 · ASD ISMMethods for Destroying Magnetic Tapes
Magnetic tapes should be destroyed using specific methods like incineration or degaussing to ensure
ISM-1726 · ASD ISMMethods for Destructing Optical Disks
Optical disks should be destroyed using various methods like incineration or grinding to ensure data
ISM-1727 · ASD ISMMethods for Destroying Semiconductor Memory
Specialised equipment like a furnace or hammer mill is used to destroy semiconductor memory to ensur
ISM-1728 · ASD ISMHandling Media Waste Based on Particle Size
Store shredded media differently based on particle size: OFFICIAL up to 3 mm, PROTECTED up to 6 mm,
ISM-1729 · ASD ISMStorage Classification of Media Waste Particles
Store destroyed TOP SECRET media waste as OFFICIAL if under 3 mm, or as SECRET if 3-9 mm.
ISM-1730 · ASD ISMProvide a Software Bill of Materials to Consumers
Ensure software users receive a detailed list of included software components.
ISM-1731 · ASD ISMCoordinate Intrusion Remediation on Separate Systems
Intrusion response activities should be managed from a different system than the one that has been b
ISM-1732 · ASD ISMCoordinated Intrusion Remediation During Planned Outages
Ensure all activities to fix intrusions happen together during scheduled downtime.
ISM-1735 · ASD ISMDestroy Unsanitised Media Before Disposal
Media that can't be safely sanitised should be destroyed before being thrown away.
ISM-1736 · ASD ISMMaintain and Verify Managed Service Register
Keep and regularly check a log of managed services.
ISM-1737 · ASD ISMMaintain a Comprehensive Managed Service Register
Keep a detailed register of all managed services, including providers, purpose, data sensitivity, as
ISM-1738 · ASD ISMVerify Compliance with Security Requirements
Regularly ensure service providers are following the security agreements in their contracts.
ISM-1739 · ASD ISMApprove Security Architecture Before System Development
Ensure system security plans are approved before starting system development.
ISM-1740 · ASD ISMManage and Report Business Email Compromise
Employees should know about email fraud in banking and how to manage and report it.
ISM-1741 · ASD ISMImplement IT Equipment Destruction Procedures
Create and maintain processes for safely destroying IT equipment.
ISM-1742 · ASD ISMDestroy Un-sanitizable IT Equipment Safely
If IT equipment can't be cleaned properly, it must be destroyed to ensure security.
ISM-1743 · ASD ISMChoose Secure Operating System Vendors
Choose OS vendors who prioritise secure design and memory-safe languages or practices.
ISM-1745 · ASD ISMEnable Security Features for System Protection
Ensure essential security features are active to protect the system during startup.
ISM-1746 · ASD ISMRestrict File System Permission Changes
Only authorised users can change file permissions for approved applications to maintain system secur
ISM-1748 · ASD ISMPrevent Changes to Email Client Security Settings
Users are not allowed to change the security settings on their email clients.
ISM-1749 · ASD ISMLimit Cached Credentials to Single Logon
Users' credentials are stored only for their last login to enhance security.
ISM-1750 · ASD ISMSegregation of Administrative Infrastructure for Server Security
Keep management systems for different types of servers separate to ensure better security.
ISM-1751 · ASD ISMTimely Application of Vendor Patches for Non-Critical OS Vulnerabilities
Apply OS patches for non-critical issues within a month if no exploits exist.
ISM-1752 · ASD ISMFortnightly Vulnerability Scanning for Non-Workstations
Check non-work devices every two weeks for missing security updates.
ISM-1753 · ASD ISMReplace Unsupported Internet-Facing Devices
Replace network devices that are no longer supported by manufacturers.
ISM-1754 · ASD ISMTimely Resolution of Identified Software Vulnerabilities
Software vulnerabilities should be fixed quickly to prevent potential security risks.
ISM-1755 · ASD ISMDevelop and Maintain a Vulnerability Disclosure Policy
Organisations create and sustain a policy for reporting software vulnerabilities securely.
ISM-1756 · ASD ISMDevelop and Maintain Vulnerability Disclosure Processes
Organisations must create and maintain procedures for reporting software vulnerabilities.
ISM-1759 · ASD ISMEnsure Strong Encryption with Diffie-Hellman
Use a minimum 3072-bit modulus for secure Diffie-Hellman key exchanges.
ISM-1761 · ASD ISMUse NIST Curves for ECDH Encryption
Use specific NIST curves for secure encryption key exchanges, with P-384 preferred.
ISM-1762 · ASD ISMUse NIST P-384 Curve for ECDH Keys
When using ECDH, utilise the NIST P-384 curve for better encryption security.
ISM-1763 · ASD ISMUse NIST P-384 Curve for ECDSA Signatures
When signing digitally, prefer using the NIST P-384 curve for better security.
ISM-1764 · ASD ISMUse NIST P-384 Curve for ECDSA Signatures
Use the NIST P-384 or P-521 curves, preferably P-384, for secure digital signatures.
ISM-1765 · ASD ISMUse RSA with 3072-bit Modulus for Security
Ensure RSA uses at least a 3072-bit size for secure digital signatures and key transport.
ISM-1766 · ASD ISMEnsure Secure Hashing with SHA-2 Algorithm
Use at least 224-bit SHA-2 hash, with SHA-384 or SHA-512 being preferred, to ensure strong security.
ISM-1767 · ASD ISMUse SHA-2 with Minimum 256-bit Output
When using SHA-2, ensure the hash is at least 256 bits for better security.
ISM-1768 · ASD ISMUse Appropriate SHA-2 Output Size for Hashing
Use SHA-2 with at least 384-bit output for secure data hashing.
ISM-1769 · ASD ISMUsing AES Encryption with Strong Key Lengths
Use AES encryption with a strong key length, preferably AES-256, for enhanced security.
ISM-1770 · ASD ISMUtilise Strong AES Encryption Algorithms
When encrypting with AES, use stronger versions like AES-192 or preferably AES-256 for better securi
ISM-1771 · ASD ISMUse AES Encryption for IPsec Connections
AES encryption, especially ENCR_AES_GCM_16, is recommended for securing internet protocol connection
ISM-1772 · ASD ISMUse Secure Pseudorandom Functions for IPsec Connections
Use secure methods for IPsec connections to ensure data integrity and security.
ISM-1773 · ASD ISMEligibility Criteria for Gateway System Administrators
Only Australian or seconded foreign nationals can manage government-only network gateways in Austral
ISM-1774 · ASD ISMSecure Management Paths for Network Gateways
Gateways are managed separately from any networks they are connected to ensure security.
ISM-1778 · ASD ISMQuarantine Security-Noncompliant Data for Review
Noncompliant data is quarantined for review before system entry when imported manually.
ISM-1779 · ASD ISMQuarantine Data Failing Security Checks During Manual Export
Data failing security checks during manual export is quarantined until reviewed for approval.
ISM-1780 · ASD ISMApply SecDevOps for Secure Software Development
Use DevOps practices focused on security to develop software safely and securely.
ISM-1781 · ASD ISMEncrypt Network Data with ASD-Approved Cryptography
Ensure all data over networks is encrypted using approved methods.
ISM-1782 · ASD ISMUse Protective DNS to Block Malicious Domains
A service that prevents access to harmful website addresses.
ISM-1783 · ASD ISMSecure BGP with Valid ROA for IP Addresses
Ensure public IP addresses are protected by valid Route Origin Authorisation records to enhance secu
ISM-1784 · ASD ISMAnnual Testing of Cyber Incident Response Plan
The organisation tests its cyber incident response plan every year to ensure it's effective.
ISM-1785 · ASD ISMDevelop and Maintain Supplier Management Policy
Ensure a policy is in place for managing relationships with suppliers in a consistent manner.
ISM-1786 · ASD ISMMaintain an Approved Supplier List
Ensure a list of approved suppliers is created, used, and kept updated.
ISM-1787 · ASD ISMEnsure Suppliers are Approved for IT and OT Sourcing
Ensure systems and equipment are bought from pre-approved suppliers to mitigate risks.
ISM-1788 · ASD ISMIdentify Multiple Suppliers for Critical IT Sourcing
Ensure multiple suppliers are considered for sourcing essential IT systems and services to reduce su
ISM-1789 · ASD ISMMaintain Reserve Spares of Critical IT and OT Equipment
Source and keep sufficient spares of critical IT and OT equipment in reserve so failed items can be
ISM-1790 · ASD ISMEnsure Integrity in IT and OT Deliveries
Deliveries of IT and OT systems should be made securely to prevent tampering or integrity loss.
