swap_horizFree crosswalk tool

ISO 27001 to ASD ISM

Every ISO/IEC 27001:2022 Annex A control, with the ASD ISM controls that cover the same ground. Useful when you hold ISO 27001 and are asked to show ISM alignment, or the other way round.

listISO 27001 controls shieldASD ISM controls

92 of the 93 ISO 27001 controls (99%) have at least one ASD ISM counterpart, giving 2,068 control-to-control relationships across 1,071 distinct ASD ISM controls. ISO 27001 and the ISM overlap heavily in subject matter, so coverage here is high. What differs is depth: the ISM states specific technical requirements where Annex A states outcomes.

These relationships are generated from the Control Stack catalogue and reviewed for topic fidelity, then labelled with how the two controls relate rather than asserted as equivalent. Where no counterpart exists, the row says so plainly instead of stretching for a match. Some rows are read from the other framework’s own mappings, so the wording of those summaries leads with that side.

Control Stack is a free Australian reference covering 1,423 cyber security controls: all 1,143 ASD ISM controls, 149 Essential Eight controls across all four maturity levels, all 93 ISO/IEC 27001:2022 Annex A controls and all 38 ISO/IEC 42001:2023 Annex A controls. Every one of them is cross-mapped between the four frameworks and readable in full without an account.

Reviewed 16 September 2026 · Maps ISO/IEC 27001:2022 Annex A to the September 2026 ASD ISM

ISO 27001 to ASD ISM

ISO 27001 control	Group	ASD ISM counterparts
Annex A 5.1 Policies for information security	Organisational controls	ISM-0039Partially overlaps Develop and Maintain a Cyber Security Strategy ISM-0043Partially overlaps Cyber Security Incident Response Plan Requirements ISM-0047Partially overlaps Approval Process for Cyber Security Documentation ISM-0264Partially overlaps Develop and Maintain an Email Usage Policy ISM-0407Depends on Maintaining a Secure Lifetime Access Record for Each Human User ISM-0588Broader than Develop and Maintain MFD Usage Policy ISM-0888Partially overlaps Annual Review of Cyber Security Documentation ISM-1078Broader than Develop and Maintain Telephone System Usage Policy ISM-1359Broader than Establish and Maintain Removable Media Policy ISM-1478Partially overlaps CISO Management of Cyber Security Compliance ISM-1510Broader than Develop and Maintain a Digital Preservation Policy ISM-1549Broader than Develop and Maintain Media Management Policy ISM-1551Broader than Develop and Maintain IT Equipment Management Policy ISM-1602Partially overlaps Ensure Cyber Security Docs Are Communicated ISM-1617Partially overlaps Regular Review of Cyber Security Program ISM-1864Broader than Develop and Enforce a System Usage Policy ISM-1865Broader than Compliance with System Usage Policies for Access ISM-1999Partially overlaps Align Cyber Security with Business Strategy ISM-2074Broader than Develop and Maintain AI Usage Policy ISM-2105Broader than Advise Staff to Limit Posting Work Information on Unauthorised Online Services ISM-2120Broader than Develop and Maintain Secure Software Policy
Annex A 5.2 Defining Information Security Roles and Responsibilities	Organisational controls	ISM-0043Partially overlaps Cyber Security Incident Response Plan Requirements ISM-0047Partially overlaps Approval Process for Cyber Security Documentation ISM-0714Partially overlaps Appoint a CISO to Lead Cyber Security Across IT and OT ISM-0717Partially overlaps CISO Oversight of Cyber Security Personnel ISM-0725Partially overlaps Cyber Security Steering Committee Coordination ISM-0726Partially overlaps Coordinate Security Risk Management Activities ISM-0734Partially overlaps CISO Role in Disaster Recovery Planning ISM-1071Partially overlaps Assign System Ownership for Better Oversight ISM-1478Partially overlaps CISO Management of Cyber Security Compliance ISM-1525Partially overlaps Register Systems with Authorising Officers ISM-1773Partially overlaps Eligibility Criteria for Gateway System Administrators ISM-1997Equivalent Define Cyber Security Roles for Leadership ISM-2001Partially overlaps Championing Cyber Security at an Executive Level ISM-2006Partially overlaps Board Plans for Major Cyber Security Incidents ISM-2020Depends on Ensure Adequate Cyber Security Personnel Are Acquired ISM-2035Broader than Document Security Roles for Software Development ISM-2036Broader than Document Security Duties for Software Developers
Annex A 5.3 Segregation of Duties	Organisational controls	ISM-0047Partially overlaps Approval Process for Cyber Security Documentation ISM-0445Partially overlaps Dedicated Privileged Accounts Used Solely for Privileged Duties ISM-0616Broader than Ensure Separation of Duties for Gateway Admins ISM-1255Supports Restrict Database Content Access by User Duties and Functions ISM-1705Partially overlaps Restrict Access to User Account Backups ISM-1706Partially overlaps Prevent Backup Access by Privileged Users ISM-2048Supports Restrict Non-Admins from Changing Permissions
Annex A 5.4 Management responsibilities for information security	Organisational controls	ISM-0264Partially overlaps Develop and Maintain an Email Usage Policy ISM-0408Depends on Logon Banner for Security Responsibilities ISM-0735Depends on CISO Oversees the Cyber Security Awareness Training Program ISM-1078Partially overlaps Develop and Maintain Telephone System Usage Policy ISM-1478Partially overlaps CISO Management of Cyber Security Compliance ISM-1602Partially overlaps Ensure Cyber Security Docs Are Communicated ISM-1864Depends on Develop and Enforce a System Usage Policy ISM-1865Depends on Compliance with System Usage Policies for Access ISM-1998Partially meets Integrate Cyber Security Across Business Functions ISM-2001Partially overlaps Championing Cyber Security at an Executive Level ISM-2004Partially overlaps Enhancing Cyber Security Skills and Experience ISM-2074Depends on Develop and Maintain AI Usage Policy ISM-2105Broader than Advise Staff to Limit Posting Work Information on Unauthorised Online Services
Annex A 5.5 Establish and Maintain Contact with Authorities	Organisational controls	ISM-0043Partially overlaps Cyber Security Incident Response Plan Requirements ISM-0140Broader than Prompt Reporting of Cyber Incidents to ASD ISM-0249Supports Request ASD Emanation Security Assessments for Deployed Classified Systems ISM-0576Supports Develop and Maintain Cyber Security Incident Plans ISM-1137Supports Request Risk Assessment for Emanation Security
Annex A 5.6 Contact with special interest groups	Organisational controls	ISM-2000Partially overlaps Regular Cyber Security Briefings for Executives
Annex A 5.7 Threat Intelligence Collection and Analysis	Organisational controls	ISM-1203Depends on Risk Assessment for System Security ISM-1526Depends on System Owners Continuously Monitor Security and Manage Threats, Risks and Controls ISM-1696Supports Apply Critical Patches Within 48 Hours ISM-2039Supports Review Threat Model During Software Development ISM-2116Partially overlaps Use Cyber Threat Intelligence for Event Detection ISM-2153Supports Quarterly Threat Hunting Informed by Current Threat Intelligence
Annex A 5.8 Information security in project management	Organisational controls	ISM-0597Broader than Consult ASD Before Changing CDS Connectivity ISM-1203Partially overlaps Risk Assessment for System Security ISM-1790Broader than Ensure Integrity in IT and OT Deliveries ISM-1998Partially meets Integrate Cyber Security Across Business Functions ISM-2033Broader than Document and Maintain Software Security Requirements ISM-2084Broader than Document AI Model and System Characteristics
Annex A 5.9 Inventory management of information and associated assets	Organisational controls	ISM-0208Broader than Maintain a Comprehensive Cable Register ISM-0336Partially overlaps Develop and Maintain Networked IT Equipment Register ISM-1071Broader than Assign System Ownership for Better Oversight ISM-1243Partially overlaps Develop and Verify Database Register ISM-1493Partially overlaps Maintain and Verify Software Registers ISM-1525Supports Register Systems with Authorising Officers ISM-1543Partially meets Register for RF and IR Devices in Secret Areas ISM-1551Supports Develop and Maintain IT Equipment Management Policy ISM-1637Partially overlaps Maintain an Outsourced Cloud Service Register ISM-1638Partially overlaps Outsourced Cloud Service Register Recording Eight Required Details ISM-1713Partially overlaps Develop and Maintain a Removable Media Register ISM-1737Partially overlaps Recording Required Details for Each Managed Service in the Register ISM-1869Broader than Maintain Non-Networked IT Equipment Register ISM-1966Partially overlaps CISO Manages and Verifies System Register ISM-2005Supports Understanding Business Criticality of Organisation Systems
Annex A 5.10 Acceptable Use Policies for Information and Assets	Organisational controls	ISM-0161Broader than Ensure Security of Unused IT Equipment and Media ISM-0240Broader than Prevent Sensitive Data in Messaging Services ISM-0258Broader than Establish and Maintain a Web Usage Policy ISM-0264Broader than Develop and Maintain an Email Usage Policy ISM-0337Broader than Ensure Media is Used with Authorised Systems ISM-0348Partially overlaps Develop and Maintain Media Sanitisation Procedures ISM-0358Broader than Classification Retention for Sanitised EPROM and EEPROM ISM-0588Broader than Develop and Maintain MFD Usage Policy ISM-0661Supports Holding Human Users Accountable for Data Transfers They Perform ISM-0824Broader than Avoid Using Unauthorised Online File Services ISM-0870Broader than Secure Storage and Handling of Mobile Devices ISM-1078Broader than Develop and Maintain Telephone System Usage Policy ISM-1083Partially overlaps Advise Personnel on Mobile Communication Sensitivity ISM-1146Broader than Separate Personal and Work Accounts for Online Services ISM-1187Broader than Check Data for Improper Markings Before Export ISM-1359Broader than Establish and Maintain Removable Media Policy ISM-1549Partially overlaps Develop and Maintain Media Management Policy ISM-1551Partially overlaps Develop and Maintain IT Equipment Management Policy ISM-1599Broader than Proper Handling of Sensitive IT Equipment ISM-1644Broader than Secure Communication Practices in Public Areas ISM-1864Broader than Develop and Enforce a System Usage Policy ISM-1865Supports Compliance with System Usage Policies for Access ISM-1868Supports Restrictions on Mobile Device Removable Media ISM-2074Broader than Develop and Maintain AI Usage Policy ISM-2075Broader than Prohibit the Use of Fax Machines for Messages ISM-2095Broader than Block Personal Devices Granting AI Agents Access to Sensitive Systems ISM-2104Partially overlaps Do Not Post Security Clearance and Briefing Details Online ISM-2105Broader than Advise Staff to Limit Posting Work Information on Unauthorised Online Services ISM-2106Broader than Advise Staff to Limit Posting Work Skills Online
Annex A 5.11 Return of Organisation's Assets upon Departure	Organisational controls	ISM-0430Partially overlaps Same-Day Removal or Suspension of Access No Longer Required
Annex A 5.12 Information Classification Policy and Practices	Organisational controls	ISM-0027Partially overlaps Mandatory Authorisation for System Operation ISM-0201Broader than Labelling Requirements for TOP SECRET Conduits ISM-0269Supports Restrict Sensitive Emails to Verified Recipients ISM-0270Broader than Apply Protective Markings to Emails Based on Sensitivity ISM-0271Supports Prevent Automatic Email Marking by Protective Tools ISM-0272Supports Restrict Protective Marking Tools to Authorised System Markings ISM-0293Broader than Classify IT Equipment by Data Sensitivity ISM-0323Broader than Classifying Media by Data Sensitivity ISM-0325Broader than Reclassify Media to Higher Sensitivity ISM-0332Broader than Label Media With Protective Markings Reflecting Sensitivity Or Classification ISM-0358Broader than Classification Retention for Sanitised EPROM and EEPROM ISM-0393Broader than Classify Databases Based on Data Sensitivity ISM-0462Depends on Managing Encryption Access for IT Equipment and Media ISM-0501Depends on Transport of Keyed Cryptographic Equipment ISM-0565Supports Email Security for Protective Markings ISM-0589Depends on Limit Document Sensitivity on MFDs Based on Network Classification ISM-0694Depends on Block Privately Owned Devices From SECRET and TOP SECRET Systems ISM-0831Supports Ensure Proper Handling of Sensitive Media ISM-0835Supports TOP SECRET Volatile Media Retains Classification After Sanitisation ISM-1053Supports Secure Physical Access for Classified Equipment ISM-1083Broader than Advise Personnel on Mobile Communication Sensitivity ISM-1089Broader than Block Downgrading Protective Markings on Email Replies and Forwards ISM-1461Supports Same Classification and Security Domain for Shared Isolation Hosts ISM-1482Depends on Ensure Separation of Classified and Personal Data on Devices ISM-1530Supports Secure Classified Equipment in Suitable Security Containers ISM-1599Supports Proper Handling of Sensitive IT Equipment ISM-1719Depends on Colour Code for TOP SECRET Cables ISM-1729Broader than Storage Classification of Media Waste Particles
Annex A 5.13 Labelling of Information	Organisational controls	ISM-0201Broader than Labelling Requirements for TOP SECRET Conduits ISM-0218Broader than Label and Protect Long TS Fibre-Optic Leads ISM-0270Broader than Apply Protective Markings to Emails Based on Sensitivity ISM-0271Partially overlaps Prevent Automatic Email Marking by Protective Tools ISM-0272Broader than Restrict Protective Marking Tools to Authorised System Markings ISM-0293Partially overlaps Classify IT Equipment by Data Sensitivity ISM-0294Broader than Label IT Equipment with Sensitivity Markings ISM-0296Partially overlaps Approval Required for High Assurance IT Equipment Labelling ISM-0332Broader than Label Media With Protective Markings Reflecting Sensitivity Or Classification ISM-0337Supports Ensure Media is Used with Authorised Systems ISM-0378Partially overlaps Remove Labels from Media Before Disposal ISM-0393Depends on Classify Databases Based on Data Sensitivity ISM-0831Supports Ensure Proper Handling of Sensitive Media ISM-0926Broader than Ensure Cables Are Not Salmon Pink or Red ISM-1089Broader than Block Downgrading Protective Markings on Email Replies and Forwards ISM-1107Broader than Colour Restrictions for Wall Outlet Boxes ISM-1216Broader than Ensure Correct Labelling of Non-conformant Cables ISM-1535Supports Prevent Unsuitable Foreign Data Exports ISM-1720Broader than Colour Coding for Secret Wall Outlet Boxes ISM-2094Supports AI Content Filtering to Block Sensitive Data Exposure
Annex A 5.14 Information Transfer Policies and Procedures	Organisational controls	ISM-0231Broader than Visual Indication for Secure Telephone Connections ISM-0240Broader than Prevent Sensitive Data in Messaging Services ISM-0347Broader than Use Write-Once Media for Secure Data Transfers ISM-0467Broader than Using HACE for Secure Communication of Data ISM-0490Broader than Ensure S/MIME 3.0 or Later is Used ISM-0571Broader than Ensure Secure Email Transmission via Gateways ISM-0574Broader than Use SPF to Authorise Email Servers ISM-0626Broader than Implementing CDS for Secure Network Segmentation ISM-0643Broader than Use of Diodes for Unidirectional Gateway Security ISM-0649Broader than Filter Gateway Files for Allowed Types ISM-0660Broader than Monthly Verification of Data Transfer Logs for SECRET Systems ISM-0661Partially overlaps Holding Human Users Accountable for Data Transfers They Perform ISM-0663Equivalent Develop and Maintain Data Transfer Procedures ISM-0675Broader than Ensure Data Exports are Digitally Signed ISM-0677Broader than Ensure File Integrity Through Signature Validation ISM-0861Broader than Enable DKIM Signing for Organisational Emails ISM-0947Broader than Sanitise Media After Data Transfers Between Domains ISM-1024Broader than Verify Senders for Email Failure Notifications ISM-1026Broader than Verification of DKIM Signatures on Incoming Emails ISM-1178Broader than Limit Network Documentation for Third Parties ISM-1277Broader than Encrypt Database and Web Server Communications ISM-1284Broader than Ensure Content Validation for Gateway Files ISM-1502Broader than Block Inbound External Email Spoofing Internal Domains ISM-1535Broader than Prevent Unsuitable Foreign Data Exports ISM-1540Broader than Configuring DMARC for Email Security ISM-1574Partially overlaps Data Portability in Service Contracts ISM-1589Broader than Enable MTA-STS for Secure Email Transport ISM-1778Broader than Quarantine Security-Noncompliant Data for Review ISM-1779Partially overlaps Quarantine Data Failing Security Checks During Manual Export ISM-1799Broader than Enforce Email Rejection for Failed DMARC Checks ISM-1866Partially overlaps Prevent Storing Classified Data on Privately Owned Devices ISM-2097Depends on Configure Mobile Devices with Always On VPN ISM-2098Broader than Prevent Data Transfer Over USB on Mobile Devices
