Security assurance

search account_circle

policyASD ISM

Guidelines for security assurance

35 controls in this part of theInformation Security Manual (ISM). Each control links to plain-English guidance, audit tips and cross-framework mappings.

Security assessments

Daily Vulnerability Scanning for Missing Updates

Online services are checked daily for missing updates to prevent vulnerabilities.

Weekly Vulnerability Scanning for Software Updates

Every week, a scanner checks for software updates to fix security issues in commonly used applicatio

Regular Vulnerability Scanning for Applications

A scanner is used every two weeks to find missing updates in most applications.

Daily Vulnerability Scanning for Internet-Facing Systems

Use a daily scanner to find missing security updates on internet-facing systems to keep them secure.

Regularly Scan for Missing Security Patches

Regular checks detect missing updates on devices to fix security gaps.

Regular Vulnerability Scanning for Missing Patches

A scanner checks every two weeks to find missing security patches for drivers.

Fortnightly Vulnerability Scanning for Non-Workstations

Check non-work devices every two weeks for missing security updates.

Automated Asset Discovery for Vulnerability Scanning

Automatically find devices every two weeks to check for security problems.

Vulnerability Scanning with Updated Tools

Ensure vulnerability scanners are updated regularly to identify system weaknesses.

Fortnightly System Vulnerability Scanning

Scan systems every two weeks to find and fix unpatched security flaws.

Assess System Compromise Risks Often

Regularly check how likely systems can be hacked due to known vulnerabilities.

Security Assessments

Conduct Vulnerability Assessments and Penetration Tests Annually

Conduct vulnerability assessments and penetration tests on systems before they are deployed, before

Utilise AI Models in Vulnerability Assessments

Suitable AI models are used to augment both vulnerability assessments and penetration tests.

Security monitoring

Capture Detailed Information in Event Logs

Record details like time, user, and equipment for each logged event.

Ensure Accurate Time Source for Event Logs

Logs must use a reliable time source for accuracy and consistency.

Analyse Cyber Security Events Promptly

Timely analysis of security events to spot incidents.

Implement a Centralised Event Logging Facility

Ensure all event logs are collected and managed in one central location for analysis and security mo

Protect Event Logs from Unauthorised Access

Ensure logs are safe from changes or deletion by unauthorised users.

Timely Analysis of Internet-Facing Server Logs

Organisations must quickly review logs from online servers to spot potential security threats.

Timely Analysis of Non-Internet-Server Logs

Examine logs from servers not facing the internet promptly to find security issues.

Ensure Consistent Formatting for Event Logs

Event logs should be stored in a consistent format to ensure reliable data tracking.

Timely Analysis of Event Logs for Cybersecurity

Internet-facing device logs are quickly reviewed to find security issues.

Timely Analysis of Network Device Event Logs

Analyse logs from internal network devices quickly to detect security events.

Protect Event Logs from Unauthorised Access

Ensure that only authorised individuals can view or access event logs.

Timely Analysis of Critical Server Event Logs

Event logs from important servers are quickly reviewed to find security issues.

Timely Analysis of Security Event Logs

Security event logs are reviewed promptly to identify cyber threats.

Ensure Event Logs Are Retained for 12 Months

Keep event logs searchable and accessible for at least 12 months to help in audits or investigations

Ensure Event Logs Meet Retention Requirements

Event logs must be kept according to the retention rules set by the National Archives of Australia.

Security Monitoring

Timely Analysis of Workstation Event Logs

Workstation event logs must be checked promptly to find any cybersecurity issues.

Access to Tools for Detecting Security Events

Ensure cyber security staff have tools to detect and identify security threats and incidents.

Develop, Implement and Maintain a Security Monitoring Policy

A security monitoring policy must be developed (written down), implemented (actually put into practi

Log Events Sent to Centralised Facility Quickly

Ensure all event logs are sent to a central logging facility as soon as possible after occurring.

Encrypt Event Logs in Transit Using ASD Cryptography

Event logs must be encrypted with approved methods before being sent to a central logging system.

Use Cyber Threat Intelligence for Event Detection

Cyber threat intelligence is fed into log monitoring and detection tooling so that matches against k

AI Models Augment Cyber Security Event Detection

Only AI models proven suitable (validated for detection efficacy, false-negative behaviour, provenan

Back to the full ACSC ISM control list, or browse the complete control library.