ISM-1791 · ASD ISMAssess Integrity of Delivered IT and OT Products
Check the integrity of IT and OT products before accepting them to ensure they're safe and reliable.
ISM-1792 · ASD ISMAssess Authenticity of IT and OT Deliveries
Ensure that software and equipment are genuine before accepting them.
ISM-1793 · ASD ISMRegular Assessment of Managed Service Providers
Managed service providers must be assessed for security compliance every 24 months.
ISM-1794 · ASD ISMNotify Significant Changes to Service Provider Agreements
Service providers must inform clients at least one month in advance of major changes to their contra
ISM-1795 · ASD ISMSet 30-Character Minimum for Key Administrator Passwords
Ensure key system accounts use passwords that are at least 30 characters long to enhance security.
ISM-1796 · ASD ISMDigitally Sign Executable Software for Security
Executable files must have a digital signature verified by a trusted certificate to ensure security.
ISM-1797 · ASD ISMEnsure Software Updates are Securely Signed
Make sure software updates and patches are securely signed to verify they are authentic and untamper
ISM-1798 · ASD ISMDevelop Secure Configuration Guidelines for Software
Provide users with guides to securely set up software configurations.
ISM-1799 · ASD ISMEnforce Email Rejection for Failed DMARC Checks
Emails not verified by DMARC are blocked to enhance email security.
ISM-1800 · ASD ISMEnsure Network Devices Have Trusted Firmware
Network devices must be installed with trusted firmware before their first use to prevent security r
ISM-1801 · ASD ISMMonthly Restart of Network Devices
Ensure network devices are restarted every month to maintain optimal performance.
ISM-1802 · ASD ISMOperate Approved High Assurance Cryptographic Equipment
Use approved high-security cryptographic tools according to Australian guidelines.
ISM-1803 · ASD ISMDocument and Report Cyber Security Incidents
Keep a record of cyber incidents including dates, actions, and reporting details.
ISM-1804 · ASD ISMInclude Break Clauses in Cloud Service Contracts
Contracts must have clauses that allow termination if security requirements aren't met by service pr
ISM-1805 · ASD ISMDevelop a Denial of Service Response Plan
Create a plan to detect, maintain, and respond to service disruptions in video and telephony systems
ISM-1806 · ASD ISMChange Default User Credentials During Setup
Change or remove default user accounts when setting up applications to enhance security.
ISM-1807 · ASD ISMAutomated Asset Discovery for Vulnerability Scanning
Automatically find devices every two weeks to check for security problems.
ISM-1808 · ASD ISMVulnerability Scanning with Updated Tools
Ensure vulnerability scanners are updated regularly to identify system weaknesses.
ISM-1809 · ASD ISMImplement Compensating Controls for Unsupported Systems
When systems can't be updated or replaced, use temporary security measures.
ISM-1810 · ASD ISMEnsuring Data Backup Synchronisation
Backups should be in sync to restore everything to the same time point when needed.
ISM-1811 · ASD ISMSecure and Resilient Data Backup Retention
Ensure backups of data and applications are stored safely and can withstand issues.
ISM-1812 · ASD ISMRestrict Backup Access to Unprivileged Users
Ensure that users without special permissions cannot see other people's backups.
ISM-1813 · ASD ISMPrevent Unauthorised User Access to Backup Data
Ensure that regular user accounts cannot view or restore their own backup files for security reasons
ISM-1814 · ASD ISMPrevent Backup Modifications by Unprivileged Users
Only authorised users can change or delete backups, keeping data safe from unauthorised access.
ISM-1815 · ASD ISMProtect Event Logs from Unauthorised Access
Ensure logs are safe from changes or deletion by unauthorised users.
ISM-1816 · ASD ISMPrevent Unauthorised Changes to Software Sources
Ensure software source is protected against unauthorised changes to maintain integrity.
ISM-1817 · ASD ISMSecure API Access with Authentication and Authorisation
Ensure only authorised clients can access sensitive data via network APIs over the internet.
ISM-1818 · ASD ISMClient Authentication for Network API Access
Ensure clients are verified before they change data through network APIs on the internet.
ISM-1819 · ASD ISMEnact Cyber Security Incident Response Plans
When a cyber incident is identified, the organisation activates its response plan.
ISM-1820 · ASD ISMEnsure Consistent Cable Colours for Systems
Use the same colour cables for each separate system to avoid confusion.
ISM-1821 · ASD ISMEnsuring Exclusive Bundling for TOP SECRET Cables
TOP SECRET cables must be in separate bundles or conduits to ensure security.
ISM-1822 · ASD ISMStandardised Colour for Wall Outlet Boxes
Ensure wall outlet boxes have the same colour for each system for consistency.
ISM-1823 · ASD ISMPrevent Users from Changing Security Settings in Apps
Users can't change security settings in office software, keeping configurations secure.
ISM-1824 · ASD ISMPrevent Changes to PDF Application Security Settings
Users are restricted from changing security settings in PDF applications.
ISM-1825 · ASD ISMEnsure Security Configuration Is Immutable by Users
Users cannot modify the security settings of security products.
ISM-1826 · ASD ISMSelect Vendors Committed to Secure Design for Servers
Choose server vendors who ensure secure designs and use safe programming practices.
ISM-1827 · ASD ISMUse Dedicated Admin Accounts for Domain Controllers
Ensure domain controllers have unique admin accounts not used elsewhere for better security.
ISM-1828 · ASD ISMDisable Print Spooler on AD DS Domain Controllers
Ensure the Print Spooler is turned off on AD DS domain controllers for security.
ISM-1829 · ASD ISMPrevent Password Storage in Group Policy Preferences
Make sure passwords aren't saved in Group Policy Preferences for added security.
ISM-1830 · ASD ISMCentral Logging for Microsoft AD Server Activities
Log important actions on Microsoft AD servers in a central location for better monitoring.
ISM-1832 · ASD ISMSPN Configuration for Active Directory Accounts
Only specialised accounts should have SPNs to increase security in Active Directory setups.
ISM-1833 · ASD ISMLimit Privileges for User Accounts in Active Directory
User accounts are set up with just the access they need, nothing extra.
ISM-1834 · ASD ISMEnsure No Duplicate SPNs in Active Directory
Make sure there are no duplicate identifiers for network services in the organisation's Active Direc
ISM-1835 · ASD ISMRestrict Delegation of Privileged Active Directory Accounts
Ensure privileged accounts are marked as sensitive and cannot be delegated to maintain security.
ISM-1836 · ASD ISMRequire Kerberos Pre-Authentication for User Accounts
All user accounts need extra verification when logging in for better security.
ISM-1837 · ASD ISMEnsure User Passwords Expire and Are Required
Ensure user accounts have passwords that expire and are always required.
ISM-1838 · ASD ISMRestrict UserPassword Attribute in AD Accounts
The UserPassword field should not be used to ensure account security.
ISM-1839 · ASD ISMSecure Account Properties in Active Directory
Do not use account fields that everyone can see to store passwords.
ISM-1840 · ASD ISMPrevent Reversible Encryption of User Passwords
User account passwords must not be stored in a way that allows them to be easily decrypted.
ISM-1841 · ASD ISMRestrict Domain Joining to Admin Users Only
Only authorised users can add computers to the network to maintain security.
ISM-1842 · ASD ISMUse Privileged Accounts for Domain Machine Addition
Special accounts are used for adding computers to the network for security purposes.
ISM-1843 · ASD ISMAnnual Review of Unconstrained Delegation in AD Accounts
Annually review AD accounts for unnecessary delegation and remove if no business need.
ISM-1844 · ASD ISMPrevent Non-Controller Accounts from Delegating Services
Ensure non-domain controller accounts can't be used to delegate services in Active Directory.
ISM-1845 · ASD ISMDisable User Security Group Access in Active Directory
When a user is disabled, they lose access to all security groups.
ISM-1846 · ASD ISMRestrict Pre-Windows 2000 Access Group Membership
Ensure no user accounts are added to the obsolete security group for better system security.
ISM-1847 · ASD ISMReset KRBTGT Account Password Twice After Compromise or Yearly
Change the Active Directory KRBTGT service account password twice (allowing replication in between)