Annex A 5.15 Access Control Policies and Procedures	Organisational controls	ISM-0217Broader than Secure Separation of Non-TOP SECRET and TOP SECRET Panels ISM-0258Partially overlaps Establish and Maintain a Web Usage Policy ISM-0269Broader than Restrict Sensitive Emails to Verified Recipients ISM-0343Broader than Disabling Unnecessary Access to Removable Media ISM-0382Broader than Prevent Unprivileged Human Users Uninstalling or Disabling Approved Applications ISM-0405Broader than Validation for Unprivileged System Access Requests ISM-0407Broader than Maintaining a Secure Lifetime Access Record for Each Human User ISM-0409Supports Restricting Foreign National Access to AUSTEO and REL Systems ISM-0411Broader than Restricting Foreign National Access to Systems Handling AGAO Data ISM-0415Broader than Strictly Controlling Shared Accounts and Identifying Their Users ISM-0418Broader than Keep Physical Credentials Separate from Systems ISM-0428Broader than Session Lock Timing, Content Blocking and Full Re-Authentication for Services ISM-0430Broader than Same-Day Removal or Suspension of Access No Longer Required ISM-0432Broader than Document System Access Requirements in Security Plans ISM-0434Depends on Ensure Personnel Employment Screening and Security Clearance ISM-0441Broader than Restricting Temporary System Access to Data Required for Duties ISM-0443Broader than Restrict Temporary Access to Secure Systems ISM-0447Broader than Restrict Privileged Access for Foreign Nationals ISM-0484Depends on Configure SSH for Secure Server Access ISM-0487Broader than Disable Certain Features for Passwordless SSH Logins ISM-0489Broader than Four-Hour Cached SSH Private Key Lifetime and Screen Locks ISM-0530Broader than Administer VLANs from Trusted Security Domains ISM-0551Broader than Ensure Secure IP Telephony Device Authentication ISM-0610Depends on Training Human Users on Secure CDS Use Before Granting Access ISM-0611Broader than Restrict Privileges for Gateway Administrators ISM-0622Broader than Ensuring Network Authentication via Gateways ISM-0665Broader than CISO Verifies and Authorises Trustworthy Sources for SECRET and TOP SECRET Systems ISM-0687Broader than Use Approved Platforms for Secure Mobile Access ISM-0694Broader than Block Privately Owned Devices From SECRET and TOP SECRET Systems ISM-0854Broader than Access Restrictions for AUSTEO and AGAO Data ISM-1006Broader than Prevent Unauthorised Access to Network Traffic ISM-1014Broader than Implement Individual Logins for Secure IP Phone Use ISM-1182Broader than Implement Network Traffic Control Measures ISM-1250Broader than Limit Server Application User Account Privileges ISM-1255Broader than Restrict Database Content Access by User Duties and Functions ISM-1256Broader than Implement File-Based Access Controls for Databases ISM-1327Partially overlaps Access Controls, Encryption and User Authentication for X.509 Certificates ISM-1392Broader than Restrict File Modifications via Path Rules ISM-1403Broader than Lock Accounts After Five Failed Logon Attempts ISM-1404Broader than Disabling Inactive User Access After 45 Days ISM-1418Broader than Disable Unnecessary Removable Media Access ISM-1420Supports Ensure Non-Production Security Matches Production ISM-1432Broader than Protect Online Services from Domain Hijacking ISM-1439Supports Restrict IP Disclosure in CDNs ISM-1487Broader than Restrict Write Access to Trusted Locations to Macro Vetting Users ISM-1505Broader than Multi-factor Authentication for Human Users of Data Repositories ISM-1508Broader than Restricting Privileged Access to What Duties Require ISM-1530Broader than Secure Classified Equipment in Suitable Security Containers ISM-1604Broader than Harden Software Isolation Mechanisms Sharing Physical Computing Resources ISM-1611Broader than Use Break Glass Accounts Only in Emergencies ISM-1612Broader than Restricted Use of Break Glass Accounts for Emergencies ISM-1649Broader than Implement Just-in-Time Administration for System Access ISM-1746Broader than Restrict File System Permission Changes ISM-1773Depends on Eligibility Criteria for Gateway System Administrators ISM-1813Broader than Prevent Unauthorised User Access to Backup Data ISM-1816Broader than Prevent Unauthorised Changes to Software Sources ISM-1832Broader than SPN Configuration for Active Directory Accounts ISM-1839Broader than Secure Account Properties in Active Directory ISM-1841Broader than Restrict Domain Joining to Admin Users Only ISM-1844Broader than Prevent Non-Controller Accounts from Delegating Services ISM-1852Broader than Limit Unprivileged Access to What Duties Require ISM-1854Broader than Human Users Authenticate to MFDs Before Printing, Scanning or Copying ISM-1865Depends on Compliance with System Usage Policies for Access ISM-1888Broader than Ensure Mobile Devices Have Secure Lock Screens ISM-1920Broader than Blocking MFA Self-Enrolment From Untrustworthy Devices ISM-1927Broader than Limit Identity Server Access to Privileged Users Requiring It ISM-1928Broader than Encrypt and Restrict Access to Microsoft AD and Entra Connect Server Backups ISM-1933Broader than Restrict DCSync Permissions on Service Accounts ISM-1934Broader than Six-Monthly Review and Removal of DCSync User Permissions ISM-1936Broader than Prevent Usage of sIDHistory in User Accounts ISM-1946Broader than Restrict Write Access to Certificate Templates ISM-1948Broader than Certificate Manager Approval for Templates Allowing Supplied SANs ISM-1958Broader than Block DCSync-Permitted Accounts From Logging On To Unprivileged Environments ISM-1985Broader than Protect Event Logs from Unauthorised Access ISM-2014Broader than Ensure API Client Authentication and Authorisation ISM-2048Broader than Restrict Non-Admins from Changing Permissions ISM-2080Partially overlaps No Password Complexity Requirements Enforced ISM-2092Broader than Enforce Fine-Grained Permissions for AI Applications ISM-2093Broader than Role-Based Access Controls in AI Applications ISM-2095Broader than Block Personal Devices Granting AI Agents Access to Sensitive Systems ISM-2098Broader than Prevent Data Transfer Over USB on Mobile Devices ISM-2100Broader than Do Not View Classified Data on Mobile Devices ISM-2112Broader than Disable AI Applications' Direct Access to External Public Data Sources ISM-2124Broader than Restricting Service Provider Access to Approved Tools, Addresses and Time Windows ISM-2128Broader than Limit Kernel-Mode Code Installation to Privileged Users Who Need It ISM-2133Broader than Assign Each AI Agent a Unique Identity Distinct from Personnel Accounts ISM-2135Broader than Recording Identifier, Owner, Identities, Credentials and Access for Each AI Agent ISM-2136Broader than Enforcing Risk-Based Access Decisions Informed by Contextual Signals ISM-2137Broader than Block User OAuth Consent, Reserve It for Authorised Administrators ISM-2138Broader than Six-Monthly Review of OAuth Application Consents and Granted Permissions ISM-2140Broader than Disable OAuth Device Code Flow Unless Required and Restrict Its Use ISM-2149Depends on Develop, Enforce and Maintain an Authorised RMM and Remote Access Tool List ISM-2156Broader than Restrict Agentic AI Applications to Minimum Tools, Functions and Permissions ISM-2157Broader than Agentic AI Tool Calls Limited by User Access and Task-Scoped Authorisation ISM-2165Broader than Fresh EAP-TLS Authentication for Each New Connectivity Association Key
Annex A 5.16 Identity life cycle management	Organisational controls	ISM-0380Partially overlaps Disable Unneeded OS Accounts and Services ISM-0407Broader than Maintaining a Secure Lifetime Access Record for Each Human User ISM-0414Broader than Uniquely Identifying Every User Granted System Access ISM-0415Broader than Strictly Controlling Shared Accounts and Identifying Their Users ISM-0420Broader than Identify Nationality of Foreign Personnel in System ISM-0430Broader than Same-Day Removal or Suspension of Access No Longer Required ISM-0446Partially overlaps Restrict Privileged Access for Foreign Nationals ISM-1583Broader than Ensure Contractors are Identified as Users ISM-1591Broader than Remove or Suspend Access When Users Are Detected Acting Maliciously ISM-1593Broader than Verify User Identity Before Issuing, Resetting, Disabling or Enrolling Credentials ISM-1619Broader than Configure Service Accounts as Managed Service Accounts ISM-1845Broader than Disable User Security Group Access in Active Directory ISM-1920Broader than Blocking MFA Self-Enrolment From Untrustworthy Devices ISM-1934Broader than Six-Monthly Review and Removal of DCSync User Permissions ISM-1943Broader than Enforce Certificate and User Mapping in AD Services ISM-1950Supports Disable Soft Matching After Synchronisation ISM-1951Broader than Disable Hard Match Takeover in Microsoft Entra Connect ISM-2047Broader than Secondary-Channel Notification of Authentication Factor Resets ISM-2053Partially overlaps End of Life Procedures for Software ISM-2133Broader than Assign Each AI Agent a Unique Identity Distinct from Personnel Accounts ISM-2145Broader than Revoke User Account Credentials When No Longer Required ISM-2146Partially overlaps Revoking Static Application and Workload Credentials When No Longer Required ISM-2148Broader than Revoke Sessions and Tokens on Reset, Compromise, Non-Compliance or Risky Sign-In
Annex A 5.17 Management of Authentication Information	Organisational controls	ISM-0383Partially overlaps Change Default OS User Accounts During Setup ISM-0421Partially overlaps Require Minimum 15-Character Passwords for Security ISM-0422Partially overlaps Ensuring Strong Passwords for TOP SECRET Systems ISM-0485Broader than Use Public Key Authentication for SSH Access ISM-0553Partially overlaps Authenticate Video Calls and Manage Settings ISM-0555Partially overlaps Ensure Authentication for IP Telephony Actions ISM-0974Depends on Multi-Factor Authentication for Unprivileged Human Users of Systems ISM-1014Broader than Implement Individual Logins for Secure IP Phone Use ISM-1324Depends on Generating X.509 Certificates With Evaluated CA or HSM ISM-1327Partially overlaps Access Controls, Encryption and User Authentication for X.509 Certificates ISM-1401Supports Multi-Factor Authentication Combines Possession With Knowledge or Inherence ISM-1402Partially overlaps Protecting Stored Credentials with Security Measures ISM-1449Partially overlaps Protect SSH Private Keys with Passwords or Encryption ISM-1557Partially overlaps Ensure Strong Passwords for SECRET Systems ISM-1558Partially overlaps Ensure Secure Construction of Passwords ISM-1559Partially overlaps Minimum Password Length for Secure Systems ISM-1560Broader than Ensure Strong Passwords for SECRET System Authentication ISM-1561Partially overlaps Ensure Strong Passwords for TOP SECRET Systems ISM-1593Partially overlaps Verify User Identity Before Issuing, Resetting, Disabling or Enrolling Credentials ISM-1594Broader than Delivering User Credentials via Secure Channel or Split Parts ISM-1595Broader than Credentials Issued to Human Users Are Changed on First Use ISM-1596Partially overlaps Avoid Reusing Credentials Across Systems ISM-1614Broader than Manage Emergency Account Access Changes ISM-1615Depends on Testing Break Glass Accounts Post Credential Change ISM-1679Depends on Multi-factor Authentication for Third-party Services Handling Sensitive Data ISM-1685Partially overlaps Strengthening Passwords for Critical Accounts ISM-1829Broader than Prevent Password Storage in Group Policy Preferences ISM-1840Broader than Prevent Reversible Encryption of User Passwords ISM-1875Broader than Monthly System Scans to Detect Credentials Stored in the Clear ISM-1888Broader than Ensure Mobile Devices Have Secure Lock Screens ISM-1920Broader than Blocking MFA Self-Enrolment From Untrustworthy Devices ISM-1930Broader than Prevent Storing Passwords in Group Policy Preferences ISM-1953Broader than Ensure Strong Management of Admin Account Credentials ISM-1955Partially overlaps Regularly Change Compromised Credentials ISM-1980Broader than Avoid Using Credential Hints in Systems ISM-2011Broader than Disabling Weaker MFA Options When Phishing-Resistant MFA Is Used ISM-2030Broader than Commit-Time Scanning Blocks Secrets From Source Repositories ISM-2044Broader than Prevent Default Credentials in Software Installations ISM-2047Partially overlaps Secondary-Channel Notification of Authentication Factor Resets ISM-2076Broader than Eliminating Security Questions for Authentication ISM-2078Partially overlaps Ensure Passwords Are Not Common or Compromised ISM-2079Partially overlaps Ensure Password Length is at Least 64 Characters ISM-2080Partially overlaps No Password Complexity Requirements Enforced ISM-2109Partially overlaps Pre-Boot Authentication for Encrypted System Volume Media ISM-2126Partially overlaps Positively Identify Requestors Before Actioning Account, Banking or Payment Requests ISM-2135Partially overlaps Recording Identifier, Owner, Identities, Credentials and Access for Each AI Agent ISM-2136Supports Enforcing Risk-Based Access Decisions Informed by Contextual Signals ISM-2140Partially overlaps Disable OAuth Device Code Flow Unless Required and Restrict Its Use ISM-2141Broader than Prefer Short-Lived Dynamically Issued Credentials for Applications and Workloads ISM-2142Broader than Central Management of Application and Workload Credentials ISM-2143Broader than Unique Per-Application Credentials Not Shared Across Environments ISM-2144Broader than Change Application Static Credentials Found Compromised or Exposed in Clear ISM-2145Partially overlaps Revoke User Account Credentials When No Longer Required ISM-2146Broader than Revoking Static Application and Workload Credentials When No Longer Required ISM-2148Broader than Revoke Sessions and Tokens on Reset, Compromise, Non-Compliance or Risky Sign-In
Annex A 5.18 Managing Access Rights to Information Assets	Organisational controls	ISM-0269Broader than Restrict Sensitive Emails to Verified Recipients ISM-0405Broader than Validation for Unprivileged System Access Requests ISM-0407Broader than Maintaining a Secure Lifetime Access Record for Each Human User ISM-0409Broader than Restricting Foreign National Access to AUSTEO and REL Systems ISM-0411Broader than Restricting Foreign National Access to Systems Handling AGAO Data ISM-0414Depends on Uniquely Identifying Every User Granted System Access ISM-0415Partially overlaps Strictly Controlling Shared Accounts and Identifying Their Users ISM-0430Broader than Same-Day Removal or Suspension of Access No Longer Required ISM-0432Depends on Document System Access Requirements in Security Plans ISM-0441Partially overlaps Restricting Temporary System Access to Data Required for Duties ISM-0443Broader than Restrict Temporary Access to Secure Systems ISM-0446Partially overlaps Restrict Privileged Access for Foreign Nationals ISM-0555Partially overlaps Ensure Authentication for IP Telephony Actions ISM-0610Depends on Training Human Users on Secure CDS Use Before Granting Access ISM-1199Partially overlaps Remove Unnecessary Bluetooth Pairings on Devices ISM-1255Broader than Restrict Database Content Access by User Duties and Functions ISM-1268Partially overlaps Enforce Need-to-Know Access in Databases ISM-1327Broader than Access Controls, Encryption and User Authentication for X.509 Certificates ISM-1392Broader than Restrict File Modifications via Path Rules ISM-1404Broader than Disabling Inactive User Access After 45 Days ISM-1422Depends on Prevent Unauthorised Access to Software Source ISM-1487Broader than Restrict Write Access to Trusted Locations to Macro Vetting Users ISM-1590Broader than Changing User Account Credentials After Compromise, Exposure or Shared Membership Change ISM-1591Broader than Remove or Suspend Access When Users Are Detected Acting Maliciously ISM-1612Partially overlaps Restricted Use of Break Glass Accounts for Emergencies ISM-1647Broader than Disable Privileged Access After 12 Months ISM-1648Broader than Disabling Inactive Privileged Access to Systems ISM-1649Broader than Implement Just-in-Time Administration for System Access ISM-1812Broader than Restrict Backup Access to Unprivileged Users ISM-1833Partially overlaps Limit Privileges for User Accounts in Active Directory ISM-1841Supports Restrict Domain Joining to Admin Users Only ISM-1843Broader than Annual Review of Unconstrained Delegation in AD Accounts ISM-1845Broader than Disable User Security Group Access in Active Directory ISM-1846Broader than Restrict Pre-Windows 2000 Access Group Membership ISM-1852Broader than Limit Unprivileged Access to What Duties Require ISM-1927Broader than Limit Identity Server Access to Privileged Users Requiring It ISM-1933Broader than Restrict DCSync Permissions on Service Accounts ISM-1934Broader than Six-Monthly Review and Removal of DCSync User Permissions ISM-1940Broader than Restrict Service Accounts from Privileged Groups ISM-1946Broader than Restrict Write Access to Certificate Templates ISM-1958Broader than Block DCSync-Permitted Accounts From Logging On To Unprivileged Environments ISM-2048Supports Restrict Non-Admins from Changing Permissions ISM-2049Broader than Enforcing Re-authentication After Permission Changes ISM-2092Broader than Enforce Fine-Grained Permissions for AI Applications ISM-2093Partially overlaps Role-Based Access Controls in AI Applications ISM-2095Broader than Block Personal Devices Granting AI Agents Access to Sensitive Systems ISM-2124Partially overlaps Restricting Service Provider Access to Approved Tools, Addresses and Time Windows ISM-2126Partially overlaps Positively Identify Requestors Before Actioning Account, Banking or Payment Requests ISM-2131Depends on Quarterly Certificate Template Reviews to Remediate Misconfigurations ISM-2133Depends on Assign Each AI Agent a Unique Identity Distinct from Personnel Accounts ISM-2135Depends on Recording Identifier, Owner, Identities, Credentials and Access for Each AI Agent ISM-2136Partially overlaps Enforcing Risk-Based Access Decisions Informed by Contextual Signals ISM-2137Broader than Block User OAuth Consent, Reserve It for Authorised Administrators ISM-2138Equivalent Six-Monthly Review of OAuth Application Consents and Granted Permissions ISM-2146Broader than Revoking Static Application and Workload Credentials When No Longer Required ISM-2156Broader than Restrict Agentic AI Applications to Minimum Tools, Functions and Permissions