ISM-1848 · ASD ISMReplace Unsupported Software-Based Isolation Mechanisms Sharing Physical Resources
A software-based isolation mechanism is software that keeps separate workloads apart while they shar
ISM-1849 · ASD ISMImplement OWASP Top 10 in Web Development
Use OWASP Top 10 controls to secure web applications during development.
ISM-1850 · ASD ISMMitigate OWASP Top 10 in Web Applications
Developers need to address the OWASP Top 10 security risks in web applications to enhance security.
ISM-1851 · ASD ISMSecure Development Using OWASP API Security Top 10
Web API developers must address the top 10 security risks identified by OWASP to ensure safety.
ISM-1852 · ASD ISMLimit Unprivileged Access to Essential Functions
Users can only access what they need to do their work, nothing extra.
ISM-1854 · ASD ISMRequire User Authentication for Multifunction Devices
Users must log in to use MFDs for printing, scanning, or copying.
ISM-1855 · ASD ISMCentral Logging of Multifunction Device Use
Uses of multifunction devices are logged centrally for tracking purposes.
ISM-1858 · ASD ISMImplement Strict IT Equipment Hardening Guidelines
Use the most restrictive security guidelines to secure IT equipment from unauthorised access.
ISM-1859 · ASD ISMHardening Office Productivity Suites
Secure your office apps using the strictest guidance from ASD and vendors to keep your data safe.
ISM-1860 · ASD ISMHarden PDF Applications Using ASD Guidance
Ensure PDF applications are securely configured following official security guidelines.
ISM-1861 · ASD ISMEnable Local Security Authority Protection
Ensure the system has measures to secure login details against unauthorized access.
ISM-1862 · ASD ISMRestrict Access and Conceal Web Server IP Addresses
Avoid revealing server IPs and limit access exclusively to WAFs and authorised networks.
ISM-1863 · ASD ISMRestrict Exposure of Network Management Interfaces
IT equipment management interfaces should not be accessible from the internet to enhance security.
ISM-1864 · ASD ISMDevelop and Enforce a System Usage Policy
Create and regularly update a policy that dictates how systems should be used within the organisatio
ISM-1865 · ASD ISMCompliance with System Usage Policies for Access
Employees must agree to follow system rules before they can access it.
ISM-1866 · ASD ISMPrevent Storing Classified Data on Privately Owned Devices
Staff using their own phones, tablets or computers for work must be stopped from saving OFFICIAL: Se
ISM-1867 · ASD ISMUse Approved Mobile Platforms for Sensitive Access
Mobile devices must use evaluated platforms for secure access to sensitive systems or data.
ISM-1868 · ASD ISMRestrictions on Mobile Device Removable Media
SECRET and TOP SECRET devices need ASD approval to use removable media.
ISM-1869 · ASD ISMMaintain Non-Networked IT Equipment Register
Ensure a non-networked IT equipment list is created and kept up-to-date.
ISM-1870 · ASD ISMImplement Application Control for User Profiles and Folders
Ensure user and temporary folders for systems, browsers, and emails are secured via application cont
ISM-1871 · ASD ISMImplement Application Control Exclusions for System Areas
Application control is set up to avoid certain system areas like user profiles and temporary folders
ISM-1872 · ASD ISMEnsuring Phishing-Resistant Multi-Factor Authentication
Users must use multi-factor authentication that resists phishing when accessing online services.
ISM-1873 · ASD ISMEnhance Security with Phishing-Resistant MFA
Online services should use multi-factor authentication that cannot be easily tricked by phishing.
ISM-1874 · ASD ISMPhishing-Resistant Multi-Factor Authentication for Customers
Online services use multi-step security to prevent phishing attacks during customer login.
ISM-1875 · ASD ISMMonthly Network Scans for Clear-Text Credentials
Monthly scans check for passwords or credentials that are not encrypted.
ISM-1876 · ASD ISMApply Critical Patches Within 48 Hours
Install critical patches for online services within 48 hours when notified by the vendor or if explo
ISM-1877 · ASD ISMTimely Application of Critical Security Patches
Apply critical patches to online systems within 48 hours to prevent vulnerability exploits.
ISM-1878 · ASD ISMApply Critical Patches Within 48 Hours
Critical system updates must be installed within 48 hours to prevent security risks.
ISM-1879 · ASD ISMTimely Patching of Critical Driver Vulnerabilities
Critical driver vulnerabilities must be fixed within 48 hours to prevent exploits.
ISM-1880 · ASD ISMTimely Reporting of Cyber Incidents Involving Customer Data
Notify customers and the public promptly about cybersecurity incidents involving their data.
ISM-1881 · ASD ISMTimely Reporting of Cyber Incidents Without Data Breach
Inform customers about cyber incidents quickly if no customer data is involved.
ISM-1882 · ASD ISMProcurement from Transparent Suppliers
Ensure vendors are transparent about their products and services before purchasing.
ISM-1883 · ASD ISMRestrict Privileged Access to Necessary Service Duties
Only necessary access is allowed for users to perform their duties online.
ISM-1884 · ASD ISMEnsure Compliance with Emanation Security Doctrine
Organisations must follow guidelines for managing information leaks through electromagnetic emission
ISM-1885 · ASD ISMImplement Emanation Security Measures for Systems
System owners follow security advice to protect against information leaks from electronic devices.
ISM-1886 · ASD ISMEnsure Mobile Devices Operate in Supervised Mode
Mobile devices must be set to a supervised mode to maintain security controls.
ISM-1887 · ASD ISMImplement Remote Locate and Wipe for Mobile Security
Mobile devices should be set up to be located and wiped remotely to ensure security.
ISM-1888 · ASD ISMEnsure Mobile Devices Have Secure Lock Screens
Mobile devices must have secure password-protected screens to prevent unauthorized access.
ISM-1889 · ASD ISMCentral Logging of Command Line Events
Track all command line actions by keeping a central log of every new process initiated via the comma
ISM-1890 · ASD ISMEnsure Macros Are Free of Malicious Code
Verify that Microsoft Office macros are safe before signing or storing them in trusted locations.
ISM-1891 · ASD ISMRestrict Non-V3 Signed Macros in Microsoft Office
Microsoft Office can't enable macros signed with old methods via common interfaces.
ISM-1892 · ASD ISMImplement Multi-factor Authentication for Customer Services
Use multi-factor authentication to protect access to sensitive customer data online.
ISM-1893 · ASD ISMEnforcing Multi-Factor Authentication for User Security
Users must use multi-factor authentication to access third-party services handling sensitive data.
ISM-1894 · ASD ISMEnsuring Phishing-Resistant Multi-factor Authentication
Ensure multi-factor authentication resists phishing attempts for secure data access.
ISM-1895 · ASD ISMLog Single-factor Authentication Events
Keep track of successful and unsuccessful single-factor login attempts.
ISM-1896 · ASD ISMEnable Memory Integrity for Credential Protection
Ensure memory integrity is activated to safeguard credential data.
ISM-1897 · ASD ISMEnable Remote Credential Guard for Credential Protection
Activating Remote Credential Guard helps prevent unauthorised access to security credentials.
ISM-1898 · ASD ISMUse Secure Admin Workstations for Administration
Use special secure computers for admin tasks to protect sensitive data.
ISM-1899 · ASD ISMRestrict Unauthorised Network Connections
Devices outside the network can't establish connections with administration systems.
ISM-1900 · ASD ISMFortnightly System Vulnerability Scanning
Scan systems every two weeks to find and fix unpatched security flaws.
ISM-1901 · ASD ISMTimely Application of Non-Critical Security Patches
Apply non-critical software patches within two weeks to maintain system security.
ISM-1902 · ASD ISMApply Non-Critical Patches to Non-Internet Systems Promptly
Ensure non-critical security patches are applied within a month if no active threats are identified.
ISM-1903 · ASD ISMRapid Application of Critical Firmware Patches
Install critical firmware updates within 48 hours to protect systems from known vulnerabilities.
ISM-1904 · ASD ISMApply Firmware Patches for Non-Critical Vulnerabilities
Install patches for minor firmware issues within a month if there're no immediate threats.
ISM-1905 · ASD ISMRemove Online Services No Longer Supported by Vendors