Annex A 5.19 Managing Information Security in Supplier Relationships	Organisational controls	ISM-0072Partially overlaps Document Security Requirements in Contractual Arrangements ISM-0141Broader than Report Cyber Incidents Promptly to Designated Contacts ISM-0280Broader than Choose PP-evaluated Products Over EAL-based Ones ISM-0285Broader than Ensuring Evaluated Products Follow Delivery Procedures ISM-0307Partially overlaps Sanitise Equipment When Not Using Cleared Technician ISM-0731Partially meets CISO Oversight of Cyber Supply Chain Risks ISM-0840Broader than Certified Services for Outsourced Media Destruction ISM-1073Broader than Ensure Provider Contracts for System Access ISM-1178Broader than Limit Network Documentation for Third Parties ISM-1395Partially overlaps Ensuring Data Protection by Service Providers ISM-1451Broader than Document Data Ownership in Service Contracts ISM-1452Broader than Perform Supply Chain Risk Assessments for System Suppliers ISM-1480Supports Ensure High Assurance for Peripheral Switches ISM-1567Broader than Avoid High-Risk Suppliers in Cyber Supply Chain ISM-1568Broader than Ensure Security Commitment from Suppliers ISM-1569Partially overlaps Document and Share a Supplier Customer Shared Responsibility Model ISM-1570Partially overlaps Regular IRAP Assessment of Cloud Service Providers ISM-1571Partially meets Verify Security Compliance in Service Contracts ISM-1572Broader than Document Service Provider Data Handling and Change Notifications ISM-1573Broader than Log Access Documentation with Service Providers ISM-1574Broader than Data Portability in Service Contracts ISM-1575Broader than One-Month Notice for Service Termination ISM-1576Partially overlaps Treating Unauthorised Service Provider Access as a Reportable Incident ISM-1577Supports Ensure Network Segregation from Service Providers ISM-1631Broader than Identify Suppliers in Cyber Supply Chain ISM-1632Broader than Ensure Secure Procurement from Reliable Suppliers ISM-1637Broader than Maintain an Outsourced Cloud Service Register ISM-1638Supports Outsourced Cloud Service Register Recording Eight Required Details ISM-1736Supports Maintain and Verify Managed Service Register ISM-1737Supports Recording Required Details for Each Managed Service in the Register ISM-1738Partially overlaps Verify Compliance with Security Requirements ISM-1785Partially overlaps Develop and Maintain Supplier Management Policy ISM-1786Broader than Maintain an Approved Supplier List ISM-1787Broader than Ensure Suppliers are Approved for IT and OT Sourcing ISM-1788Broader than Identify Multiple Suppliers for Critical IT Sourcing ISM-1789Broader than Maintain Reserve Spares of Critical IT and OT Equipment ISM-1790Broader than Ensure Integrity in IT and OT Deliveries ISM-1791Broader than Assess Integrity of Delivered IT and OT Products ISM-1793Broader than Regular Assessment of Managed Service Providers ISM-1794Broader than Notify Significant Changes to Service Provider Agreements ISM-1804Broader than Include Break Clauses in Cloud Service Contracts ISM-1826Broader than Select Vendors Committed to Secure Design for Servers ISM-1882Broader than Procurement from Transparent Suppliers ISM-1972Partially overlaps ASD Security Control Assessment of TOP SECRET Cloud Services Every 24 Months ISM-2027Supports Verify Software Artefacts with Digital Signatures ISM-2082Broader than Using Cryptographic BOM in Software Development
Annex A 5.20 Integrating security clauses in supplier agreements	Organisational controls	ISM-0072Equivalent Document Security Requirements in Contractual Arrangements ISM-0141Broader than Report Cyber Incidents Promptly to Designated Contacts ISM-1178Partially overlaps Limit Network Documentation for Third Parties ISM-1395Depends on Ensuring Data Protection by Service Providers ISM-1451Broader than Document Data Ownership in Service Contracts ISM-1568Partially overlaps Ensure Security Commitment from Suppliers ISM-1569Partially overlaps Document and Share a Supplier Customer Shared Responsibility Model ISM-1571Broader than Verify Security Compliance in Service Contracts ISM-1572Broader than Document Service Provider Data Handling and Change Notifications ISM-1575Broader than One-Month Notice for Service Termination ISM-1576Supports Treating Unauthorised Service Provider Access as a Reportable Incident ISM-1631Depends on Identify Suppliers in Cyber Supply Chain ISM-1737Partially overlaps Recording Required Details for Each Managed Service in the Register ISM-1738Partially meets Verify Compliance with Security Requirements ISM-1785Supports Develop and Maintain Supplier Management Policy ISM-1786Partially meets Maintain an Approved Supplier List ISM-1793Depends on Regular Assessment of Managed Service Providers ISM-1794Broader than Notify Significant Changes to Service Provider Agreements ISM-1804Broader than Include Break Clauses in Cloud Service Contracts ISM-1882Partially overlaps Procurement from Transparent Suppliers
Annex A 5.21 Managing Information Security in the ICT Supply Chain	Organisational controls	ISM-0039Partially overlaps Develop and Maintain a Cyber Security Strategy ISM-0072Partially meets Document Security Requirements in Contractual Arrangements ISM-0280Broader than Choose PP-evaluated Products Over EAL-based Ones ISM-0285Broader than Ensuring Evaluated Products Follow Delivery Procedures ISM-0286Partially overlaps Consult ASD for High Assurance IT Delivery Procedures ISM-0305Partially overlaps On-Site IT Equipment Maintenance by Cleared Technicians ISM-0731Broader than CISO Oversight of Cyber Supply Chain Risks ISM-0840Broader than Certified Services for Outsourced Media Destruction ISM-0938Broader than Select Secure-by-Design Committed Vendors ISM-1073Partially overlaps Ensure Provider Contracts for System Access ISM-1195Depends on Enforce Policy with Evaluated Mobile Device Management ISM-1395Broader than Ensuring Data Protection by Service Providers ISM-1452Equivalent Perform Supply Chain Risk Assessments for System Suppliers ISM-1567Broader than Avoid High-Risk Suppliers in Cyber Supply Chain ISM-1568Broader than Ensure Security Commitment from Suppliers ISM-1570Partially overlaps Regular IRAP Assessment of Cloud Service Providers ISM-1631Supports Identify Suppliers in Cyber Supply Chain ISM-1632Broader than Ensure Secure Procurement from Reliable Suppliers ISM-1638Depends on Outsourced Cloud Service Register Recording Eight Required Details ISM-1736Depends on Maintain and Verify Managed Service Register ISM-1737Broader than Recording Required Details for Each Managed Service in the Register ISM-1738Partially overlaps Verify Compliance with Security Requirements ISM-1743Broader than Choose Secure Operating System Vendors ISM-1786Broader than Maintain an Approved Supplier List ISM-1787Broader than Ensure Suppliers are Approved for IT and OT Sourcing ISM-1788Broader than Identify Multiple Suppliers for Critical IT Sourcing ISM-1789Broader than Maintain Reserve Spares of Critical IT and OT Equipment ISM-1790Broader than Ensure Integrity in IT and OT Deliveries ISM-1791Broader than Assess Integrity of Delivered IT and OT Products ISM-1792Broader than Assess Authenticity of IT and OT Deliveries ISM-1797Depends on Ensure Software Updates are Securely Signed ISM-1800Broader than Ensure Network Devices Have Trusted Firmware ISM-1804Partially meets Include Break Clauses in Cloud Service Contracts ISM-1826Broader than Select Vendors Committed to Secure Design for Servers ISM-1882Broader than Procurement from Transparent Suppliers ISM-1972Partially overlaps ASD Security Control Assessment of TOP SECRET Cloud Services Every 24 Months ISM-2023Broader than Maintain a Reliable Source for Software ISM-2026Broader than Scan Software Artefacts for Malicious Content ISM-2027Broader than Verify Software Artefacts with Digital Signatures ISM-2029Broader than Restrict Third-Party Libraries to Trustworthy Sources ISM-2082Broader than Using Cryptographic BOM in Software Development ISM-2083Depends on Provide a Cryptographic Bill of Materials to Software Users ISM-2086Broader than Verify Integrity of AI Models, Structures, and Weights ISM-2087Partially overlaps Verify the Source and Integrity of AI Training Data ISM-2124Depends on Restricting Service Provider Access to Approved Tools, Addresses and Time Windows ISM-2125Depends on Independently Log and Analyse All Service Provider System Access ISM-2154Broader than Pinning Software Artefact Dependencies to Approved Versions in Source Code ISM-2155Depends on Reproducible Builds Enabling Independent Verification of Release Artefacts
Annex A 5.22 Monitoring and Managing Supplier Services	Organisational controls	ISM-0072Depends on Document Security Requirements in Contractual Arrangements ISM-0731Partially meets CISO Oversight of Cyber Supply Chain Risks ISM-1073Partially overlaps Ensure Provider Contracts for System Access ISM-1395Partially overlaps Ensuring Data Protection by Service Providers ISM-1452Partially overlaps Perform Supply Chain Risk Assessments for System Suppliers ISM-1567Supports Avoid High-Risk Suppliers in Cyber Supply Chain ISM-1570Partially overlaps Regular IRAP Assessment of Cloud Service Providers ISM-1571Depends on Verify Security Compliance in Service Contracts ISM-1631Depends on Identify Suppliers in Cyber Supply Chain ISM-1637Supports Maintain an Outsourced Cloud Service Register ISM-1638Depends on Outsourced Cloud Service Register Recording Eight Required Details ISM-1736Depends on Maintain and Verify Managed Service Register ISM-1737Supports Recording Required Details for Each Managed Service in the Register ISM-1738Partially overlaps Verify Compliance with Security Requirements ISM-1786Partially meets Maintain an Approved Supplier List ISM-1787Supports Ensure Suppliers are Approved for IT and OT Sourcing ISM-1790Supports Ensure Integrity in IT and OT Deliveries ISM-1793Broader than Regular Assessment of Managed Service Providers ISM-1794Broader than Notify Significant Changes to Service Provider Agreements ISM-1826Broader than Select Vendors Committed to Secure Design for Servers ISM-1882Partially overlaps Procurement from Transparent Suppliers ISM-1972Partially overlaps ASD Security Control Assessment of TOP SECRET Cloud Services Every 24 Months ISM-2125Broader than Independently Log and Analyse All Service Provider System Access
Annex A 5.23 Cloud Service Security Management	Organisational controls	ISM-1437Broader than Utilising Cloud Providers for Hosting Online Services ISM-1529Partially overlaps Limit Cloud Services to Community or Private for SECRETS ISM-1638Supports Outsourced Cloud Service Register Recording Eight Required Details
Annex A 5.24 Information security incident management planning and preparation	Organisational controls	ISM-0043Partially overlaps Cyber Security Incident Response Plan Requirements ISM-0123Broader than Report Cyber Security Incidents Promptly ISM-0125Broader than Maintaining a Cyber Security Incident Register ISM-0137Broader than Seek Legal Advice for Intrusion Evidence Collection ISM-0714Partially overlaps Appoint a CISO to Lead Cyber Security Across IT and OT ISM-0733Partially overlaps Ensure CISO Awareness of Cyber Incidents ISM-1019Broader than Develop a Denial of Service Response Plan ISM-1088Partially meets Report Potential Compromises of Mobile Devices Overseas ISM-1576Partially overlaps Treating Unauthorised Service Provider Access as a Reportable Incident ISM-1618Partially overlaps CISO's Role in Cyber Security Incident Response ISM-1731Broader than Plan and Coordinate Intrusion Remediation From Trusted Separate Systems ISM-1784Partially overlaps Annual Testing of Cyber Incident Response Plan ISM-1819Broader than Enact Cyber Security Incident Response Plans ISM-1881Supports Timely Reporting of Cyber Incidents Without Data Breach ISM-1997Partially overlaps Define Cyber Security Roles for Leadership ISM-2006Partially overlaps Board Plans for Major Cyber Security Incidents
Annex A 5.25 Assessment and decision on information security events	Organisational controls	ISM-0043Supports Cyber Security Incident Response Plan Requirements ISM-1228Equivalent Analyse Cyber Security Events Promptly ISM-2116Depends on Use Cyber Threat Intelligence for Event Detection ISM-2132Depends on Central Logging of Certificate Enrolment Requests, Template and AD CS Configuration Changes ISM-2148Partially overlaps Revoke Sessions and Tokens on Reset, Compromise, Non-Compliance or Risky Sign-In
Annex A 5.26 Response to Information Security Incidents	Organisational controls	ISM-0043Depends on Cyber Security Incident Response Plan Requirements ISM-0123Broader than Report Cyber Security Incidents Promptly ISM-0137Broader than Seek Legal Advice for Intrusion Evidence Collection ISM-0138Broader than Maintaining Integrity of Evidence in Investigations ISM-0576Partially overlaps Develop and Maintain Cyber Security Incident Plans ISM-0917Broader than Procedures for Handling Malicious Code Infections ISM-1213Broader than Enhanced Monitoring After Intrusion Remediation Until Eradication Is Confirmed ISM-1591Broader than Remove or Suspend Access When Users Are Detected Acting Maliciously ISM-1609Broader than Consult System Owners Before Continuing Intrusions ISM-1618Supports CISO's Role in Cyber Security Incident Response ISM-1731Broader than Plan and Coordinate Intrusion Remediation From Trusted Separate Systems ISM-1732Partially overlaps Coordinating and Sequencing Intrusion Remediation to Prevent Re-Compromise ISM-1784Supports Annual Testing of Cyber Incident Response Plan ISM-1803Partially overlaps Document and Report Cyber Security Incidents ISM-1880Broader than Timely Reporting of Cyber Incidents Involving Customer Data ISM-1955Supports Regularly Change Compromised Credentials ISM-1956Partially overlaps Regularly Update AD FS Certificates to Prevent Risks ISM-2006Depends on Board Plans for Major Cyber Security Incidents ISM-2106Partially overlaps Advise Staff to Limit Posting Work Skills Online
Annex A 5.27 Learning from information security incidents	Organisational controls	ISM-0125Depends on Maintaining a Cyber Security Incident Register ISM-0576Supports Develop and Maintain Cyber Security Incident Plans
Annex A 5.28 Procedures for Collecting and Preserving Evidence	Organisational controls	ISM-0043Partially overlaps Cyber Security Incident Response Plan Requirements ISM-0137Partially overlaps Seek Legal Advice for Intrusion Evidence Collection ISM-0138Partially overlaps Maintaining Integrity of Evidence in Investigations ISM-0580Partially overlaps Develop, Implement and Maintain a Security Monitoring Policy ISM-0988Supports Ensure Accurate Time Source for Event Logs ISM-1537Depends on Log Security-Relevant Database Events Centrally ISM-1566Supports Central Logging of Unprivileged System Access ISM-1609Partially overlaps Consult System Owners Before Continuing Intrusions ISM-1623Supports Centralised Logging of PowerShell Activities ISM-1731Partially overlaps Plan and Coordinate Intrusion Remediation From Trusted Separate Systems ISM-1819Depends on Enact Cyber Security Incident Response Plans ISM-1976Supports Central Logging of Security Events on macOS ISM-1988Depends on Ensure Event Logs Are Retained for 12 Months ISM-2051Partially overlaps Ensure Event Logs for Cyber security Event Detection ISM-2159Depends on Centrally Log Agentic AI Tool Invocations, External Requests and Outputs
Annex A 5.29 Maintain information security during disruptions	Organisational controls	ISM-0043Partially overlaps Cyber Security Incident Response Plan Requirements ISM-0570Depends on Maintain Backup Email Gateways to Primary Standards ISM-0576Partially overlaps Develop and Maintain Cyber Security Incident Plans ISM-0734Partially overlaps CISO Role in Disaster Recovery Planning ISM-2006Depends on Board Plans for Major Cyber Security Incidents
Annex A 5.30 ICT Readiness for Business Continuity	Organisational controls	ISM-0734Broader than CISO Role in Disaster Recovery Planning ISM-1019Partially meets Develop a Denial of Service Response Plan ISM-1123Supports Ensure UPS Powers All Top Secret IT Equipment ISM-1431Partially overlaps Strategies for Mitigating Denial-of-Service Attacks ISM-1438Broader than Ensure High Availability by Using CDNs ISM-1511Partially overlaps Conduct and Maintain Regular Data Backups ISM-1547Partially overlaps Develop and Maintain Data Backup Procedures ISM-1548Broader than Develop and Maintain Data Restoration Processes ISM-1580Partially overlaps Ensure High Availability for Online Services ISM-1610Broader than Document and Test Emergency System Access Procedures ISM-1615Depends on Testing Break Glass Accounts Post Credential Change ISM-1633Depends on Determine System Boundary, Criticality and Security Objectives ISM-1805Partially overlaps Develop a Denial of Service Response Plan
Annex A 5.31 Compliance with Information Security Legal Requirements	Organisational controls	ISM-0181Depends on Ensure Cabling Meets Australian Standards ISM-0499Depends on Ensure Compliance with ASD Communication Security Policies ISM-1297Broader than Seek Legal Advice for Personal Device Access ISM-1478Partially overlaps CISO Management of Cyber Security Compliance ISM-1626Broader than Seek Legal Advice for Insider Threat Plans
Annex A 5.32 Intellectual Property Rights Protection	Organisational controls	No direct ASD ISM equivalent
Annex A 5.33 Protection of Records	Organisational controls	ISM-0407Partially overlaps Maintaining a Secure Lifetime Access Record for Each Human User ISM-1586Partially overlaps Record All Data Imports and Exports ISM-1815Broader than Protect Event Logs from Unauthorised Access ISM-1985Broader than Protect Event Logs from Unauthorised Access ISM-1989Broader than Ensure Event Logs Meet Retention Requirements
Annex A 5.34 Privacy and Protection of Personally Identifiable Information	Organisational controls	ISM-1268Supports Enforce Need-to-Know Access in Databases ISM-1395Partially overlaps Ensuring Data Protection by Service Providers ISM-1880Partially overlaps Timely Reporting of Cyber Incidents Involving Customer Data ISM-2021Partially overlaps Implement and Maintain Data Minimisation Practices ISM-2046Supports Ensure Secure Impersonation Logging Practices ISM-2103Partially overlaps AI Data Use Requires Explicit Owner Consent
Annex A 5.35 Independent review of information security	Organisational controls	ISM-0100Broader than Regular IRAP Assessment of Sensitive Gateways ISM-1037Partially overlaps Regular Testing of Gateway Security Configurations ISM-1563Partially overlaps Assessor Produces Security Assessment Report Covering Required Content ISM-1564Supports System Owner Produces Plan of Action and Milestones After Assessment ISM-1587Partially overlaps Annual Security Status Reporting for Systems ISM-1617Partially overlaps Regular Review of Cyber Security Program ISM-1636Partially overlaps Security Control Assessment of Systems by Own or IRAP Assessors ISM-1793Broader than Regular Assessment of Managed Service Providers ISM-1918Partially overlaps Regular Cyber Security Reporting to Audit Committee ISM-1967Partially overlaps ASD Assessor Security Control Assessment of TOP SECRET Systems ISM-1972Broader than ASD Security Control Assessment of TOP SECRET Cloud Services Every 24 Months ISM-2019Broader than ASD Assessment of TOP SECRET Gateways Every 24 Months
Annex A 5.36 Review compliance with information security policies	Organisational controls	ISM-0072Partially overlaps Document Security Requirements in Contractual Arrangements ISM-0718Partially overlaps CISO Reporting to Board on Cyber Security ISM-1037Broader than Regular Testing of Gateway Security Configurations ISM-1078Supports Develop and Maintain Telephone System Usage Policy ISM-1478Partially overlaps CISO Management of Cyber Security Compliance ISM-1523Broader than Regular Assessment of Security Events in CDS ISM-1738Partially overlaps Verify Compliance with Security Requirements ISM-1971Partially overlaps ASD-Led Security Assessment of TOP SECRET Managed Services Every 24 Months
Annex A 5.37 Documented Operating Procedures for Information Processing	Organisational controls	ISM-0042Broader than Maintain Effective System Administration Practices ISM-0206Broader than Develop and Maintain Cable Labelling Processes ISM-0348Broader than Develop and Maintain Media Sanitisation Procedures ISM-0576Partially overlaps Develop and Maintain Cyber Security Incident Plans ISM-0888Partially overlaps Annual Review of Cyber Security Documentation ISM-0912Partially overlaps Establish and Manage System Configuration Changes ISM-1602Partially overlaps Ensure Cyber Security Docs Are Communicated
Annex A 6.1 Personnel Background Verification	People controls	ISM-0434Partially overlaps Ensure Personnel Employment Screening and Security Clearance ISM-0613Broader than Requirement for Gateway System Administrators Nationality ISM-1520Broader than Employment Screening for Gateway Administrators ISM-1625Partially meets Develop Insider Threat Mitigation Programs ISM-1773Broader than Eligibility Criteria for Gateway System Administrators
Annex A 6.2 Terms and conditions of employment for security	People controls	ISM-2035Partially overlaps Document Security Roles for Software Development ISM-2036Partially overlaps Document Security Duties for Software Developers
Annex A 6.3 Information security awareness, education and training program	People controls	ISM-0229Broader than Guidelines for Discussing Sensitive Information Over Phones ISM-0230Broader than Advising on Risks of Non-Secure Telephone Systems ISM-0252Partially overlaps Annual Cyber Security Awareness for Personnel ISM-0435Broader than Pre-Access Briefings for System Resources ISM-0610Broader than Training Human Users on Secure CDS Use Before Granting Access ISM-0612Broader than Training for Gateway System Administrators ISM-0720Depends on Develop and Maintain a Cyber Security Communication Strategy ISM-0735Depends on CISO Oversees the Cyber Security Awareness Training Program ISM-0817Broader than Reporting Suspicious Online Contact Awareness ISM-0821Broader than Advise on Risks of Posting Personal Information Online ISM-0824Broader than Avoid Using Unauthorised Online File Services ISM-1083Broader than Advise Personnel on Mobile Communication Sensitivity ISM-1146Broader than Separate Personal and Work Accounts for Online Services ISM-1298Broader than Advise Personnel on Overseas Mobile Device Security ISM-1554Partially overlaps Guidelines for Using Mobile Devices Abroad ISM-1565Broader than Annual Tailored Training for All Privileged Access Holders ISM-1602Partially overlaps Ensure Cyber Security Docs Are Communicated ISM-1644Partially meets Secure Communication Practices in Public Areas ISM-1740Broader than Manage and Report Business Email Compromise ISM-1864Supports Develop and Enforce a System Usage Policy ISM-2002Broader than Ensure Board Cyber Security Literacy for Compliance ISM-2004Supports Enhancing Cyber Security Skills and Experience ISM-2022Broader than Develop and Maintain Cyber Security Training Register ISM-2035Partially overlaps Document Security Roles for Software Development ISM-2037Broader than Train Software Developers Lacking Cyber Security Skills ISM-2038Supports Maintain a Software Developer Cyber Security Knowledge and Skills Register ISM-2071Broader than Training on Managing Social Engineering Threats ISM-2104Broader than Do Not Post Security Clearance and Briefing Details Online ISM-2105Broader than Advise Staff to Limit Posting Work Information on Unauthorised Online Services ISM-2106Broader than Advise Staff to Limit Posting Work Skills Online ISM-2107Broader than Restrict Personal Information Viewing Online ISM-2121Partially overlaps Prevent Using Developers Without Cyber Security Skills
Annex A 6.4 Disciplinary Process for Information Security Violations	People controls	ISM-0661Supports Holding Human Users Accountable for Data Transfers They Perform ISM-1864Supports Develop and Enforce a System Usage Policy
Annex A 6.5 Responsibilities after employment termination or role change	People controls	ISM-0430Partially overlaps Same-Day Removal or Suspension of Access No Longer Required ISM-1569Partially overlaps Document and Share a Supplier Customer Shared Responsibility Model
Annex A 6.6 Confidentiality and Non-disclosure Agreements	People controls	ISM-0072Partially overlaps Document Security Requirements in Contractual Arrangements
Annex A 6.7 Remote Working Security Measures	People controls	ISM-0467Depends on Using HACE for Secure Communication of Data ISM-0694Broader than Block Privately Owned Devices From SECRET and TOP SECRET Systems ISM-0705Broader than Disable Split Tunnelling for VPN Connections ISM-0871Supports Supervise Mobile Devices During Active Use ISM-1084Supports Transporting Mobile Devices Securely ISM-1400Partially overlaps Enforce Data Separation on Personal Devices ISM-1482Partially overlaps Ensure Separation of Classified and Personal Data on Devices ISM-1504Partially meets Multi-Factor Authentication for Human Users of Sensitive Data Online Services ISM-1554Broader than Guidelines for Using Mobile Devices Abroad ISM-1866Partially overlaps Prevent Storing Classified Data on Privately Owned Devices ISM-1887Broader than Implement Remote Locate and Wipe for Mobile Security ISM-2096Depends on Separate Organisational and Personal Mobile Data ISM-2101Broader than Restrict Sensitive Conversations Near Vehicles
Annex A 6.8 Mechanisms for Reporting Security Events	People controls	ISM-0043Partially overlaps Cyber Security Incident Response Plan Requirements ISM-0123Partially overlaps Report Cyber Security Incidents Promptly ISM-0125Partially overlaps Maintaining a Cyber Security Incident Register ISM-0142Broader than Report Cryptographic Equipment Compromises Promptly ISM-0252Supports Annual Cyber Security Awareness for Personnel ISM-0820Broader than Avoid Posting Work Data on Unauthorised Online Services ISM-1088Partially overlaps Report Potential Compromises of Mobile Devices Overseas ISM-1740Depends on Manage and Report Business Email Compromise ISM-1803Partially overlaps Document and Report Cyber Security Incidents ISM-1880Partially overlaps Timely Reporting of Cyber Incidents Involving Customer Data ISM-2071Partially overlaps Training on Managing Social Engineering Threats ISM-2105Partially overlaps Advise Staff to Limit Posting Work Information on Unauthorised Online Services
Annex A 7.1 Physical Security Perimeters	Physical controls	ISM-0225Broader than Prevent Unauthorised RF and IR Device Entry ISM-0810Broader than Secure Facilities Based on System Classification ISM-0813Supports Ensure Secure Access to Critical Infrastructure ISM-0829Broader than Detect Unauthorised RF Devices in Secure Areas ISM-1053Broader than Secure Physical Access for Classified Equipment ISM-1074Partially meets Controlling Access to Critical IT Infrastructure ISM-1098Broader than Segregate SECRET Cable Terminations Using Individual Cabinets or Division Plates ISM-1137Partially overlaps Request Risk Assessment for Emanation Security ISM-1296Partially overlaps Protect Network Devices in Public Areas ISM-1974Broader than Securing Non-Classified IT Equipment in Secure Rooms ISM-1975Supports Secure Non-Classified Equipment in Safe Containers ISM-2070Supports Control Access to Recording Devices in Secure Areas
Annex A 7.2 Physical access controls for secure areas	Physical controls	ISM-0164Partially meets Prevent Unauthorised Viewing of System Displays ISM-0225Broader than Prevent Unauthorised RF and IR Device Entry ISM-0306Partially overlaps Escort Uncleared Technicians During IT Equipment Maintenance or Repairs ISM-0810Broader than Secure Facilities Based on System Classification ISM-0813Partially overlaps Ensure Secure Access to Critical Infrastructure ISM-1053Partially overlaps Secure Physical Access for Classified Equipment ISM-1074Partially overlaps Controlling Access to Critical IT Infrastructure ISM-1296Partially overlaps Protect Network Devices in Public Areas ISM-1327Partially overlaps Access Controls, Encryption and User Authentication for X.509 Certificates ISM-1973Partially overlaps Secure Facilities for Non-Classified Systems ISM-1974Supports Securing Non-Classified IT Equipment in Secure Rooms ISM-2007Supports Authorised Medical Device Register for SECRET and TOP SECRET Areas ISM-2070Broader than Control Access to Recording Devices in Secure Areas
Annex A 7.3 Physical Security for Offices and Facilities	Physical controls	ISM-0164Broader than Prevent Unauthorised Viewing of System Displays ISM-0198Broader than Consultation for Penetrating Audio Secure Rooms ISM-0810Broader than Secure Facilities Based on System Classification ISM-0813Broader than Ensure Secure Access to Critical Infrastructure ISM-1053Broader than Secure Physical Access for Classified Equipment ISM-1107Broader than Colour Restrictions for Wall Outlet Boxes ISM-1164Broader than Use Clear Plastic for Shared Facility Cabling Covers ISM-1296Broader than Protect Network Devices in Public Areas ISM-1327Partially overlaps Access Controls, Encryption and User Authentication for X.509 Certificates ISM-1973Broader than Secure Facilities for Non-Classified Systems ISM-1974Broader than Securing Non-Classified IT Equipment in Secure Rooms
Annex A 7.4 Continuous monitoring of physical access to premises	Physical controls	ISM-1053Partially overlaps Secure Physical Access for Classified Equipment ISM-1973Supports Secure Facilities for Non-Classified Systems
Annex A 7.5 Protecting against physical and environmental threats	Physical controls	ISM-0194Broader than Sealing Conduit Joints in Shared Facilities ISM-0195Broader than Seal Removable Covers on TOP SECRET Cables ISM-0216Broader than Ensure Separate Cabinets for TOP SECRET Patch Panels ISM-0734Partially overlaps CISO Role in Disaster Recovery Planning ISM-0810Supports Secure Facilities Based on System Classification ISM-0813Broader than Ensure Secure Access to Critical Infrastructure ISM-1053Supports Secure Physical Access for Classified Equipment ISM-1074Broader than Controlling Access to Critical IT Infrastructure ISM-1116Broader than Ensure Separation Between Top Secret and Other Cabinets ISM-1119Partially overlaps Ensure Cables in TOP SECRET Areas are Inspectable ISM-1164Broader than Use Clear Plastic for Shared Facility Cabling Covers ISM-1296Partially overlaps Protect Network Devices in Public Areas ISM-1645Broader than Maintain and Verify Floor Plan Diagrams ISM-1973Broader than Secure Facilities for Non-Classified Systems
Annex A 7.6 Security Measures for Working in Secure Areas	Physical controls	ISM-0164Broader than Prevent Unauthorised Viewing of System Displays ISM-0225Broader than Prevent Unauthorised RF and IR Device Entry ISM-0235Broader than Use of Speakerphones in TOP SECRET Areas ISM-0236Broader than Implement Off-hook Audio Protection on Telephones ISM-0559Broader than Restrict Microphone and Webcam Use in SECRET Areas ISM-0810Partially overlaps Secure Facilities Based on System Classification ISM-0829Broader than Detect Unauthorised RF Devices in Secure Areas ISM-0931Broader than Off-hook Audio Protection Using Push-to-Talk Devices ISM-1013Broader than Limit Wireless Range with RF Shielding ISM-1101Broader than Terminate Cabling Closely in Top Secret Areas ISM-1103Broader than Terminate Cables Outside Cabinets in Secure Areas ISM-1137Partially overlaps Request Risk Assessment for Emanation Security ISM-1296Partially overlaps Protect Network Devices in Public Areas ISM-1450Broader than Restricting Devices in Top Secret Areas ISM-1635Partially meets System Owners Implement Security Controls for Each System and Environment ISM-1973Partially overlaps Secure Facilities for Non-Classified Systems ISM-2008Broader than Criteria for Medical Devices in SECRET and TOP SECRET Areas ISM-2009Broader than Restrict Medical Devices in SECRET and TOP SECRET Areas ISM-2069Broader than Maintain Register of Authorised Recording Devices in SECRET and TOP SECRET Areas ISM-2070Broader than Control Access to Recording Devices in Secure Areas
Annex A 7.7 Clear desk and clear screen policies	Physical controls	ISM-0161Partially overlaps Ensure Security of Unused IT Equipment and Media ISM-0164Partially overlaps Prevent Unauthorised Viewing of System Displays ISM-0831Partially overlaps Ensure Proper Handling of Sensitive Media ISM-0866Partially overlaps Ensure Privacy While Viewing Data in Public ISM-0870Partially overlaps Secure Storage and Handling of Mobile Devices ISM-1145Partially overlaps Apply Privacy Filters to Protect Device Screens ISM-1359Partially overlaps Establish and Maintain Removable Media Policy ISM-1888Broader than Ensure Mobile Devices Have Secure Lock Screens ISM-2012Partially overlaps Enforced Screen Lock With Full Re-Authentication After Inactivity
Annex A 7.8 Equipment Siting and Protection	Physical controls	ISM-0161Partially overlaps Ensure Security of Unused IT Equipment and Media ISM-0164Partially overlaps Prevent Unauthorised Viewing of System Displays ISM-0216Partially overlaps Ensure Separate Cabinets for TOP SECRET Patch Panels ISM-0810Partially overlaps Secure Facilities Based on System Classification ISM-0813Partially overlaps Ensure Secure Access to Critical Infrastructure ISM-0870Partially overlaps Secure Storage and Handling of Mobile Devices ISM-1036Broader than Place Multifunction Devices Where Their Use Can Be Observed ISM-1053Partially overlaps Secure Physical Access for Classified Equipment ISM-1074Partially overlaps Controlling Access to Critical IT Infrastructure ISM-1109Broader than Ensure Clear Plastic Covers for Wall Outlets ISM-1116Broader than Ensure Separation Between Top Secret and Other Cabinets ISM-1119Partially overlaps Ensure Cables in TOP SECRET Areas are Inspectable ISM-1296Broader than Protect Network Devices in Public Areas ISM-1599Partially overlaps Proper Handling of Sensitive IT Equipment ISM-1884Partially overlaps Ensure Compliance with Emanation Security Doctrine ISM-1973Partially overlaps Secure Facilities for Non-Classified Systems ISM-1974Partially overlaps Securing Non-Classified IT Equipment in Secure Rooms ISM-1975Partially overlaps Secure Non-Classified Equipment in Safe Containers
Annex A 7.9 Security of Off-Site Assets	Physical controls	ISM-0161Partially overlaps Ensure Security of Unused IT Equipment and Media ISM-0457Partially overlaps Use Evaluated Crypto for Sensitive Data Encryption ISM-0465Partially overlaps Use Evaluated Cryptographic Tools for Sensitive Data ISM-1400Broader than Enforce Data Separation on Personal Devices ISM-1554Partially meets Guidelines for Using Mobile Devices Abroad