Online services that are no longer supported by their vendors are decommissioned and removed from us
ISM-1906 · ASD ISMTimely Analysis of Internet-Facing Server Logs
Organisations must quickly review logs from online servers to spot potential security threats.
ISM-1907 · ASD ISMTimely Analysis of Non-Internet-Server Logs
Examine logs from servers not facing the internet promptly to find security issues.
ISM-1908 · ASD ISMResponsible Disclosure of Software Vulnerabilities
Software weaknesses must be reported openly and quickly, using standard classification systems.
ISM-1909 · ASD ISMPerform Root Cause Analysis for Vulnerabilities
Analyse the cause of issues and fix related vulnerabilities completely.
ISM-1910 · ASD ISMLog Network API Calls for Data Protection
Ensure API calls over the internet that change or access sensitive data are logged centrally.
ISM-1911 · ASD ISMCentralised Logging of Software Errors and Usage
Important software activities and errors are logged to a central system for security tracking.
ISM-1912 · ASD ISMDocument Device Settings for Critical and High-Value Servers
Keep records of settings for important servers and network devices to ensure strong network security
ISM-1913 · ASD ISMDevelop and Maintain Approved IT Configurations
Ensure IT equipment is set up with approved configurations to enhance security.
ISM-1914 · ASD ISMEnsure Operating Systems Have Approved Configurations
Organisations must create and maintain approved configurations for all operating systems.
ISM-1915 · ASD ISMEnsure User Application Configurations are Approved
Make sure that all user applications follow approved setup guidelines to keep systems secure.
ISM-1916 · ASD ISMEnsure Server Application Configurations Are Approved
Organisations should create and maintain approved settings for server software to ensure security.
ISM-1917 · ASD ISMSupport Post-Quantum Cryptographic Algorithms by 2030
New cryptographic tools must support specific secure algorithms by 2030 to be ready for future quant
ISM-1918 · ASD ISMRegular Cyber Security Reporting to Audit Committee
The CISO reports cyber security updates directly to the organisation's risk committee.
ISM-1919 · ASD ISMDisable Non-MFA Authentication Protocols
Ensures systems only use multi-factor authentication by disabling less secure protocols.
ISM-1920 · ASD ISMPrevent Self-enrollment on Untrusted Devices
Users cannot set up multi-factor authentication on devices that aren't trusted to ensure data securi
ISM-1921 · ASD ISMAssess System Compromise Risks Often
Regularly check how likely systems can be hacked due to known vulnerabilities.
ISM-1922 · ASD ISMUse OWASP Standards in Mobile App Development
Developers use OWASP standards to enhance security in mobile app creation.
ISM-1924 · ASD ISMDetect and Mitigate Adversarial Prompts in Generative AI Applications
Generative AI applications must check user prompts to catch and block adversarial inputs that try to
ISM-1926 · ASD ISMEnsure Exclusive Usage of Microsoft AD Servers
Ensure Microsoft AD servers only run their intended roles, no additional apps unless security-relate
ISM-1927 · ASD ISMRestrict Access to Microsoft Active Directory Servers
Only privileged users should access key Microsoft servers for security.
ISM-1928 · ASD ISMEncrypt Backups of Microsoft AD Servers
Ensure backups of Microsoft AD servers are encrypted and only accessible by admins.
ISM-1929 · ASD ISMEnsure LDAP Signing on AD DS Domain Controllers
Make sure AD servers use secure communication to prevent unauthorised access.
ISM-1930 · ASD ISMPrevent Storing Passwords in Group Policy Preferences
Ensure passwords are not saved in Group Policy to enhance security.
ISM-1931 · ASD ISMEnsure SID Filtering for Domain and Forest Trusts
Enable SID filtering for enhanced security between domain and forest trusts.
ISM-1932 · ASD ISMLimit Service Accounts with SPNs in Active Directory
Reduce the number of special accounts to improve security in Active Directory.
ISM-1933 · ASD ISMRestrict DCSync Permissions on Service Accounts
Ensure service accounts with SPNs can't simulate domain controller operations.
ISM-1934 · ASD ISMAnnual Review of DCSync Permissions
Review DCSync user permissions yearly and remove them if no longer needed.
ISM-1935 · ASD ISMPrevent Unconstrained Delegation in Domain Services
Ensure computer accounts do not allow unrestricted delegation to protect security.
ISM-1936 · ASD ISMPrevent Usage of sIDHistory in User Accounts
Ensure user accounts do not use the sIDHistory attribute for security purposes.
ISM-1937 · ASD ISMWeekly Audit of sIDHistory in User Accounts
Check user accounts weekly to ensure they don't have the sIDHistory attribute.
ISM-1938 · ASD ISMRestrict Domain Computers Group in Active Directory
Prevent Domain Computers from changing anything in Active Directory for security.
ISM-1939 · ASD ISMMinimise Members in Privileged Security Groups
Limit the number of users in highly privileged security groups like Domain Admins to enhance securit
ISM-1940 · ASD ISMRestrict Service Accounts from Privileged Groups
Service accounts shouldn't join Domain or Enterprise Admins for security.
ISM-1941 · ASD ISMRestrict Computer Accounts in Privileged Security Groups
Ensure computer accounts aren't in highly privileged security groups like Domain Admins.
ISM-1942 · ASD ISMDomain Computers Group Privilege Restriction
The Domain Computers group should not have any privileged access to maintain security.
ISM-1943 · ASD ISMEnforce Certificate and User Mapping in AD Services
Ensure certificates are accurately matched to users within Active Directory.
ISM-1944 · ASD ISMConfiguration Changes in Active Directory Certificate Services
Ensure a specific security flag is not configured in Microsoft AD CS to maintain system integrity.
ISM-1945 · ASD ISMRemove Enrollee Supplies Subject Flag from Templates
Ensure certificate templates do not allow users to supply their own subject information.
ISM-1946 · ASD ISMRestrict Write Access to Certificate Templates
Ensure regular users can't change certificate templates to maintain security.
ISM-1947 · ASD ISMRemove User Authentication from Extended Key Usages
Ensure that Extended Key Usages do not allow user authentication.
ISM-1948 · ASD ISMApproval for Certificate Template SANs in AD Services
Approval is needed before using certificate templates that let you specify extra names.
ISM-1949 · ASD ISMUse Dedicated Accounts for AD FS Administration
AD FS servers should be managed using special accounts not shared with other systems.
ISM-1950 · ASD ISMDisable Soft Matching After Synchronisation
Ensure soft matching is turned off after syncing Microsoft AD DS with Microsoft Entra ID to enhance
ISM-1951 · ASD ISMDisable Hard Match Takeover in Microsoft Entra Connect
Ensure that the hard match feature is turned off to prevent unauthorised access in Microsoft Entra C
ISM-1952 · ASD ISMPrevent Synchronisation of Privileged Accounts
Ensure privileged accounts aren't synced between Microsoft AD DS and Entra ID for security reasons.
ISM-1953 · ASD ISMEnsure Strong Management of Admin Account Credentials
Make sure admin account passwords in each domain are long, unique, and securely managed.
ISM-1954 · ASD ISMEnforce Random Credentials for Administrator Accounts
Ensure admin and service account passwords are randomly generated to improve security.
ISM-1955 · ASD ISMRegularly Change Compromised Credentials
Change computer account passwords every 30 days or if they're compromised or suspected to be.
ISM-1956 · ASD ISMRegularly Update AD FS Certificates to Prevent Risks
AD FS certificates must be updated twice quickly if compromised or not updated within a year to enha
ISM-1957 · ASD ISMEnsure CA Servers Use Hardware Security Modules
Microsoft AD CS private keys need a hardware module for secure storage.
ISM-1958 · ASD ISMPrevent Unauthorised Access for DCSync Accounts
Users with certain permissions can't access less secure systems to maintain security.
ISM-1959 · ASD ISMEnsure Consistent Formatting for Event Logs
Event logs should be stored in a consistent format to ensure reliable data tracking.
ISM-1960 · ASD ISMTimely Analysis of Event Logs for Cybersecurity
Internet-facing device logs are quickly reviewed to find security issues.
ISM-1961 · ASD ISMTimely Analysis of Network Device Event Logs
Analyse logs from internal network devices quickly to detect security events.
ISM-1962 · ASD ISMDisable SMBv1 Protocol on Networks