Annex A 7.10 Secure Management of Storage Media	Physical controls	ISM-0307Broader than Sanitise Equipment When Not Using Cleared Technician ISM-0311Partially overlaps Ensuring Sanitisation of IT Equipment Media ISM-0312Broader than Return Overseas Equipment for Destruction ISM-0313Partially overlaps Develop and Maintain IT Equipment Sanitisation Procedures ISM-0315Partially overlaps Ensure Destruction of High Assurance IT Equipment ISM-0316Partially meets Formal Decision on IT Equipment Disposal ISM-0317Broader than Ensuring Data Erasure on Printer Cartridges and Drums ISM-0318Broader than Safely Disposing of Unsanitised Printer Components ISM-0323Broader than Classifying Media by Data Sensitivity ISM-0325Broader than Reclassify Media to Higher Sensitivity ISM-0330Broader than Proper Sanitisation and Reclassification of Media ISM-0337Broader than Ensure Media is Used with Authorised Systems ISM-0343Partially overlaps Disabling Unnecessary Access to Removable Media ISM-0348Partially overlaps Develop and Maintain Media Sanitisation Procedures ISM-0350Broader than Destroy Unsanitizable Media Before Disposal ISM-0351Broader than Proper Method for Volatile Media Sanitisation ISM-0352Broader than Secure Volatile Media by Overwriting with Random Data ISM-0354Broader than Ensuring Proper Sanitisation of Magnetic Media ISM-0356Broader than Classify Magnetic Media After Sanitisation ISM-0357Broader than Sanitising Non-volatile EPROM Media ISM-0358Broader than Classification Retention for Sanitised EPROM and EEPROM ISM-0359Broader than Proper Sanitisation of Non-Volatile Flash Memory ISM-0360Partially overlaps Classification Retention After Flash Memory Sanitisation ISM-0361Broader than Using Degaussers for Magnetic Media Destruction ISM-0362Broader than Follow Manufacturer's Directions for Degaussing ISM-0363Broader than Develop and Maintain Media Destruction Processes ISM-0368Broader than Ensuring Media Particles Are No Larger Than 9 mm ISM-0370Broader than Supervise Media Destruction with Cleared Personnel ISM-0371Broader than Ensure Proper Supervision of Media Destruction ISM-0372Broader than Supervision of Media Destruction Procedures ISM-0374Broader than Develop and Maintain Media Disposal Procedures ISM-0375Broader than Decide on Public Release of Data Storage Media ISM-0378Broader than Remove Labels from Media Before Disposal ISM-0462Partially overlaps Managing Encryption Access for IT Equipment and Media ISM-0831Equivalent Ensure Proper Handling of Sensitive Media ISM-0835Partially overlaps TOP SECRET Volatile Media Retains Classification After Sanitisation ISM-0836Broader than Overwriting EEPROM for Complete Data Sanitisation ISM-0839Broader than Prohibit Outsourcing of Media Destruction ISM-0840Partially overlaps Certified Services for Outsourced Media Destruction ISM-0947Broader than Sanitise Media After Data Transfers Between Domains ISM-1059Broader than Encrypt All Data Stored on Media Using ASD-Approved Cryptography ISM-1065Broader than Reset Device Settings Before Media Sanitisation ISM-1067Broader than Secure Erase for Non-Volatile Magnetic Media ISM-1160Broader than Use NSA-evaluated Degaussers for Media Destruction ISM-1217Partially overlaps Remove Identifying Labels from IT Equipment Before Disposal ISM-1299Partially overlaps Personnel Awareness for Secure Mobile Device Usage ISM-1300Partially overlaps Mobile Device Security After Overseas Travel ISM-1361Broader than Use Approved Equipment for Media Destruction ISM-1418Partially overlaps Disable Unnecessary Removable Media Access ISM-1517Broader than Microform Destruction Using Fine Powder Method ISM-1550Partially meets Develop and Maintain IT Equipment Disposal Procedures ISM-1600Broader than Ensure Media is Sanitised Before Initial Use ISM-1641Broader than Ensure Degaussed Media is Physically Damaged ISM-1722Broader than Methods for Destroying Electrostatic Memory Devices ISM-1723Broader than Methods for Destroying Magnetic Floppy Disks ISM-1724Broader than Methods for Destroying Magnetic Hard Disks ISM-1725Broader than Methods for Destroying Magnetic Tapes ISM-1726Broader than Methods for Destructing Optical Disks ISM-1727Broader than Methods for Destroying Semiconductor Memory ISM-1728Broader than Handling Media Waste Based on Particle Size ISM-1729Broader than Storage Classification of Media Waste Particles ISM-1735Broader than Destroy Unsanitised Media Before Disposal ISM-1866Broader than Prevent Storing Classified Data on Privately Owned Devices ISM-2098Broader than Prevent Data Transfer Over USB on Mobile Devices
Annex A 7.11 Protection from Utility Failures	Physical controls	ISM-1123Broader than Ensure UPS Powers All Top Secret IT Equipment ISM-1580Partially overlaps Ensure High Availability for Online Services
Annex A 7.12 Secure Cabling for Power and Data	Physical controls	ISM-0181Supports Ensure Cabling Meets Australian Standards ISM-0187Broader than Exclusive Secret Cable Bundling in Infrastructure ISM-0195Broader than Seal Removable Covers on TOP SECRET Cables ISM-0206Broader than Develop and Maintain Cable Labelling Processes ISM-0213Partially overlaps Segregate Patch Panels for Secret-Level Cables ISM-0250Partially overlaps Ensure IT Equipment Meets EMI/EMC Standards ISM-0926Broader than Ensure Cables Are Not Salmon Pink or Red ISM-1095Broader than Proper Labelling of Wall Outlet Boxes ISM-1096Partially meets Ensure Proper Labelling of Cables for Identification ISM-1100Broader than Terminating TOP SECRET Cables in Cabinets ISM-1101Broader than Terminate Cabling Closely in Top Secret Areas ISM-1102Broader than Terminate Cable Reticulation Close to Cabinet ISM-1103Broader than Terminate Cables Outside Cabinets in Secure Areas ISM-1105Broader than Ensure Wall Outlets Have Appropriate Cable Security ISM-1111Broader than Ensure Fibre-Optic Cables Replace Copper Cables ISM-1112Broader than Ensure Cables Are Inspectable Every Five Metres ISM-1114Broader than Ensure Separation in Cable Reticulation Systems ISM-1115Broader than Ensure Cables Use Conduits in Walls ISM-1119Broader than Ensure Cables in TOP SECRET Areas are Inspectable ISM-1122Broader than Secure TOP SECRET Cable Wall Exits ISM-1130Broader than Use Enclosed Systems for Shared Facility Cables ISM-1133Broader than Prevent Installation of TOP SECRET Cables in Shared Walls ISM-1164Broader than Use Clear Plastic for Shared Facility Cabling Covers ISM-1639Partially overlaps Label Building Management Cables Clearly ISM-1640Broader than Label Cables for Foreign Systems in Australia ISM-1646Depends on Detail Cabling Paths and Points on Floor Plans ISM-1718Broader than Colour Code for SECRET Cables ISM-1719Broader than Colour Code for TOP SECRET Cables ISM-1720Broader than Colour Coding for Secret Wall Outlet Boxes ISM-1721Broader than Red Colour Coding for TOP SECRET Outlet Boxes ISM-1820Depends on Ensure Consistent Cable Colours for Systems ISM-1821Broader than Ensuring Exclusive Bundling for TOP SECRET Cables ISM-1884Partially overlaps Ensure Compliance with Emanation Security Doctrine
Annex A 7.13 Proper Maintenance of Equipment	Physical controls	ISM-0211Partially overlaps Develop and Verify a Cable Register ISM-0298Partially overlaps Centralised System Patch and Update Management ISM-0305Broader than On-Site IT Equipment Maintenance by Cleared Technicians ISM-0306Broader than Escort Uncleared Technicians During IT Equipment Maintenance or Repairs ISM-0307Partially overlaps Sanitise Equipment When Not Using Cleared Technician ISM-0310Partially overlaps Off-Site IT Equipment Handling Approvals ISM-1079Broader than Seek Approval for High Assurance IT Repairs ISM-1598Partially overlaps Inspect IT Equipment Post-Maintenance for Unauthorised Changes
Annex A 7.14 Secure disposal or re-use of equipment	Physical controls	ISM-0161Partially overlaps Ensure Security of Unused IT Equipment and Media ISM-0307Partially overlaps Sanitise Equipment When Not Using Cleared Technician ISM-0311Equivalent Ensuring Sanitisation of IT Equipment Media ISM-0312Broader than Return Overseas Equipment for Destruction ISM-0313Partially overlaps Develop and Maintain IT Equipment Sanitisation Procedures ISM-0315Partially overlaps Ensure Destruction of High Assurance IT Equipment ISM-0316Partially overlaps Formal Decision on IT Equipment Disposal ISM-0317Broader than Ensuring Data Erasure on Printer Cartridges and Drums ISM-0318Broader than Safely Disposing of Unsanitised Printer Components ISM-0321Partially overlaps Contact ASD for Guidance on Secure IT Disposal ISM-0330Partially overlaps Proper Sanitisation and Reclassification of Media ISM-0350Partially overlaps Destroy Unsanitizable Media Before Disposal ISM-0351Broader than Proper Method for Volatile Media Sanitisation ISM-0352Broader than Secure Volatile Media by Overwriting with Random Data ISM-0354Broader than Ensuring Proper Sanitisation of Magnetic Media ISM-0357Broader than Sanitising Non-volatile EPROM Media ISM-0359Broader than Proper Sanitisation of Non-Volatile Flash Memory ISM-0360Partially overlaps Classification Retention After Flash Memory Sanitisation ISM-0361Broader than Using Degaussers for Magnetic Media Destruction ISM-0362Broader than Follow Manufacturer's Directions for Degaussing ISM-0363Partially overlaps Develop and Maintain Media Destruction Processes ISM-0368Broader than Ensuring Media Particles Are No Larger Than 9 mm ISM-0370Depends on Supervise Media Destruction with Cleared Personnel ISM-0371Partially overlaps Ensure Proper Supervision of Media Destruction ISM-0372Depends on Supervision of Media Destruction Procedures ISM-0373Partially meets Supervise and Certify Accountable Material Destruction ISM-0374Partially overlaps Develop and Maintain Media Disposal Procedures ISM-0375Partially overlaps Decide on Public Release of Data Storage Media ISM-0378Partially overlaps Remove Labels from Media Before Disposal ISM-0835Partially overlaps TOP SECRET Volatile Media Retains Classification After Sanitisation ISM-0836Broader than Overwriting EEPROM for Complete Data Sanitisation ISM-0839Partially overlaps Prohibit Outsourcing of Media Destruction ISM-0947Partially overlaps Sanitise Media After Data Transfers Between Domains ISM-1065Broader than Reset Device Settings Before Media Sanitisation ISM-1067Broader than Secure Erase for Non-Volatile Magnetic Media ISM-1076Broader than Sanitise Screen Burn-In With a Solid White Image ISM-1160Broader than Use NSA-evaluated Degaussers for Media Destruction ISM-1217Partially overlaps Remove Identifying Labels from IT Equipment Before Disposal ISM-1218Broader than Sanitise Overseas IT Equipment Handling Sensitive Data ISM-1219Broader than Inspect and Destroy MFD Print Drums and Image Transfer Rollers ISM-1220Broader than Inspect and Destroy Retained Images on Printer Platens ISM-1221Broader than Check Printers and MFDs for Trapped Pages ISM-1222Broader than Destroy Unsanitised Televisions and Monitors ISM-1223Broader than Methods for Sanitising Network Device Memory ISM-1361Partially overlaps Use Approved Equipment for Media Destruction ISM-1550Partially overlaps Develop and Maintain IT Equipment Disposal Procedures ISM-1599Partially overlaps Proper Handling of Sensitive IT Equipment ISM-1641Broader than Ensure Degaussed Media is Physically Damaged ISM-1642Partially overlaps Ensure Media is Sanitised Before Reuse ISM-1724Partially overlaps Methods for Destroying Magnetic Hard Disks ISM-1726Broader than Methods for Destructing Optical Disks ISM-1727Broader than Methods for Destroying Semiconductor Memory ISM-1729Partially overlaps Storage Classification of Media Waste Particles ISM-1735Partially overlaps Destroy Unsanitised Media Before Disposal ISM-1741Partially overlaps Implement IT Equipment Destruction Procedures ISM-1742Partially overlaps Destroy Un-sanitizable IT Equipment Safely
Annex A 8.1 Protection of User Endpoint Devices	Technological controls	ISM-0161Partially overlaps Ensure Security of Unused IT Equipment and Media ISM-0345Broader than Disable External Interfaces for Direct Memory Access ISM-0489Broader than Four-Hour Cached SSH Private Key Lifetime and Screen Locks ISM-0591Partially meets Use Evaluated Peripheral Switches Securely ISM-0682Broader than Disable Bluetooth on SECRET/TS Mobile Devices ISM-0687Broader than Use Approved Platforms for Secure Mobile Access ISM-0701Broader than Establish Mobile Device Emergency Sanitisation Processes and Procedures ISM-0853Broader than Terminate Interactive User Sessions and Restart Workstations at Least Daily ISM-0864Broader than Prevent Modifications to Security Settings on Mobile Devices ISM-0866Broader than Ensure Privacy While Viewing Data in Public ISM-0869Broader than Encrypt Storage on Mobile Devices ISM-0870Broader than Secure Storage and Handling of Mobile Devices ISM-0871Broader than Supervise Mobile Devices During Active Use ISM-0874Broader than Ensure Internet Access via Organisation's Gateway ISM-1059Broader than Encrypt All Data Stored on Media Using ASD-Approved Cryptography ISM-1080Supports Use AACA or High Assurance Algorithms for Data Encryption ISM-1082Broader than Develop and Maintain Mobile Device Usage Policy ISM-1084Broader than Transporting Mobile Devices Securely ISM-1195Broader than Enforce Policy with Evaluated Mobile Device Management ISM-1196Broader than Keep Mobile Devices Undiscoverable via Bluetooth ISM-1198Broader than Secure Bluetooth Pairing for Mobile Devices ISM-1199Broader than Remove Unnecessary Bluetooth Pairings on Devices ISM-1200Broader than Secure Bluetooth Pairing for Mobile Devices ISM-1341Broader than Implement HIPS or EDR on Workstations ISM-1400Broader than Enforce Data Separation on Personal Devices ISM-1482Broader than Ensure Separation of Classified and Personal Data on Devices ISM-1533Broader than Establish Mobile Device Management Policies ISM-1554Partially meets Guidelines for Using Mobile Devices Abroad ISM-1585Broader than Lock Web Browser Security Settings Against Human User Changes ISM-1686Broader than Enable Credential Guard for Credential Protection ISM-1749Broader than Limit Cached Credentials to Single Logon ISM-1866Broader than Prevent Storing Classified Data on Privately Owned Devices ISM-1867Broader than Use Approved Mobile Platforms for Sensitive Access ISM-1868Broader than Restrictions on Mobile Device Removable Media ISM-1886Broader than Ensure Mobile Devices Operate in Supervised Mode ISM-1887Broader than Implement Remote Locate and Wipe for Mobile Security ISM-1888Broader than Ensure Mobile Devices Have Secure Lock Screens ISM-1896Broader than Enable Memory Integrity for Credential Protection ISM-1898Partially meets Use Secure Admin Workstations for Administration ISM-2097Broader than Configure Mobile Devices with Always On VPN
Annex A 8.2 Management of Privileged Access Rights	Technological controls	ISM-0078Supports Australian Supervision of AUSTEO/AGAO Data Systems ISM-0407Partially overlaps Maintaining a Secure Lifetime Access Record for Each Human User ISM-0415Partially overlaps Strictly Controlling Shared Accounts and Identifying Their Users ISM-0432Depends on Document System Access Requirements in Security Plans ISM-0443Broader than Restrict Temporary Access to Secure Systems ISM-0445Broader than Dedicated Privileged Accounts Used Solely for Privileged Duties ISM-0446Partially overlaps Restrict Privileged Access for Foreign Nationals ISM-0447Broader than Restrict Privileged Access for Foreign Nationals ISM-0611Broader than Restrict Privileges for Gateway Administrators ISM-0616Broader than Ensure Separation of Duties for Gateway Admins ISM-0629Broader than Manage Gateways Between Different Security Domains ISM-1175Broader than Restrict Privileged Users from Internet Access ISM-1249Broader than Limit Server Application User Privileges ISM-1250Partially overlaps Limit Server Application User Account Privileges ISM-1263Broader than Enforce Unique Accounts for Server Administration ISM-1392Depends on Restrict File Modifications via Path Rules ISM-1487Partially overlaps Restrict Write Access to Trusted Locations to Macro Vetting Users ISM-1507Broader than Ensure Requests for Privileged Access are Verified ISM-1508Partially overlaps Restricting Privileged Access to What Duties Require ISM-1565Depends on Annual Tailored Training for All Privileged Access Holders ISM-1591Partially overlaps Remove or Suspend Access When Users Are Detected Acting Maliciously ISM-1604Partially overlaps Harden Software Isolation Mechanisms Sharing Physical Computing Resources ISM-1612Broader than Restricted Use of Break Glass Accounts for Emergencies ISM-1614Partially overlaps Manage Emergency Account Access Changes ISM-1620Broader than Ensure Privileged Accounts are Secured in AD ISM-1647Broader than Disable Privileged Access After 12 Months ISM-1648Broader than Disabling Inactive Privileged Access to Systems ISM-1649Broader than Implement Just-in-Time Administration for System Access ISM-1650Partially meets Log Management of Privileged User Activities ISM-1685Broader than Strengthening Passwords for Critical Accounts ISM-1688Broader than Block Unprivileged Account Logons to Privileged Operating Environments ISM-1689Broader than Block Privileged Account Logons to Unprivileged Operating Environments ISM-1706Partially overlaps Prevent Backup Access by Privileged Users ISM-1827Broader than Use Dedicated Admin Accounts for Domain Controllers ISM-1835Broader than Restrict Delegation of Privileged Active Directory Accounts ISM-1842Broader than Use Privileged Accounts for Domain Machine Addition ISM-1846Broader than Restrict Pre-Windows 2000 Access Group Membership ISM-1883Broader than Limit Authorised Privileged Account Online Service Access to Duties ISM-1898Broader than Use Secure Admin Workstations for Administration ISM-1927Broader than Limit Identity Server Access to Privileged Users Requiring It ISM-1932Partially overlaps Limit Service Accounts with SPNs in Active Directory ISM-1934Broader than Six-Monthly Review and Removal of DCSync User Permissions ISM-1936Broader than Prevent Usage of sIDHistory in User Accounts ISM-1939Broader than Minimise Members in Privileged Security Groups ISM-1940Broader than Restrict Service Accounts from Privileged Groups ISM-1941Broader than Restrict Computer Accounts in Privileged Security Groups ISM-1942Broader than Domain Computers Group Privilege Restriction ISM-1946Broader than Restrict Write Access to Certificate Templates ISM-1948Depends on Certificate Manager Approval for Templates Allowing Supplied SANs ISM-1949Broader than Use Dedicated Accounts for AD FS Administration ISM-1952Broader than Prevent Synchronisation of Privileged Accounts ISM-1958Broader than Block DCSync-Permitted Accounts From Logging On To Unprivileged Environments ISM-2048Broader than Restrict Non-Admins from Changing Permissions ISM-2113Depends on Configuring AI Applications to Require Human Approval Before High-Impact Actions ISM-2128Broader than Limit Kernel-Mode Code Installation to Privileged Users Who Need It
Annex A 8.3 Restrict access to information and assets	Technological controls	ISM-0133Partially overlaps Responding to Data Spills by Restricting Access ISM-0343Broader than Disabling Unnecessary Access to Removable Media ISM-0382Broader than Prevent Unprivileged Human Users Uninstalling or Disabling Approved Applications ISM-0409Broader than Restricting Foreign National Access to AUSTEO and REL Systems ISM-0411Broader than Restricting Foreign National Access to Systems Handling AGAO Data ISM-0441Broader than Restricting Temporary System Access to Data Required for Duties ISM-0443Broader than Restrict Temporary Access to Secure Systems ISM-0462Partially overlaps Managing Encryption Access for IT Equipment and Media ISM-0488Broader than Use Forced Commands for SSH Without Passwords ISM-0520Broader than Prevent Unauthorised Network Device Connections ISM-0551Broader than Ensure Secure IP Telephony Device Authentication ISM-0555Broader than Ensure Authentication for IP Telephony Actions ISM-0558Broader than Restrict IP Phone Network Access in Public Areas ISM-0611Broader than Restrict Privileges for Gateway Administrators ISM-0622Broader than Ensuring Network Authentication via Gateways ISM-0694Broader than Block Privately Owned Devices From SECRET and TOP SECRET Systems ISM-0854Broader than Access Restrictions for AUSTEO and AGAO Data ISM-1006Broader than Prevent Unauthorised Access to Network Traffic ISM-1175Broader than Restrict Privileged Users from Internet Access ISM-1249Broader than Limit Server Application User Privileges ISM-1250Broader than Limit Server Application User Account Privileges ISM-1255Broader than Restrict Database Content Access by User Duties and Functions ISM-1256Broader than Implement File-Based Access Controls for Databases ISM-1268Broader than Enforce Need-to-Know Access in Databases ISM-1327Broader than Access Controls, Encryption and User Authentication for X.509 Certificates ISM-1392Broader than Restrict File Modifications via Path Rules ISM-1422Broader than Prevent Unauthorised Access to Software Source ISM-1439Broader than Restrict IP Disclosure in CDNs ISM-1487Broader than Restrict Write Access to Trusted Locations to Macro Vetting Users ISM-1508Broader than Restricting Privileged Access to What Duties Require ISM-1604Partially meets Harden Software Isolation Mechanisms Sharing Physical Computing Resources ISM-1612Broader than Restricted Use of Break Glass Accounts for Emergencies ISM-1649Broader than Implement Just-in-Time Administration for System Access ISM-1705Broader than Restrict Access to User Account Backups ISM-1812Broader than Restrict Backup Access to Unprivileged Users ISM-1813Broader than Prevent Unauthorised User Access to Backup Data ISM-1814Broader than Prevent Backup Modifications by Unprivileged Users ISM-1815Broader than Protect Event Logs from Unauthorised Access ISM-1816Broader than Prevent Unauthorised Changes to Software Sources ISM-1817Broader than Secure API Access with Authentication and Authorisation ISM-1833Partially overlaps Limit Privileges for User Accounts in Active Directory ISM-1841Broader than Restrict Domain Joining to Admin Users Only ISM-1846Broader than Restrict Pre-Windows 2000 Access Group Membership ISM-1852Broader than Limit Unprivileged Access to What Duties Require ISM-1854Broader than Human Users Authenticate to MFDs Before Printing, Scanning or Copying ISM-1862Broader than Restrict Access and Conceal Web Server IP Addresses ISM-1866Partially overlaps Prevent Storing Classified Data on Privately Owned Devices ISM-1888Broader than Ensure Mobile Devices Have Secure Lock Screens ISM-1927Broader than Limit Identity Server Access to Privileged Users Requiring It ISM-1933Broader than Restrict DCSync Permissions on Service Accounts ISM-1936Broader than Prevent Usage of sIDHistory in User Accounts ISM-1985Broader than Protect Event Logs from Unauthorised Access ISM-2014Broader than Ensure API Client Authentication and Authorisation ISM-2046Partially overlaps Ensure Secure Impersonation Logging Practices ISM-2048Broader than Restrict Non-Admins from Changing Permissions ISM-2092Broader than Enforce Fine-Grained Permissions for AI Applications ISM-2093Broader than Role-Based Access Controls in AI Applications ISM-2095Broader than Block Personal Devices Granting AI Agents Access to Sensitive Systems ISM-2124Broader than Restricting Service Provider Access to Approved Tools, Addresses and Time Windows ISM-2136Broader than Enforcing Risk-Based Access Decisions Informed by Contextual Signals ISM-2137Broader than Block User OAuth Consent, Reserve It for Authorised Administrators ISM-2156Broader than Restrict Agentic AI Applications to Minimum Tools, Functions and Permissions ISM-2157Broader than Agentic AI Tool Calls Limited by User Access and Task-Scoped Authorisation
Annex A 8.4 Access management for source code and tools	Technological controls	ISM-0441Partially overlaps Restricting Temporary System Access to Data Required for Duties ISM-1422Broader than Prevent Unauthorised Access to Software Source ISM-1746Partially overlaps Restrict File System Permission Changes ISM-2024Supports Utilise Authoritative Sources in Software Development
Annex A 8.5 Secure authentication technologies and procedures	Technological controls	ISM-0417Broader than Use Passwords When Multi-Factor Authentication Isn't Supported ISM-0418Partially overlaps Keep Physical Credentials Separate from Systems ISM-0421Broader than Require Minimum 15-Character Passwords for Security ISM-0428Broader than Session Lock Timing, Content Blocking and Full Re-Authentication for Services ISM-0484Partially meets Configure SSH for Secure Server Access ISM-0485Broader than Use Public Key Authentication for SSH Access ISM-0488Broader than Use Forced Commands for SSH Without Passwords ISM-0551Broader than Ensure Secure IP Telephony Device Authentication ISM-0554Broader than Secure Two-Way Authentication for Video Calls ISM-0590Broader than Ensure Strong Authentication for Multi-Function Devices ISM-0619Broader than User Authentication for Network Gateway Access ISM-0622Broader than Ensuring Network Authentication via Gateways ISM-0974Broader than Multi-Factor Authentication for Unprivileged Human Users of Systems ISM-1014Broader than Implement Individual Logins for Secure IP Phone Use ISM-1055Broader than Disable Insecure LAN Manager Authentication ISM-1151Broader than Verify Email Authenticity Using SPF ISM-1173Broader than Multi-Factor Authentication for Privileged Human Users of Systems ISM-1200Partially overlaps Secure Bluetooth Pairing for Mobile Devices ISM-1321Broader than Enforce 802.1X EAP-TLS Mutual Authentication With Other EAP Methods Disabled ISM-1322Broader than Using Evaluated Supplicants, Authenticators and Authentication Servers for 802.1X ISM-1323Broader than Requiring X.509 Certificates for 802.1X Network Authentication ISM-1327Partially overlaps Access Controls, Encryption and User Authentication for X.509 Certificates ISM-1330Broader than Limit PMK Caching Duration on Wireless Networks ISM-1504Broader than Multi-Factor Authentication for Human Users of Sensitive Data Online Services ISM-1505Broader than Multi-factor Authentication for Human Users of Data Repositories ISM-1546Broader than Ensure User Authentication Before System Access ISM-1558Broader than Ensure Secure Construction of Passwords ISM-1559Broader than Minimum Password Length for Secure Systems ISM-1560Broader than Ensure Strong Passwords for SECRET System Authentication ISM-1597Broader than Ensuring Credential Input Obscurity ISM-1603Broader than Disabling Vulnerable Authentication Methods ISM-1679Broader than Multi-factor Authentication for Third-party Services Handling Sensitive Data ISM-1680Broader than Multi-Factor Authentication for Human Users of Third-Party Services Holding Non-Sensitive Data ISM-1681Broader than Mandating Multi-Factor Authentication for Customer Services ISM-1682Broader than Phishing-resistant multi-factor authentication for human users of systems ISM-1711Broader than Ensure User Identity Confidentiality in EAP-TLS ISM-1749Broader than Limit Cached Credentials to Single Logon ISM-1817Broader than Secure API Access with Authentication and Authorisation ISM-1818Broader than Client Authentication for Network API Access ISM-1836Broader than Require Kerberos Pre-Authentication for User Accounts ISM-1854Broader than Human Users Authenticate to MFDs Before Printing, Scanning or Copying ISM-1872Broader than Phishing-Resistant Multi-Factor Authentication for Human Users of Online Services ISM-1874Broader than Phishing-Resistant Multi-Factor Authentication for Customers ISM-1892Broader than Multi-Factor Authentication for Organisation Users of Online Customer Services ISM-1893Broader than Multi-Factor Authentication for Third-Party Services Holding Sensitive Customer Data ISM-1894Broader than Phishing-Resistant Multi-Factor Authentication for Human Users of Data Repositories ISM-1919Broader than Disable Authentication Protocols That Cannot Support Multi-Factor Authentication ISM-1920Broader than Blocking MFA Self-Enrolment From Untrustworthy Devices ISM-1929Broader than Ensure LDAP Signing on AD DS Domain Controllers ISM-1943Broader than Enforce Certificate and User Mapping in AD Services ISM-1947Broader than Remove User Authentication from Extended Key Usages ISM-1980Broader than Avoid Using Credential Hints in Systems ISM-2011Broader than Disabling Weaker MFA Options When Phishing-Resistant MFA Is Used ISM-2012Partially overlaps Enforced Screen Lock With Full Re-Authentication After Inactivity ISM-2013Broader than Ensure Client Authentication for Internal Network APIs ISM-2014Broader than Ensure API Client Authentication and Authorisation ISM-2047Broader than Secondary-Channel Notification of Authentication Factor Resets ISM-2049Partially overlaps Enforcing Re-authentication After Permission Changes ISM-2076Broader than Eliminating Security Questions for Authentication ISM-2077Broader than Avoid Email for Out-of-Band Authentication ISM-2081Broader than Enforce Use of All ASCII Characters in Passwords ISM-2109Broader than Pre-Boot Authentication for Encrypted System Volume Media ISM-2140Broader than Disable OAuth Device Code Flow Unless Required and Restrict Its Use ISM-2147Broader than Cryptographically Bind Tokens and Session Cookies to Issuing Device ISM-2165Broader than Fresh EAP-TLS Authentication for Each New Connectivity Association Key ISM-2167Broader than Disabling Pre-Shared Key Fallback Authentication for MACsec
Annex A 8.6 Capacity Management for Resource Use	Technological controls	ISM-1431Partially overlaps Strategies for Mitigating Denial-of-Service Attacks ISM-1579Partially overlaps Dynamic Resource Scaling for Demand Spikes ISM-1581Partially overlaps Monitor Capacity and Availability of Online Services ISM-2090Supports Rate Limiting for AI Inference Queries ISM-2091Broader than Enforce Resource Limits for AI Models ISM-2114Partially overlaps Monitor Baselines for AI Application Performance
Annex A 8.7 Protection against malware	Technological controls	ISM-0263Depends on Inspect and Decrypt TLS Traffic through Gateways ISM-0651Broader than Block Malicious or Uninspectable Files ISM-0652Broader than Quarantine Suspicious Files for Review ISM-0657Broader than Scanning Data for Threats Before Manual Import ISM-0917Partially overlaps Procedures for Handling Malicious Code Infections ISM-1034Broader than Deploy HIPS or EDR on Critical and High-Value Servers ISM-1234Broader than Protect Email Systems with Content Filtering ISM-1287Broader than Ensure Gateway and CDS File Content Sanitisation ISM-1288Broader than Antivirus Scanning of Gateway Files ISM-1289Broader than Unpack Archive Files for Content Filtering at Gateways ISM-1290Supports Controlled Unpacking of Archive Files for Filtering ISM-1299Partially overlaps Personnel Awareness for Secure Mobile Device Usage ISM-1341Broader than Implement HIPS or EDR on Workstations ISM-1389Broader than Analyse Executable Files in Sandboxes ISM-1417Broader than Ensure Antivirus Protection on Workstations and Servers ISM-1486Broader than Restrict Java Processing in Web Browsers ISM-1608Broader than Scan Third-Party SOEs for Malicious Code ISM-1659Broader than Implement Microsoft's Vulnerable Driver Blocklist ISM-1672Broader than Enable Antivirus Scanning for Office Macros ISM-1745Partially overlaps Enable Security Features for System Protection ISM-1782Broader than Use Protective DNS to Block Malicious Domains ISM-1890Broader than Ensure Macros Are Free of Malicious Code ISM-1969Broader than Preventing Accidental Execution of Malicious Code ISM-2026Broader than Scan Software Artefacts for Malicious Content ISM-2072Broader than Store AI Models In A Non-Executable File Format
Annex A 8.8 Management of Technical Vulnerabilities	Technological controls	ISM-0298Broader than Centralised System Patch and Update Management ISM-0300Broader than Apply System Security Patches with Approval ISM-0912Partially overlaps Establish and Manage System Configuration Changes ISM-1143Broader than Develop and Maintain Patch Management Procedures ISM-1163Partially overlaps Continuous Monitoring Plan to Find and Fix Vulnerabilities ISM-1366Broader than Ensure Timely Security Updates for Mobile Devices ISM-1483Broader than Use Latest Release of Internet-Facing Server Applications ISM-1501Broader than Replace Unsupported Operating Systems ISM-1526Partially overlaps System Owners Continuously Monitor Security and Manage Threats, Risks and Controls ISM-1606Broader than Patch Isolation Mechanisms and Underlying Operating Systems Promptly ISM-1616Partially overlaps Implementing a Vulnerability Disclosure Program ISM-1622Broader than Ensure PowerShell Uses Constrained Language Mode ISM-1635Partially meets System Owners Implement Security Controls for Each System and Environment ISM-1643Depends on Maintain Detailed Software Version and Patch Records ISM-1659Broader than Implement Microsoft's Vulnerable Driver Blocklist ISM-1690Broader than Timely Application of Non-Critical Vulnerability Patches ISM-1691Broader than Timely Vulnerability Patching in Software Tools ISM-1692Broader than Quick Apply Critical Patches for Vulnerabilities ISM-1693Broader than Timely Application of Patches to Mitigate Vulnerabilities ISM-1694Broader than Timely Application of Non-Critical Security Patches ISM-1695Broader than Timely Application of System Security Patches ISM-1696Broader than Apply Critical Patches Within 48 Hours ISM-1697Broader than Apply Non-Critical Patches Within One Month ISM-1698Broader than Daily Vulnerability Scanning for Missing Updates ISM-1701Broader than Daily Vulnerability Scanning for Internet-Facing Systems ISM-1702Broader than Regularly Scan for Missing Security Patches ISM-1703Broader than Regular Vulnerability Scanning for Missing Patches ISM-1704Broader than Remove Unsupported Software to Ensure Security ISM-1717Partially overlaps Implement Security.txt for Vulnerability Disclosure ISM-1751Broader than Timely Application of Vendor Patches for Non-Critical OS Vulnerabilities ISM-1752Broader than Fortnightly Vulnerability Scanning for Non-Workstations ISM-1754Broader than Timely Resolution of Identified Software Vulnerabilities ISM-1755Broader than Develop and Maintain a Vulnerability Disclosure Policy ISM-1756Partially overlaps Develop and Maintain Vulnerability Disclosure Processes ISM-1808Broader than Vulnerability Scanning with Updated Tools ISM-1809Partially overlaps Compensating Controls for Unsupported Systems Pending Removal or Replacement ISM-1848Broader than Replace Unsupported Software-Based Isolation Mechanisms Sharing Physical Resources ISM-1876Broader than Apply Critical Patches Within 48 Hours ISM-1877Broader than Timely Application of Critical Security Patches ISM-1878Broader than Apply Critical Patches Within 48 Hours ISM-1879Broader than Timely Patching of Critical Driver Vulnerabilities ISM-1900Broader than Fortnightly System Vulnerability Scanning ISM-1901Broader than Timely Application of Non-Critical Security Patches ISM-1903Broader than Rapid Application of Critical Firmware Patches ISM-1904Broader than Apply Firmware Patches for Non-Critical Vulnerabilities ISM-1905Broader than Remove Online Services No Longer Supported by Vendors ISM-1908Partially overlaps Responsible Disclosure of Software Vulnerabilities ISM-1909Broader than Perform Root Cause Analysis for Vulnerabilities ISM-1913Partially overlaps Develop and Maintain Approved IT Configurations ISM-1914Partially meets Ensure Operating Systems Have Approved Configurations ISM-1915Partially meets Ensure User Application Configurations are Approved ISM-1916Partially meets Ensure Server Application Configurations Are Approved ISM-2054Partially meets Ensure No Vulnerabilities in Third-Party Software Components ISM-2118Broader than Conduct Vulnerability Assessments and Penetration Tests ISM-2119Depends on Utilise AI Models in Vulnerability Assessments and Penetration Tests ISM-2131Partially overlaps Quarterly Certificate Template Reviews to Remediate Misconfigurations