Ensure SMB version 1 is not active on network systems to enhance security.
ISM-1963 · ASD ISMCentral Logging of Events on Internet-Facing Devices
Important events on internet-connected network devices are logged in a central location for security
ISM-1964 · ASD ISMCentral Logging for Network Device Events
Logs activities from internal network devices to keep track of security-related events.
ISM-1965 · ASD ISMContent Checking for Imported or Exported Files
Files passing through gateways or data systems are checked to ensure they meet security requirements
ISM-1966 · ASD ISMCISO Manages and Verifies System Register
The CISO keeps and checks a list of all the systems the organisation uses.
ISM-1967 · ASD ISMEnsure Security Assessment of TOP SECRET Systems
System owners and officers ensure TOP SECRET systems are correctly assessed for security measures.
ISM-1968 · ASD ISMObtain Authorisation for TOP SECRET Systems
System owners must get official approval to operate TOP SECRET systems from the Director-General ASD
ISM-1969 · ASD ISMPreventing Accidental Execution of Malicious Code
Ensure malicious code cannot accidentally run by treating it before storage or communication.
ISM-1970 · ASD ISMSegregated Environment for Malicious Code Analysis
Malicious code should be analyzed in a separate, isolated environment to prevent system contaminatio
ISM-1971 · ASD ISMSecurity Assessments for TOP SECRET Managed Services
TOP SECRET managed services must undergo security checks by ASD assessors every two years.
ISM-1972 · ASD ISMSecurity Assessments for Top Secret Cloud Services
Cloud providers' secret services need security checks every two years by authorised assessors.
ISM-1973 · ASD ISMSecure Facilities for Non-Classified Systems
Ensure non-classified systems are located in secure buildings to prevent unauthorised access.
ISM-1974 · ASD ISMSecuring Non-Classified IT Equipment in Secure Rooms
Non-classified IT equipment should be placed in secure rooms to prevent unauthorized physical access
ISM-1975 · ASD ISMSecure Non-Classified Equipment in Safe Containers
Secure non-classified equipment in secure containers to protect against unauthorized physical access
ISM-1976 · ASD ISMCentral Logging of Security Events on macOS
Ensure security events on macOS systems are logged centrally for monitoring.
ISM-1977 · ASD ISMCentral Logging of Linux System Events
Important Linux system events should be logged in a central location for security purposes.
ISM-1978 · ASD ISMCentralised Logging for Server Application Events
Log important events centrally for applications on internet-facing servers for security monitoring.
ISM-1979 · ASD ISMCentral Logging for Security Events on Servers
Record important server activities in a central system to monitor non-internet-connected servers.
ISM-1980 · ASD ISMAvoid Using Credential Hints in Systems
Systems should not use hints to reveal or guess passwords.
ISM-1981 · ASD ISMReplace Unsupportable Non-Internet Network Devices
Replace network devices not supported by vendors to maintain security.
ISM-1982 · ASD ISMReplace Unsupported Networked IT Equipment
Replace networked IT equipment when vendors no longer provide support.
ISM-1983 · ASD ISMLog Events Sent to Centralised Facility Quickly
Ensure all event logs are sent to a central logging facility as soon as possible after occurring.
ISM-1984 · ASD ISMEncrypt Event Logs in Transit Using ASD Cryptography
Event logs must be encrypted with approved methods before being sent to a central logging system.
ISM-1985 · ASD ISMProtect Event Logs from Unauthorised Access
Ensure that only authorised individuals can view or access event logs.
ISM-1986 · ASD ISMTimely Analysis of Critical Server Event Logs
Event logs from important servers are quickly reviewed to find security issues.
ISM-1987 · ASD ISMTimely Analysis of Security Event Logs
Security event logs are reviewed promptly to identify cyber threats.
ISM-1988 · ASD ISMEnsure Event Logs Are Retained for 12 Months
Keep event logs searchable and accessible for at least 12 months to help in audits or investigations
ISM-1989 · ASD ISMEnsure Event Logs Meet Retention Requirements
Event logs must be kept according to the retention rules set by the National Archives of Australia.
ISM-1990 · ASD ISMPrefer FIPS 140-3 Validated ML-DSA and ML-KEM Implementations
When using the post-quantum algorithms ML-DSA (FIPS 204) and ML-KEM (FIPS 203), prefer implementatio
ISM-1991 · ASD ISMImplement ML-DSA for Enhanced Digital Signature Security
Use ML-DSA algorithms, preferring ML-DSA-87, for secure digital signatures.
ISM-1992 · ASD ISMUsing Hedged Variant of ML-DSA for Digital Signatures
Use the more secure version of ML-DSA for digital signatures to minimise risks.
ISM-1993 · ASD ISMUse Pre-Hashed ML-DSA Variants Only When Necessary
Only use alternate ML-DSA signatures if the standard version is too slow.
ISM-1994 · ASD ISMUse Correct Hashing for ML-DSA Pre-hashed Variants
Ensure stronger hashes like SHA-384 or SHA-512 are used with ML-DSA digital signatures for added sec
ISM-1995 · ASD ISMUse ML-KEM for Secure Key Encapsulation
Ensure encryption keys are protected using recommended ML-KEM-768 or ML-KEM-1024 methods.
ISM-1996 · ASD ISMUsing Hybrid Schemes for Secure Encryption
Ensure at least one encryption method is approved for strong protection against future quantum threa
ISM-1997 · ASD ISMDefine Cyber Security Roles for Leadership
The board sets specific cyber security roles and duties for themselves and the whole organisation.
ISM-1998 · ASD ISMIntegrate Cyber Security Across Business Functions
Leaders ensure cyber security is a part of every business area.
ISM-1999 · ASD ISMAlign Cyber Security with Business Strategy
Leadership ensures cyber security strategy aligns with the company's overall business direction.
ISM-2000 · ASD ISMRegular Cyber Security Briefings for Executives
Executives receive regular updates on cyber security and threats from experts.
ISM-2001 · ASD ISMChampioning Cyber Security at an Executive Level
Executives set a good example to promote a healthy cyber security culture in the organisation.
ISM-2002 · ASD ISMEnsure Board Cyber Security Literacy for Compliance
Executive leaders must understand cyber security to meet legal and regulatory responsibilities.
ISM-2003 · ASD ISMMonitor Cyber Security Workforce and Skill Gaps
Executives should stay informed on hiring and skills gaps in their cyber security team.
ISM-2004 · ASD ISMEnhancing Cyber Security Skills and Experience
The board supports cyber security training for all staff using internal and external opportunities.
ISM-2005 · ASD ISMUnderstanding Business Criticality of Organisation Systems
Leaders need to know the importance, location, and protection of critical business systems.
ISM-2006 · ASD ISMBoard Plans for Major Cyber Security Incidents
The board prepares for major cyber attacks by joining practice drills and knowing their responsibili
ISM-2007 · ASD ISMAuthorised Medical Device Register for SECRET and TOP SECRET Areas
Keep, maintain and regularly check an approved list of medical devices allowed into SECRET and TOP S
ISM-2008 · ASD ISMCriteria for Medical Devices in SECRET and TOP SECRET Areas
Medical devices in secure areas must be safe, approved, and have limited connectivity.
ISM-2009 · ASD ISMRestrict Medical Devices in SECRET and TOP SECRET Areas
Ensure unauthorised medical devices are not brought into SECRET and TOP SECRET areas.
ISM-2010 · ASD ISMEnsure SPNs Use Strong Encryption in AD Services
Service accounts in Active Directory must use strong encryption to secure their SPNs.
ISM-2011 · ASD ISMRestrict MFA Options to Phishing-resistant Only
Ensure accounts using strong, phishing-proof MFA can't use less secure authentication methods.
ISM-2012 · ASD ISMEnsure Secure Screen Locking on Systems
Systems must lock screens after 15 minutes of inactivity, requiring full re-authentication to unlock
ISM-2013 · ASD ISMEnsure Client Authentication for Internal Network APIs
Make sure apps inside your network check who accesses them and what they can do, before allowing dat
ISM-2014 · ASD ISMEnsure API Client Authentication and Authorisation
Check and confirm who can use certain non-internet APIs to access restricted data.
ISM-2015 · ASD ISMCentral Logging of Non-Internet Network API Data Access
All network API data changes not shared online must be logged centrally.
ISM-2016 · ASD ISMEnsure Input Validation and Sanitisation for Security