Annex A 8.9 Configuration Management for Secure IT Systems	Technological controls	ISM-0042Partially overlaps Maintain Effective System Administration Practices ISM-0272Broader than Restrict Protective Marking Tools to Authorised System Markings ISM-0289Partially overlaps Implement and Manage Evaluated Products Correctly ISM-0290Partially overlaps Secure Configuration of High Assurance IT Equipment ISM-0341Broader than Disable Automatic Execution for Removable Media ISM-0380Broader than Disable Unneeded OS Accounts and Services ISM-0383Broader than Change Default OS User Accounts During Setup ISM-0484Broader than Configure SSH for Secure Server Access ISM-0487Broader than Disable Certain Features for Passwordless SSH Logins ISM-0498Broader than Ensure Short Lifetimes for IPsec Associations ISM-0516Supports Comprehensive Network Diagrams for Critical Components ISM-0518Partially overlaps Maintain Comprehensive Network Documentation ISM-0567Broader than Restrict Email Relay to Specific Domains ISM-0570Broader than Maintain Backup Email Gateways to Primary Standards ISM-0589Partially overlaps Limit Document Sensitivity on MFDs Based on Network Classification ISM-0864Broader than Prevent Modifications to Security Settings on Mobile Devices ISM-0912Partially overlaps Establish and Manage System Configuration Changes ISM-1027Broader than Configure Email Distribution Lists to Preserve DKIM Signatures ISM-1037Broader than Regular Testing of Gateway Security Configurations ISM-1055Broader than Disable Insecure LAN Manager Authentication ISM-1183Broader than Implement Hard Fail SPF Records for Email Security ISM-1196Broader than Keep Mobile Devices Undiscoverable via Bluetooth ISM-1211Partially meets System Administration Performed Under Change and Configuration Management Plan ISM-1260Broader than Secure Server Applications by Changing Default Credentials ISM-1272Broader than Disable Database Networking for Local Access ISM-1304Broader than Secure Network Devices by Changing Default Credentials ISM-1311Broader than Prevent Use of Insecure SNMP Versions on Networks ISM-1312Broader than Changing Default SNMP Community Strings on Devices ISM-1316Broader than Ensure Default Wireless SSIDs Are Changed ISM-1319Broader than Avoid Static IP Addressing on Wireless Networks ISM-1406Broader than Use SOEs for Workstations and Servers ISM-1408Broader than Use 64-bit Operating Systems ISM-1409Broader than Implement Restrictive OS Hardening Guidelines ISM-1428Broader than Disable IPv6 Tunnelling Unless Necessary ISM-1489Broader than Lock Microsoft Office Macro Security Settings Against User Changes ISM-1552Depends on Secure Web Content with HTTPS Only ISM-1562Broader than Secure Video Conferencing and Telephony Systems ISM-1585Broader than Lock Web Browser Security Settings Against Human User Changes ISM-1588Broader than Annual Review of Standard Operating Environments ISM-1598Broader than Inspect IT Equipment Post-Maintenance for Unauthorised Changes ISM-1604Broader than Harden Software Isolation Mechanisms Sharing Physical Computing Resources ISM-1605Broader than Harden the Operating System Beneath Software Isolation Mechanisms ISM-1608Partially overlaps Scan Third-Party SOEs for Malicious Code ISM-1622Broader than Ensure PowerShell Uses Constrained Language Mode ISM-1627Depends on Block Inbound Traffic from Anonymity Networks ISM-1669Broader than Prevent Microsoft Office from Injecting Code ISM-1673Broader than Prevent Win32 API Calls by Office Macros ISM-1710Broader than Secure Default Settings for Wireless Access Points ISM-1798Supports Develop Secure Configuration Guidelines for Software ISM-1806Broader than Change Default User Credentials During Setup ISM-1823Broader than Lock Office Productivity Suite Security Settings Against User Changes ISM-1824Broader than Lock PDF Application Security Settings Against User Changes ISM-1825Broader than Lock Security Product Settings Against Changes by Human Users ISM-1828Broader than Disable Print Spooler on AD DS Domain Controllers ISM-1832Broader than SPN Configuration for Active Directory Accounts ISM-1834Broader than Ensure No Duplicate SPNs in Active Directory ISM-1838Broader than Restrict UserPassword Attribute in AD Accounts ISM-1860Broader than Harden PDF Applications Using ASD Guidance ISM-1887Broader than Implement Remote Locate and Wipe for Mobile Security ISM-1888Broader than Ensure Mobile Devices Have Secure Lock Screens ISM-1912Partially overlaps Document Device Settings for Critical and High-Value Servers ISM-1913Equivalent Develop and Maintain Approved IT Configurations ISM-1914Broader than Ensure Operating Systems Have Approved Configurations ISM-1915Broader than Ensure User Application Configurations are Approved ISM-1916Broader than Ensure Server Application Configurations Are Approved ISM-1926Broader than Restrict Identity Servers to Their Designed Role Only ISM-1931Broader than Ensure SID Filtering for Domain and Forest Trusts ISM-1935Broader than Prevent Unconstrained Delegation in Domain Services ISM-1944Broader than Remove EDITF_ATTRIBUTESUBJECTALTNAME2 Flag From AD CS Certification Authorities ISM-1951Broader than Disable Hard Match Takeover in Microsoft Entra Connect ISM-2127Broader than Enforce Driver Digital Signature Verification Before Loading ISM-2130Broader than Disabling or Hardening AD CS Web Enrolment Interfaces ISM-2131Broader than Quarterly Certificate Template Reviews to Remediate Misconfigurations ISM-2161Broader than Verify Network Device Firmware and Configuration Against Known-Good Baseline ISM-2162Broader than Disabling or Removing Unneeded Network Device Components and Services ISM-2167Broader than Disabling Pre-Shared Key Fallback Authentication for MACsec
Annex A 8.10 Secure deletion of information when no longer needed	Technological controls	ISM-0307Partially overlaps Sanitise Equipment When Not Using Cleared Technician ISM-0311Partially overlaps Ensuring Sanitisation of IT Equipment Media ISM-0317Broader than Ensuring Data Erasure on Printer Cartridges and Drums ISM-0330Partially overlaps Proper Sanitisation and Reclassification of Media ISM-0348Supports Develop and Maintain Media Sanitisation Procedures ISM-0351Broader than Proper Method for Volatile Media Sanitisation ISM-0357Broader than Sanitising Non-volatile EPROM Media ISM-0359Broader than Proper Sanitisation of Non-Volatile Flash Memory ISM-0361Broader than Using Degaussers for Magnetic Media Destruction ISM-0362Supports Follow Manufacturer's Directions for Degaussing ISM-0363Partially overlaps Develop and Maintain Media Destruction Processes ISM-0371Partially overlaps Ensure Proper Supervision of Media Destruction ISM-0375Partially overlaps Decide on Public Release of Data Storage Media ISM-0947Broader than Sanitise Media After Data Transfers Between Domains ISM-1065Broader than Reset Device Settings Before Media Sanitisation ISM-1160Broader than Use NSA-evaluated Degaussers for Media Destruction ISM-1223Broader than Methods for Sanitising Network Device Memory ISM-1600Partially overlaps Ensure Media is Sanitised Before Initial Use ISM-1722Broader than Methods for Destroying Electrostatic Memory Devices ISM-1723Broader than Methods for Destroying Magnetic Floppy Disks ISM-2021Broader than Implement and Maintain Data Minimisation Practices ISM-2053Partially overlaps End of Life Procedures for Software ISM-2111Broader than Remove Temporary Installation Files Post-Installation ISM-2123Broader than Delete AI Chat Session Prompts and Outputs
Annex A 8.11 Data Masking for Sensitive Information	Technological controls	ISM-1268Partially overlaps Enforce Need-to-Know Access in Databases
Annex A 8.12 Data Leakage Prevention Measures	Technological controls	ISM-0240Broader than Prevent Sensitive Data in Messaging Services ISM-0267Broader than Blocking Access to Unapproved Webmail Services ISM-0325Depends on Reclassify Media to Higher Sensitivity ISM-0565Broader than Email Security for Protective Markings ISM-0589Broader than Limit Document Sensitivity on MFDs Based on Network Classification ISM-0591Broader than Use Evaluated Peripheral Switches Securely ISM-0659Partially overlaps Filtering Content of Gateway and CDS Files ISM-0661Partially overlaps Holding Human Users Accountable for Data Transfers They Perform ISM-0664Partially overlaps Authorisation of Secret Data Exports ISM-0669Partially overlaps Security Measures for Manual Data Export ISM-0682Broader than Disable Bluetooth on SECRET/TS Mobile Devices ISM-1089Depends on Block Downgrading Protective Markings on Email Replies and Forwards ISM-1157Broader than Use Evaluated Diodes to Control Unidirectional Gateway Data Flow ISM-1187Partially overlaps Check Data for Improper Markings Before Export ISM-1192Partially overlaps Inspecting and Filtering Data with Gateways ISM-1293Supports Decrypt Encrypted Files for Content Filtering ISM-1400Broader than Enforce Data Separation on Personal Devices ISM-1457Broader than Evaluate Peripheral Switches for Security Domains ISM-1482Broader than Ensure Separation of Classified and Personal Data on Devices ISM-1534Broader than Remove and Destroy Printer and MFD Ribbons ISM-1535Partially overlaps Prevent Unsuitable Foreign Data Exports ISM-1866Broader than Prevent Storing Classified Data on Privately Owned Devices ISM-1868Broader than Restrictions on Mobile Device Removable Media ISM-1875Broader than Monthly System Scans to Detect Credentials Stored in the Clear ISM-1885Partially overlaps Implement Emanation Security Measures for Systems ISM-1924Supports Detect and Mitigate Adversarial Prompts in Generative AI Applications ISM-1965Partially overlaps Content Checking for Imported or Exported Files ISM-2052Partially overlaps Ensure Event Logs Protect Sensitive Data ISM-2094Broader than AI Content Filtering to Block Sensitive Data Exposure ISM-2099Broader than Prevent Connection of Mobile Devices to Infotainment
Annex A 8.13 Backup and Recovery Procedures for Data	Technological controls	ISM-0042Partially meets Maintain Effective System Administration Practices ISM-0917Partially overlaps Procedures for Handling Malicious Code Infections ISM-1511Partially overlaps Conduct and Maintain Regular Data Backups ISM-1515Broader than Test Backup Restoration During Disaster Recovery ISM-1547Partially overlaps Develop and Maintain Data Backup Procedures ISM-1548Partially overlaps Develop and Maintain Data Restoration Processes ISM-1555Partially meets Prepare Mobile Devices Before Overseas Travel ISM-1574Depends on Data Portability in Service Contracts ISM-1705Broader than Restrict Access to User Account Backups ISM-1810Broader than Ensuring Data Backup Synchronisation ISM-1928Broader than Encrypt and Restrict Access to Microsoft AD and Entra Connect Server Backups ISM-2151Broader than Technically Enforced Immutability Protecting Backups Through Their Retention Period
Annex A 8.14 Redundancy of Information Processing Facilities	Technological controls	ISM-1438Broader than Ensure High Availability by Using CDNs ISM-1580Broader than Ensure High Availability for Online Services ISM-1789Broader than Maintain Reserve Spares of Critical IT and OT Equipment
Annex A 8.15 Logging of Activities and Events	Technological controls	ISM-0109Broader than Timely Analysis of Workstation Event Logs ISM-0261Broader than Log Web Proxy Activity for Security Analysis ISM-0565Broader than Email Security for Protective Markings ISM-0580Partially overlaps Develop, Implement and Maintain a Security Monitoring Policy ISM-0582Broader than Central Logging of Windows Security Events ISM-0585Broader than Capture Detailed Information in Event Logs ISM-0634Broader than Central Logging for Gateway Security Events ISM-0661Supports Holding Human Users Accountable for Data Transfers They Perform ISM-0670Broader than Central Logging of CDS Security Events ISM-0988Depends on Ensure Accurate Time Source for Event Logs ISM-1030Broader than Deploy NIDS/NIPS for Gateway Traffic Monitoring ISM-1213Broader than Enhanced Monitoring After Intrusion Remediation Until Eradication Is Confirmed ISM-1228Supports Analyse Cyber Security Events Promptly ISM-1294Broader than Partial Monthly Verification of Data Transfer Logs ISM-1405Partially overlaps Implement a Centralised Event Logging Facility ISM-1509Broader than Log Privileged Access Events Centrally for Monitoring ISM-1526Depends on System Owners Continuously Monitor Security and Manage Threats, Risks and Controls ISM-1536Broader than Central Logging of Software Database Queries and Errors ISM-1537Broader than Log Security-Relevant Database Events Centrally ISM-1566Broader than Central Logging of Unprivileged System Access ISM-1586Broader than Record All Data Imports and Exports ISM-1613Broader than Central Logging of Break Glass Account Usage ISM-1623Broader than Centralised Logging of PowerShell Activities ISM-1650Broader than Log Management of Privileged User Activities ISM-1683Broader than Central Logging of Multi-factor Authentication Events ISM-1830Broader than Central Logging of Security Events for Microsoft AD Infrastructure Servers ISM-1855Broader than Central Logging of Multifunction Device Use ISM-1889Broader than Central Logging of Command Line Events ISM-1895Broader than Log Single-factor Authentication Events ISM-1906Broader than Timely Analysis of Internet-Facing Server Logs ISM-1911Broader than Centralised Logging of Software Errors and Usage ISM-1937Broader than Weekly Audit of sIDHistory in User Accounts ISM-1959Broader than Ensure Consistent Formatting for Event Logs ISM-1963Broader than Central Logging of Events on Internet-Facing Devices ISM-1964Broader than Central Logging for Network Device Events ISM-1978Broader than Centralised Logging for Server Application Events ISM-1979Broader than Central Logging for Security Events on Servers ISM-1983Broader than Log Events Sent to Centralised Facility Quickly ISM-1984Broader than Encrypt Event Logs in Transit Using ASD Cryptography ISM-1985Broader than Protect Event Logs from Unauthorised Access ISM-1986Broader than Timely Analysis of Critical Server Event Logs ISM-1987Broader than Timely Analysis of Security Event Logs ISM-1988Broader than Ensure Event Logs Are Retained for 12 Months ISM-1989Partially overlaps Ensure Event Logs Meet Retention Requirements ISM-2015Broader than Central Logging of Non-Internet Network API Data Access ISM-2046Partially overlaps Ensure Secure Impersonation Logging Practices ISM-2051Broader than Ensure Event Logs for Cyber security Event Detection ISM-2052Broader than Ensure Event Logs Protect Sensitive Data ISM-2089Broader than Monitor AI Model Performance and Investigate Anomalies ISM-2116Depends on Use Cyber Threat Intelligence for Event Detection ISM-2117Depends on AI Models Augment Cyber Security Event Detection ISM-2125Broader than Independently Log and Analyse All Service Provider System Access ISM-2129Broader than Centrally Log WMI Activity and Event Subscriptions ISM-2132Broader than Central Logging of Certificate Enrolment Requests, Template and AD CS Configuration Changes ISM-2139Broader than Central Logging of Third-Party OAuth Consent, Token Issuance and Use ISM-2153Depends on Quarterly Threat Hunting Informed by Current Threat Intelligence ISM-2159Broader than Centrally Log Agentic AI Tool Invocations, External Requests and Outputs
Annex A 8.16 Monitoring Networks and Systems for Anomalous Behaviour	Technological controls	ISM-0120Depends on Access to Tools for Detecting Security Events ISM-0261Depends on Log Web Proxy Activity for Security Analysis ISM-0263Depends on Inspect and Decrypt TLS Traffic through Gateways ISM-0582Partially meets Central Logging of Windows Security Events ISM-0585Depends on Capture Detailed Information in Event Logs ISM-0634Depends on Central Logging for Gateway Security Events ISM-0652Partially overlaps Quarantine Suspicious Files for Review ISM-1028Broader than Use NIDS/NIPS for Gateway Network Security ISM-1030Broader than Deploy NIDS/NIPS for Gateway Traffic Monitoring ISM-1034Depends on Deploy HIPS or EDR on Critical and High-Value Servers ISM-1213Broader than Enhanced Monitoring After Intrusion Remediation Until Eradication Is Confirmed ISM-1341Depends on Implement HIPS or EDR on Workstations ISM-1430Depends on Configure IPv6 Addresses with DHCPv6 in Stateful Mode ISM-1431Partially overlaps Strategies for Mitigating Denial-of-Service Attacks ISM-1526Partially overlaps System Owners Continuously Monitor Security and Manage Threats, Risks and Controls ISM-1537Depends on Log Security-Relevant Database Events Centrally ISM-1556Partially overlaps Security Measures After Overseas Travel with Mobile Devices ISM-1566Depends on Central Logging of Unprivileged System Access ISM-1607Broader than Integrity Monitoring and Logging for Isolation Mechanism ISM-1625Partially overlaps Develop Insider Threat Mitigation Programs ISM-1650Depends on Log Management of Privileged User Activities ISM-1830Depends on Central Logging of Security Events for Microsoft AD Infrastructure Servers ISM-1889Depends on Central Logging of Command Line Events ISM-1911Depends on Centralised Logging of Software Errors and Usage ISM-1963Depends on Central Logging of Events on Internet-Facing Devices ISM-1976Broader than Central Logging of Security Events on macOS ISM-1978Partially meets Centralised Logging for Server Application Events ISM-1979Partially meets Central Logging for Security Events on Servers ISM-1987Partially overlaps Timely Analysis of Security Event Logs ISM-2015Depends on Central Logging of Non-Internet Network API Data Access ISM-2051Depends on Ensure Event Logs for Cyber security Event Detection ISM-2089Broader than Monitor AI Model Performance and Investigate Anomalies ISM-2114Broader than Monitor Baselines for AI Application Performance ISM-2116Depends on Use Cyber Threat Intelligence for Event Detection ISM-2117Depends on AI Models Augment Cyber Security Event Detection ISM-2153Depends on Quarterly Threat Hunting Informed by Current Threat Intelligence
Annex A 8.17 Clock synchronisation for information systems	Technological controls	ISM-0585Supports Capture Detailed Information in Event Logs ISM-0988Partially overlaps Ensure Accurate Time Source for Event Logs
Annex A 8.18 Use of Privileged Utility Programs	Technological controls	ISM-0846Partially overlaps Users Cannot Disable, Bypass or Be Exempted From Application Control ISM-1491Partially overlaps Block Unprivileged Users From Running Script Execution Engines ISM-1584Partially overlaps Prevent Unauthorised Changes to Security Settings ISM-1592Partially overlaps Restrict Unprivileged Users From Installing Unapproved Applications ISM-1657Partially overlaps Restrict Application Execution to Approved Set ISM-1658Partially overlaps Restrict Execution of Drivers via Application Control