Software must check and clean all local network inputs to prevent security issues.
ISM-2017 · ASD ISMEncrypt DNS Traffic Between Clients and Servers
DNS lookups sent between your devices and DNS servers must be encrypted using cryptography approved
ISM-2018 · ASD ISMSecure BGP Routing with RPKI-Registered IP Addresses
Routers reject or down-rank invalid IP address routes to enhance BGP security.
ISM-2019 · ASD ISMRoutine Security Assessments for TOP SECRET Gateways
TOP SECRET gateways are reviewed for security by authorised assessors every two years.
ISM-2020 · ASD ISMEnsure Adequate Cyber Security Personnel Are Acquired
The CISO must recruit qualified cyber security staff to support the organisation's activities.
ISM-2021 · ASD ISMImplement and Maintain Data Minimisation Practices
System owners should limit data collection and storage to what's necessary.
ISM-2022 · ASD ISMDevelop and Maintain Cyber Security Training Register
Maintain a record of all cyber security awareness training activities within an organisation.
ISM-2023 · ASD ISMMaintain a Reliable Source for Software
Ensure a trustworthy source for software is available and maintained consistently.
ISM-2024 · ASD ISMUtilise Authoritative Sources in Software Development
Use only official sources for all software development tasks to ensure accuracy and reliability.
ISM-2025 · ASD ISMUsing Issue Tracking for Software Development Tasks
Connect software tasks with security and change issues using an issue tracking tool.
ISM-2026 · ASD ISMScan Software Artefacts for Malicious Content
Ensure all software artefacts are checked for harmful content before adding them to the main softwar
ISM-2027 · ASD ISMVerify Software Artefacts with Digital Signatures
Ensure all software is authenticated with a digital signature or secure hash before use.
ISM-2028 · ASD ISMTest Software Artefacts for Security Weaknesses
All software is tested for security issues before being added to the official software source.
ISM-2029 · ASD ISMRestrict Third-Party Libraries to Trustworthy Sources
Only use third-party libraries from reliable sources to ensure software security.
ISM-2030 · ASD ISMPrevent Storing Secrets in Software Repositories
Code commits are scanned for secrets to ensure they aren't saved in the main software repository.
ISM-2031 · ASD ISMSecure System Build Tools Implementation
Use security features in compilers and build tools to secure your software's executable files.
ISM-2032 · ASD ISMEnsure Automated Tests Are Completed Before Building
Before creating software, complete all automated tests without errors or warnings.
ISM-2033 · ASD ISMDocument and Maintain Software Security Requirements
Ensure software security needs are documented and securely kept throughout all development stages.
ISM-2034 · ASD ISMDocument and Review Security Design in Development
Keep track of and check security choices throughout software development to ensure safety.
ISM-2035 · ASD ISMDocument Security Roles for Software Development
Identify and document the roles and skills needed for secure software development.
ISM-2036 · ASD ISMDocument Security Duties for Software Developers
Clearly define and document what software developers must do to ensure security.
ISM-2037 · ASD ISMTrain Software Developers Lacking Cyber Security Skills
Developers without cyber security skills need training in secure software practices.
ISM-2038 · ASD ISMMaintain Developer Cyber Security Skills Register
Keep a record of software developers' cybersecurity skills and knowledge.
ISM-2039 · ASD ISMReview Threat Model During Software Development
Regularly update the software threat model to match current and changing threats.
ISM-2040 · ASD ISMEnsure Secure Programming Practices in Software Development
Develop software using secure programming methods tailored to the chosen language to prevent vulnera
ISM-2041 · ASD ISMEnsure Use of Memory-Safe Programming Practices
Use programming languages that prevent memory errors to enhance security in software development.
ISM-2042 · ASD ISMEnsuring Security in Software Development Lifecycle
Security features must be included and enabled in software from the start, at no extra cost to users
ISM-2043 · ASD ISMEnsuring Readable and Maintainable Software Architecture
Ensure that software design is clear and easy to update.
ISM-2044 · ASD ISMPrevent Default Credentials in Software Installations
Ensure software does not come with default passwords; new credentials are set during installation.
ISM-2045 · ASD ISMEnsure Backwards Compatibility Doesn't Weaken Security
Make sure older software versions retain security when new updates are made.
ISM-2046 · ASD ISMEnsure Secure Impersonation Logging Practices
Ensure no sensitive information is recorded in logs and permissions are correctly set when users can
ISM-2047 · ASD ISMNotify Users of Authentication Resets via Secondary Channel
When a software authentication factor is reset, users are informed through an additional communicati
ISM-2048 · ASD ISMRestrict Non-Admins from Changing Permissions
Non-admin users can't change their own permissions or privileges in software with multiple user role
ISM-2049 · ASD ISMEnforcing Re-authentication After Permission Changes
Users must log in again if their account permissions change.
ISM-2050 · ASD ISMValidate Digital Signature Certificates Securely
Software checks digital signatures against trusted certificates and ensures they haven't been revoke
ISM-2051 · ASD ISMEnsure Event Logs for Cybersecurity Event Detection
Software should create logs to help detect security incidents.
ISM-2052 · ASD ISMEnsure Event Logs Protect Sensitive Data
Event logs must keep sensitive information safe and secured.
ISM-2053 · ASD ISMEnd of Life Procedures for Software
Create and share procedures for removing software and managing user accounts at its end of life.
ISM-2054 · ASD ISMEnsure No Vulnerabilities in Third-Party Software Components
Use available software bill of materials to check third-party components for vulnerabilities during
ISM-2055 · ASD ISMEnsure Software Components Meet Build Standards
Use available build history for third-party software to verify it meets standards during development
ISM-2056 · ASD ISMProvide Provenance for Software Builds
Ensure that details about how software is created are available to its users.
ISM-2057 · ASD ISMDocument, Build and Test All Input Validation Rules
Every rule for checking incoming data must be written down, built into the software, and tested with
ISM-2058 · ASD ISMEnsure Data Validation Before Deserialisation
Check data is correct before converting it from storage format to usable format to prevent issues.
ISM-2059 · ASD ISMRestrict and Scan File Uploads for Security
Ensure only certain file types are accepted and scanned for viruses before being accessed, executed,
ISM-2060 · ASD ISMEnsure Code Reviews for Secure Software Design
Code reviews are used to verify software security and adherence to secure design principles.
ISM-2061 · ASD ISMPeer Reviews of Critical and Security-Related Software Components
Have a second qualified developer review all critical and security-related parts of your software be
ISM-2062 · ASD ISMUnit and Integration Testing for Code Quality
Testing software parts with various cases ensures they work correctly and are built well.
ISM-2063 · ASD ISMEnsure Web App Cookies Have Security Flags
Web apps should use secure cookie settings to protect user sessions.
ISM-2064 · ASD ISMEnsure Secure Cookies with Signed Bearer Tokens
Web cookies should use signed tokens to prevent tampering and ensure security.
ISM-2065 · ASD ISMEnsure Secure Session Cookies with High Entropy Tokens
Web apps should use random session cookie identifiers with high entropy to ensure security.
ISM-2066 · ASD ISMCentralised Management of Web Application Sessions
Web apps use a server to handle and secure user sessions instead of relying on the user's device.
ISM-2067 · ASD ISMEnsure Single Logout for Single Sign-On Web Applications
Web apps with Single Sign-On should also log users out from all connected services.
ISM-2068 · ASD ISMRestrict Internet Access for Networked Devices
Limit internet connection only to devices that need it to ensure security.
ISM-2069 · ASD ISMMaintain Register of Authorised Recording Devices in SECRET and TOP SECRET Areas
Keep a maintained, regularly verified register of every photographic and video recording device auth
ISM-2070 · ASD ISMControl Access to Recording Devices in Secure Areas
Prevent unauthorised devices from entering areas where sensitive information is kept.
ISM-2071 · ASD ISMTraining on Managing Social Engineering Threats
Staff handling user accounts learn to identify and handle social engineering threats.
ISM-2072 · ASD ISMStore AI Models In A Non-Executable File Format
Artificial intelligence (AI) models must be saved using a file format that cannot run arbitrary code
ISM-2073 · ASD ISMDevelop a Post-Quantum Cryptography Transition Plan
Create and maintain a plan to move to cryptographic methods that are secure against quantum computin
ISM-2074 · ASD ISMDevelop and Maintain AI Usage Policy
Organisations must create and update policies for using AI systems.
ISM-2075 · ASD ISMProhibit the Use of Fax Machines for Messages
Fax machines and online fax services should not be used to send or receive messages.
ISM-2076 · ASD ISMEliminating Security Questions for Authentication
Authentication should not use security questions as they can be easily compromised.
ISM-2077 · ASD ISMAvoid Email for Out-of-Band Authentication
Do not use email for secondary authentication steps to increase security.
ISM-2078 · ASD ISMEnsure Passwords Are Not Common or Compromised
Make sure passwords aren't from known compromised or common password lists to enhance security.
ISM-2079 · ASD ISMEnsure Password Length is at Least 64 Characters
Passwords must allow a maximum length of at least 64 characters for increased security.
ISM-2080 · ASD ISMNo Password Complexity Requirements Enforced
Passwords do not need to follow strict complexity rules.
ISM-2081 · ASD ISMEnforce Use of All ASCII Characters in Passwords
Allow any printable character to be used in passwords for increased complexity.
ISM-2082 · ASD ISMUsing Cryptographic BOM in Software Development
Ensure imported software uses standard encryption by checking its cryptographic details.
ISM-2083 · ASD ISMProvide a Cryptographic Bill of Materials to Software Users
Software producers must give users a list of all cryptographic components used in the software.
ISM-2084 · ASD ISMDocument AI Model and System Characteristics
Create detailed documents about AI models and systems, including their architecture and security ris
ISM-2085 · ASD ISMPrevent Exposure of AI Model Confidence Scores
Do not show AI model confidence scores in outputs to avoid revealing exact confidence levels.
ISM-2086 · ASD ISMVerify Integrity of AI Models, Structures, and Weights
Ensure AI models are genuine and have not been tampered with to maintain trustworthiness.
ISM-2087 · ASD ISMVerify the Source and Integrity of AI Training Data
Check where the data used to train artificial intelligence (AI) models comes from and confirm it has
ISM-2088 · ASD ISMEnsure Accuracy of AI Model Training Data
Techniques verify that AI training data is reliable and accurate.
ISM-2089 · ASD ISMMonitor AI Model Performance and Investigate Anomalies
Keep track of AI model performance and check any unusual behaviors.
ISM-2090 · ASD ISMRate Limiting for AI Inference Queries
Limit the rate at which AI models can be queried to prevent overuse.
ISM-2091 · ASD ISMEnforce Resource Limits for AI Models
AI models must have enforced resource limits to prevent excessive use.
ISM-2092 · ASD ISMEnforce Fine-Grained Permissions for AI Applications
Implement access controls to precisely limit what users can do with AI applications.
ISM-2093 · ASD ISMRole-Based Access Controls in AI Applications
Access to sensitive data in AI apps is restricted based on user roles.
ISM-2094 · ASD ISMAI Content Filtering to Block Sensitive Data Exposure
AI apps use content filtering to prevent exposure of sensitive data and improper output.
ISM-2095 · ASD ISMBlock Personal Devices Granting AI Agents Access to Sensitive Systems
Staff using their own phones or computers to reach OFFICIAL: Sensitive or PROTECTED systems must not
ISM-2096 · ASD ISMSeparate Organisational and Personal Mobile Data
Ensure mobile devices keep work and personal apps and data separate.
ISM-2097 · ASD ISMConfigure Mobile Devices with Always On VPN
Ensure mobile devices have a VPN that is always active to protect data.
ISM-2098 · ASD ISMPrevent Data Transfer Over USB on Mobile Devices
Mobile devices must be set to stop data from being transferred via USB connections.
ISM-2099 · ASD ISMPrevent Connection of Mobile Devices to Infotainment
Do not link mobile phones to car infotainment systems.
ISM-2100 · ASD ISMDo Not View Classified Data on Mobile Devices
Avoid looking at sensitive information on your phone near connected cars.
ISM-2101 · ASD ISMRestrict Sensitive Conversations Near Vehicles
Sensitive phone calls should not be made near connected vehicles.
ISM-2102 · ASD ISMPeriodically Test Software Artefacts for Weaknesses
Regularly test software for weaknesses using different analysis tools during its development.
ISM-2103 · ASD ISMAI Data Use Requires Explicit Owner Consent
AI applications must not use organisational data without getting explicit consent from the data owne
ISM-2104 · ASD ISMDo Not Post Security Clearance and Briefing Details Online
Staff are told not to post their security clearance or briefing details on unapproved online service
ISM-2105 · ASD ISMAdvise Staff to Limit Posting Work Information on Unauthorised Online Services
Staff are told to limit posting information about their work duties on unauthorised online services
ISM-2106 · ASD ISMAdvise Staff to Limit Posting Work Skills Online
Advise staff to limit posting their work-related skills and experience on unauthorised online servic
ISM-2107 · ASD ISMRestrict Personal Information Viewing Online
Encourage personnel to apply the privacy settings available on online services so they control who c
ISM-2108 · ASD ISMMobile Apps Encrypt Sensitive Data Using ASD-Approved Cryptography
Mobile apps must encrypt all sensitive or classified data sent over public networks using cryptograp
ISM-2109 · ASD ISMPre-Boot Authentication for Encrypted System Volume Media
Devices with encrypted system volumes must require a password at start-up, or release the unlock key
ISM-2110 · ASD ISMHardening User Applications with ASD and Vendor Guidance
User applications are hardened by applying both ASD and vendor hardening guidance to their configura
ISM-2111 · ASD ISMRemove Temporary Installation Files Post-Installation
Remove all temporary installation files created during user application installation once the applic
ISM-2112 · ASD ISMDisable AI Applications' Direct Access to External Public Data Sources
AI applications that handle classified (sensitive) information must not be able to reach out to exte
ISM-2113 · ASD ISMAI Applications Flag Risky Actions for Approval
AI applications are configured so that a defined set of risky actions are held for human approval be
ISM-2114 · ASD ISMMonitor Baselines for AI Application Performance
Establish baselines of expected behaviour and performance for AI applications and continuously monit
ISM-2115 · ASD ISMRestrict Server Application Extensions to an Approved Set
Only extensions (add-on components) that your organisation has formally approved may be installed an
ISM-2116 · ASD ISMUse Cyber Threat Intelligence for Event Detection
Cyber threat intelligence is fed into log monitoring and detection tooling so that matches against k
ISM-2117 · ASD ISMAI Models Augment Cyber Security Event Detection
Only AI models proven suitable (validated for detection efficacy, false-negative behaviour, provenan
ISM-2118 · ASD ISMConduct Vulnerability Assessments and Penetration Tests Annually
Conduct vulnerability assessments and penetration tests on systems before they are deployed, before
ISM-2119 · ASD ISMUtilise AI Models in Vulnerability Assessments
Suitable AI models are used to augment both vulnerability assessments and penetration tests.
ISM-2120 · ASD ISMDevelop and Maintain Secure Software Policy
A secure software development policy is developed, formally implemented across the software developm
ISM-2121 · ASD ISMPrevent Using Developers Without Cyber Security Skills
Ensure software developers possess the cyber security knowledge and skills required for their specif
ISM-2122 · ASD ISMUse Suitable AI Models to Augment Software Security Testing
Where your organisation builds software, use appropriate artificial intelligence tools to strengthen
ISM-2123 · ASD ISMDelete AI Chat Session Prompts and Outputs
When a chat session is removed from an AI application, every prompt and output associated with that

Controls library.

Controls

Annex A 10.2 · ISO 42001Allocating Responsibilities

Annex A 10.3 · ISO 42001Manage Suppliers to Support Responsible AI Use

Annex A 10.4 · ISO 42001Consider Customer Expectations and Needs When Using AI

Annex A 2.2 · ISO 42001AI Policy

Annex A 2.3 · ISO 42001Alignment with Other Organisational Policies

Annex A 2.4 · ISO 42001Review the AI Policy at Planned Intervals to Keep It Effective

Annex A 3.2 · ISO 42001Define and Allocate AI Roles and Responsibilities

Annex A 3.3 · ISO 42001Process for Reporting Concerns About AI Systems

Annex A 4.2 · ISO 42001Resource Documentation

Annex A 4.3 · ISO 42001Document the Data Resources Used by Your AI System

Annex A 4.4 · ISO 42001Document the Tooling Resources Used for AI Systems

Annex A 4.5 · ISO 42001Document System and Computing Resources Used by AI Systems

Annex A 4.6 · ISO 42001Document the People and Skills Running Your AI System

Annex A 5.1 · ISO 27001Policies for information security

Annex A 5.10 · ISO 27001Acceptable Use Policies for Information and Assets

Annex A 5.11 · ISO 27001Return of Organisation's Assets upon Departure

Annex A 5.12 · ISO 27001Information Classification Policy and Practices

Annex A 5.13 · ISO 27001Labelling of Information

Annex A 5.14 · ISO 27001Information Transfer Policies and Procedures

Annex A 5.15 · ISO 27001Access Control Policies and Procedures

Annex A 5.16 · ISO 27001Identity life cycle management

Annex A 5.17 · ISO 27001Management of Authentication Information

Annex A 5.18 · ISO 27001Managing Access Rights to Information Assets

Annex A 5.19 · ISO 27001Managing Information Security in Supplier Relationships

Annex A 5.2 · ISO 42001AI System Impact Assessment Process

Annex A 5.2 · ISO 27001Defining Information Security Roles and Responsibilities

Annex A 5.20 · ISO 27001Integrating security clauses in supplier agreements

Annex A 5.21 · ISO 27001Managing Information Security in the ICT Supply Chain

Annex A 5.22 · ISO 27001Monitoring and Managing Supplier Services

Annex A 5.23 · ISO 27001Cloud Service Security Management

Annex A 5.24 · ISO 27001Information security incident management planning and preparation

Annex A 5.25 · ISO 27001Assessment and decision on information security events

Annex A 5.26 · ISO 27001Response to Information Security Incidents

Annex A 5.27 · ISO 27001Learning from information security incidents

Annex A 5.28 · ISO 27001Procedures for Collecting and Preserving Evidence

Annex A 5.29 · ISO 27001Maintain information security during disruptions

Annex A 5.3 · ISO 42001Document and Retain AI Impact Assessment Results

Annex A 5.3 · ISO 27001Segregation of Duties

Annex A 5.30 · ISO 27001ICT Readiness for Business Continuity

Annex A 5.31 · ISO 27001Compliance with Information Security Legal Requirements

Annex A 5.32 · ISO 27001Intellectual Property Rights Protection

Annex A 5.33 · ISO 27001Protection of Records

Annex A 5.34 · ISO 27001Privacy and Protection of Personally Identifiable Information

Annex A 5.35 · ISO 27001Independent review of information security

Annex A 5.36 · ISO 27001Review compliance with information security policies

Annex A 5.37 · ISO 27001Documented Operating Procedures for Information Processing

Annex A 5.4 · ISO 42001Assess and Document AI Impacts on Individuals and Groups

Annex A 5.4 · ISO 27001Management responsibilities for information security

Annex A 5.5 · ISO 42001Assess and Document AI Societal Impacts Across the Life Cycle

Annex A 5.5 · ISO 27001Establish and Maintain Contact with Authorities

Annex A 5.6 · ISO 27001Contact with special interest groups

Annex A 5.7 · ISO 27001Threat Intelligence Collection and Analysis

Annex A 5.8 · ISO 27001Information security in project management

Annex A 5.9 · ISO 27001Inventory management of information and associated assets

Annex A 6.1 · ISO 27001Personnel Background Verification

Annex A 6.1.2 · ISO 42001Objectives for Responsible Development of AI Systems

Annex A 6.1.3 · ISO 42001Processes for Responsible AI System Design and Development

Annex A 6.2 · ISO 27001Terms and conditions of employment for security

Annex A 6.2.2 · ISO 42001AI System Requirements and Specification

Annex A 6.2.3 · ISO 42001Documentation of AI System Design and Development

Annex A 6.2.4 · ISO 42001AI System Verification and Validation

Annex A 6.2.5 · ISO 42001AI System Deployment

Annex A 6.2.6 · ISO 42001Defining and Documenting Ongoing AI System Operation Requirements

Annex A 6.2.7 · ISO 42001Provide AI System Technical Documentation to Interested Parties

Annex A 6.2.8 · ISO 42001AI System Recording of Event Logs

Annex A 6.3 · ISO 27001Information security awareness, education and training program

Annex A 6.4 · ISO 27001Disciplinary Process for Information Security Violations

Annex A 6.5 · ISO 27001Responsibilities after employment termination or role change

Annex A 6.6 · ISO 27001Confidentiality and Non-disclosure Agreements

Annex A 6.7 · ISO 27001Remote Working Security Measures

Annex A 6.8 · ISO 27001Mechanisms for Reporting Security Events

Annex A 7.1 · ISO 27001Physical Security Perimeters

Annex A 7.10 · ISO 27001Secure Management of Storage Media

Annex A 7.11 · ISO 27001Protection from Utility Failures

Annex A 7.12 · ISO 27001Secure Cabling for Power and Data

Annex A 7.13 · ISO 27001Proper Maintenance of Equipment

Annex A 7.14 · ISO 27001Secure disposal or re-use of equipment

Annex A 7.2 · ISO 27001Physical access controls for secure areas