Annex A 8.19 Secure Software Installation Procedures	Technological controls	ISM-0042Partially meets Maintain Effective System Administration Practices ISM-0289Partially overlaps Implement and Manage Evaluated Products Correctly ISM-0382Broader than Prevent Unprivileged Human Users Uninstalling or Disabling Approved Applications ISM-0912Partially overlaps Establish and Manage System Configuration Changes ISM-1143Partially overlaps Develop and Maintain Patch Management Procedures ISM-1211Depends on System Administration Performed Under Change and Configuration Management Plan ISM-1245Broader than Remove Temporary Files After Server Installation ISM-1406Partially overlaps Use SOEs for Workstations and Servers ISM-1409Partially overlaps Implement Restrictive OS Hardening Guidelines ISM-1419Partially overlaps Software Development in Development Environments ISM-1493Partially overlaps Maintain and Verify Software Registers ISM-1592Partially overlaps Restrict Unprivileged Users From Installing Unapproved Applications ISM-1606Supports Patch Isolation Mechanisms and Underlying Operating Systems Promptly ISM-1608Broader than Scan Third-Party SOEs for Malicious Code ISM-1635Partially meets System Owners Implement Security Controls for Each System and Environment ISM-1796Supports Digitally Sign Executable Software for Security ISM-1797Partially meets Ensure Software Updates are Securely Signed ISM-1800Partially overlaps Ensure Network Devices Have Trusted Firmware ISM-1871Depends on Implement Application Control Exclusions for System Areas ISM-1915Partially overlaps Ensure User Application Configurations are Approved ISM-1926Broader than Restrict Identity Servers to Their Designed Role Only ISM-2023Partially overlaps Maintain a Reliable Source for Software ISM-2027Supports Verify Software Artefacts with Digital Signatures ISM-2111Broader than Remove Temporary Installation Files Post-Installation
Annex A 8.20 Network and Network Devices Security	Technological controls	ISM-0245Broader than Prevent MFD Connections to Digital Phone Systems ISM-0263Broader than Inspect and Decrypt TLS Traffic through Gateways ISM-0467Broader than Using HACE for Secure Communication of Data ISM-0469Broader than Use Approved Cryptographic Protocols When Encrypting Data In Transit ISM-0484Broader than Configure SSH for Secure Server Access ISM-0494Broader than Use of IPsec Tunnel and Transport Modes ISM-0516Broader than Comprehensive Network Diagrams for Critical Components ISM-0518Supports Maintain Comprehensive Network Documentation ISM-0520Broader than Prevent Unauthorised Network Device Connections ISM-0529Broader than Avoid Using VLANs for Different Security Domains ISM-0530Broader than Administer VLANs from Trusted Security Domains ISM-0534Broader than Disable Unused Network Device Ports ISM-0546Broader than Use Video and Voice-Aware Firewalls at Gateways ISM-0548Depends on Ensure Secure Protocols for Video and IP Calls ISM-0551Broader than Ensure Secure IP Telephony Device Authentication ISM-0558Broader than Restrict IP Phone Network Access in Public Areas ISM-0569Broader than Centralise Email Routing via Gateways ISM-0572Broader than Enable Opportunistic TLS for Email Server Encryption ISM-0622Broader than Ensuring Network Authentication via Gateways ISM-0628Broader than Implementing Secure Network Gateways ISM-0629Broader than Manage Gateways Between Different Security Domains ISM-0631Broader than Restrict Data Flows with Authorised Gateways ISM-0639Broader than Use Evaluated Firewalls Between Security Domains ISM-0643Broader than Use of Diodes for Unidirectional Gateway Security ISM-0874Broader than Ensure Internet Access via Organisation's Gateway ISM-1006Broader than Prevent Unauthorised Access to Network Traffic ISM-1028Broader than Use NIDS/NIPS for Gateway Network Security ISM-1030Broader than Deploy NIDS/NIPS for Gateway Traffic Monitoring ISM-1085Broader than Encrypt Sensitive Data Over Public Networks ISM-1157Broader than Use Evaluated Diodes to Control Unidirectional Gateway Data Flow ISM-1158Broader than High Assurance Evaluation for Network Diodes ISM-1182Broader than Implement Network Traffic Control Measures ISM-1192Broader than Inspecting and Filtering Data with Gateways ISM-1270Broader than Database Servers on Separate Network Segment ISM-1271Broader than Restrict Network Access to Database Servers ISM-1286Supports Ensure Content Conversion at Gateways ISM-1296Partially overlaps Protect Network Devices in Public Areas ISM-1304Broader than Secure Network Devices by Changing Default Credentials ISM-1311Broader than Prevent Use of Insecure SNMP Versions on Networks ISM-1312Broader than Changing Default SNMP Community Strings on Devices ISM-1314Broader than Ensure Wireless Devices are Wi-Fi Alliance Certified ISM-1315Broader than Disable Wireless Network Administrative Interfaces ISM-1316Broader than Ensure Default Wireless SSIDs Are Changed ISM-1317Broader than Secure Naming of Non-Public Wireless Networks ISM-1318Broader than Keep SSID Broadcasting Enabled on Wireless Access Points ISM-1319Broader than Avoid Static IP Addressing on Wireless Networks ISM-1320Broader than Avoid Using MAC Filtering for Wireless Access Control ISM-1321Broader than Enforce 802.1X EAP-TLS Mutual Authentication With Other EAP Methods Disabled ISM-1322Broader than Using Evaluated Supplicants, Authenticators and Authentication Servers for 802.1X ISM-1323Broader than Requiring X.509 Certificates for 802.1X Network Authentication ISM-1330Broader than Limit PMK Caching Duration on Wireless Networks ISM-1332Broader than Ensure Wireless Traffic is Secure with WPA3-Enterprise ISM-1334Broader than Ensure Frequency Separation in Wireless Networks ISM-1335Broader than Enabling 802.11w to Protect Wireless Management Frames ISM-1338Broader than Use Lower-Powered Wireless Access Points for Coverage ISM-1364Broader than Separate VLANs by Security Domains ISM-1386Broader than Restrict Network Management Traffic Origin ISM-1416Broader than Implement Firewalls to Control Network Connections ISM-1427Broader than Prevent IP Source Address Spoofing in Gateways ISM-1428Broader than Disable IPv6 Tunnelling Unless Necessary ISM-1429Broader than Block IPv6 Tunnelling at Externally Connected Network Boundaries ISM-1430Broader than Configure IPv6 Addresses with DHCPv6 in Stateful Mode ISM-1439Broader than Restrict IP Disclosure in CDNs ISM-1506Broader than Disable SSH Version 1 for Security ISM-1521Broader than Use Protocol Breaks to Separate Network Layers ISM-1522Broader than Ensure CDSs Separate Upward and Downward Data Paths ISM-1532Broader than Avoid Using VLANs for Network Separation ISM-1553Broader than Disable TLS Compression for Security ISM-1562Broader than Secure Video Conferencing and Telephony Systems ISM-1628Broader than Prevent Anonymity Network Traffic in Outbound Connections ISM-1710Broader than Secure Default Settings for Wireless Access Points ISM-1753Broader than Replace Unsupported Internet-Facing Devices ISM-1772Broader than Use Secure Pseudorandom Functions for IPsec Connections ISM-1774Broader than Secure Management Paths for Network Gateways ISM-1781Broader than Encrypt Network Data with ASD-Approved Cryptography ISM-1782Broader than Use Protective DNS to Block Malicious Domains ISM-1783Broader than Secure BGP with Valid ROA for IP Addresses ISM-1800Broader than Ensure Network Devices Have Trusted Firmware ISM-1801Broader than Monthly Restart of Network Devices ISM-1809Depends on Compensating Controls for Unsupported Systems Pending Removal or Replacement ISM-1862Broader than Restrict Access and Conceal Web Server IP Addresses ISM-1863Broader than Restrict Exposure of Network Management Interfaces ISM-1899Broader than Restrict Unauthorised Network Connections ISM-1912Broader than Document Device Settings for Critical and High-Value Servers ISM-1929Broader than Ensure LDAP Signing on AD DS Domain Controllers ISM-1962Broader than Disable SMBv1 Protocol on Networks ISM-1963Broader than Central Logging of Events on Internet-Facing Devices ISM-1964Broader than Central Logging for Network Device Events ISM-1981Broader than Replace Unsupportable Non-Internet Network Devices ISM-1982Supports Replace Unsupported Networked IT Equipment ISM-2017Broader than Encrypt DNS Traffic Between Clients and Servers ISM-2018Broader than Secure BGP Routing with RPKI-Registered IP Addresses ISM-2097Broader than Configure Mobile Devices with Always On VPN ISM-2130Broader than Disabling or Hardening AD CS Web Enrolment Interfaces ISM-2150Broader than Gateways Block Connections for Unauthorised RMM and Remote Access Tools ISM-2161Broader than Verify Network Device Firmware and Configuration Against Known-Good Baseline ISM-2162Broader than Disabling or Removing Unneeded Network Device Components and Services ISM-2163Broader than Enable MACsec Confidentiality Mode Using GCM-AES Cipher Suites ISM-2164Broader than Set MACsec Connectivity Association Lifetime Below 24 Hours ISM-2166Broader than MACsec Secure Association Lifetime Limited To Under Four Hours ISM-2167Broader than Disabling Pre-Shared Key Fallback Authentication for MACsec
Annex A 8.21 Security of Network Services	Technological controls	ISM-0558Broader than Restrict IP Phone Network Access in Public Areas ISM-1037Depends on Regular Testing of Gateway Security Configurations ISM-1182Partially overlaps Implement Network Traffic Control Measures ISM-1186Broader than Ensure IPv6 Network Security Appliances Are Used ISM-1314Broader than Ensure Wireless Devices are Wi-Fi Alliance Certified ISM-1323Broader than Requiring X.509 Certificates for 802.1X Network Authentication ISM-1335Broader than Enabling 802.11w to Protect Wireless Management Frames ISM-1479Partially overlaps Minimise Server-to-Server Communication ISM-1577Partially overlaps Ensure Network Segregation from Service Providers ISM-1579Partially overlaps Dynamic Resource Scaling for Demand Spikes ISM-1581Partially overlaps Monitor Capacity and Availability of Online Services ISM-1628Broader than Prevent Anonymity Network Traffic in Outbound Connections ISM-1738Partially overlaps Verify Compliance with Security Requirements ISM-1962Broader than Disable SMBv1 Protocol on Networks ISM-2068Supports Restrict Internet Access for Networked Devices
Annex A 8.22 Network Segregation for Security	Technological controls	ISM-0213Broader than Segregate Patch Panels for Secret-Level Cables ISM-0385Partially overlaps Maintain Effective Functional Separation Between Servers ISM-0529Broader than Avoid Using VLANs for Different Security Domains ISM-0530Supports Administer VLANs from Trusted Security Domains ISM-0535Broader than Prevent VLAN Trunk Sharing Across Security Domains ISM-0536Broader than Segregate Public Wireless Networks from Organisation Networks ISM-0549Broader than Separate Video Conferencing and IP Telephony Traffic From Other Data ISM-0556Broader than Ensure Traffic Separation for Video Conferencing and Telephony ISM-0558Broader than Restrict IP Phone Network Access in Public Areas ISM-0626Broader than Implementing CDS for Secure Network Segmentation ISM-0628Broader than Implementing Secure Network Gateways ISM-0629Supports Manage Gateways Between Different Security Domains ISM-0631Depends on Restrict Data Flows with Authorised Gateways ISM-0635Broader than Ensure Network Paths are Isolated in CDSs ISM-0637Broader than Implementing Demilitarised Zones in Gateways ISM-0639Broader than Use Evaluated Firewalls Between Security Domains ISM-0643Broader than Use of Diodes for Unidirectional Gateway Security ISM-0645Broader than High Assurance Evaluation of Unidirectional Gateways ISM-0874Broader than Ensure Internet Access via Organisation's Gateway ISM-1157Broader than Use Evaluated Diodes to Control Unidirectional Gateway Data Flow ISM-1158Broader than High Assurance Evaluation for Network Diodes ISM-1181Equivalent Segregate Networks by Server Criticality ISM-1182Partially overlaps Implement Network Traffic Control Measures ISM-1269Partially overlaps Ensure Databases and Web Servers are Separated ISM-1270Broader than Database Servers on Separate Network Segment ISM-1271Partially overlaps Restrict Network Access to Database Servers ISM-1364Broader than Separate VLANs by Security Domains ISM-1385Partially overlaps Segregation of Administrative Infrastructure from Networks ISM-1386Partially overlaps Restrict Network Management Traffic Origin ISM-1436Broader than Segregate Critical Services to Prevent DoS Attacks ISM-1439Broader than Restrict IP Disclosure in CDNs ISM-1457Depends on Evaluate Peripheral Switches for Security Domains ISM-1479Partially overlaps Minimise Server-to-Server Communication ISM-1521Supports Use Protocol Breaks to Separate Network Layers ISM-1522Supports Ensure CDSs Separate Upward and Downward Data Paths ISM-1528Broader than Utilising Evaluated Firewalls for Network Security ISM-1532Broader than Avoid Using VLANs for Network Separation ISM-1577Partially overlaps Ensure Network Segregation from Service Providers ISM-1750Partially overlaps Segregation of Administrative Infrastructure for Server Security ISM-1774Partially overlaps Secure Management Paths for Network Gateways ISM-1862Partially overlaps Restrict Access and Conceal Web Server IP Addresses ISM-1899Broader than Restrict Unauthorised Network Connections ISM-1970Broader than Segregated Environment for Malicious Code Analysis ISM-2068Supports Restrict Internet Access for Networked Devices ISM-2152Depends on Segregate Backup Infrastructure With Separate Administrative Authentication ISM-2160Broader than Restricting Networked Management Interfaces to a Segregated Management Network
Annex A 8.23 Web Filtering to Reduce Malicious Website Exposure	Technological controls	ISM-0258Supports Establish and Maintain a Web Usage Policy ISM-0260Supports Ensure All Web Access Uses Proxies ISM-0267Broader than Blocking Access to Unapproved Webmail Services ISM-0659Partially overlaps Filtering Content of Gateway and CDS Files ISM-0874Depends on Ensure Internet Access via Organisation's Gateway ISM-0958Partially overlaps Implement Domain Name Allow and Block Lists ISM-0961Broader than Restrict Active Content with Web Filters ISM-0963Equivalent Implementing Web Content Filters for Safety ISM-1171Broader than Block Direct IP Access to Websites ISM-1236Broader than Blocking Malicious and Anonymous Domain Names ISM-1237Partially overlaps Implement Web Content Filters for Outbound Traffic ISM-1485Broader than Prevent Web Browsers from Processing Ads ISM-1782Broader than Use Protective DNS to Block Malicious Domains ISM-2068Partially overlaps Restrict Internet Access for Networked Devices ISM-2112Partially overlaps Disable AI Applications' Direct Access to External Public Data Sources
Annex A 8.24 Effective Use of Cryptography and Key Management	Technological controls	ISM-0142Partially overlaps Report Cryptographic Equipment Compromises Promptly ISM-0232Broader than Encrypt External Traffic for Sensitive Calls ISM-0233Broader than Use Encrypted Cordless Systems for Sensitive Conversations ISM-0455Partially overlaps Enable Data Recovery for Encrypted Data ISM-0457Broader than Use Evaluated Crypto for Sensitive Data Encryption ISM-0459Broader than Implement Full or Partial Disk Encryption ISM-0460Broader than Use HACE for Encrypting Sensitive Media ISM-0465Broader than Use Evaluated Cryptographic Tools for Sensitive Data ISM-0467Broader than Using HACE for Secure Communication of Data ISM-0469Partially overlaps Use Approved Cryptographic Protocols When Encrypting Data In Transit ISM-0471Broader than Use Only High Assurance Cryptographic Algorithms ISM-0472Broader than Using Proper Modulus Size for Diffie-Hellman Keys ISM-0474Broader than Using Secure Elliptic Curve Diffie-Hellman Encryption ISM-0475Broader than Use P-384 Curve for Secure Digital Signatures ISM-0476Broader than Ensuring Strong RSA Modulus for Digital Security ISM-0477Broader than Separate RSA Key Pairs for Different Functions ISM-0479Broader than Avoid Using ECB Mode for Symmetric Encryption ISM-0481Broader than Ensure Use of High Assurance Cryptographic Protocols ISM-0489Broader than Four-Hour Cached SSH Private Key Lifetime and Screen Locks ISM-0490Broader than Ensure S/MIME 3.0 or Later is Used ISM-0496Broader than Use ESP Protocol for Secure IPsec Connections ISM-0507Equivalent Develop and Maintain Cryptographic Key Management Processes ISM-0547Broader than Secure Protocols for Video and IP Telephony ISM-0554Supports Secure Two-Way Authentication for Video Calls ISM-0571Broader than Ensure Secure Email Transmission via Gateways ISM-0572Broader than Enable Opportunistic TLS for Email Server Encryption ISM-0675Supports Ensure Data Exports are Digitally Signed ISM-0702Partially overlaps Using Cryptographic Sanitisation on Mobile Devices ISM-0869Broader than Encrypt Storage on Mobile Devices ISM-0994Broader than Use ECDH for Secure Key Exchanges ISM-0998Broader than Using Integrity Algorithms for IPsec Connections ISM-0999Broader than Use DH or ECDH for Secure Key Establishment ISM-1000Broader than Utilising Perfect Forward Secrecy for IPsec ISM-1059Supports Encrypt All Data Stored on Media Using ASD-Approved Cryptography ISM-1080Partially overlaps Use AACA or High Assurance Algorithms for Data Encryption ISM-1085Broader than Encrypt Sensitive Data Over Public Networks ISM-1091Broader than Change Keying Material When Compromised ISM-1139Broader than Require Latest Version of TLS for Security ISM-1233Broader than Use IKE Version 2 for IPsec Key Exchange ISM-1277Broader than Encrypt Database and Web Server Communications ISM-1324Broader than Generating X.509 Certificates With Evaluated CA or HSM ISM-1327Broader than Access Controls, Encryption and User Authentication for X.509 Certificates ISM-1332Broader than Ensure Wireless Traffic is Secure with WPA3-Enterprise ISM-1369Broader than Ensure TLS Connections Use AES-GCM Encryption ISM-1370Broader than Ensure Only Server-Initiated TLS Renegotiation ISM-1372Broader than Ephemeral DH or ECDH Key Establishment for TLS Connections ISM-1373Broader than Ensure TLS Connections do not use Anonymous DH ISM-1374Broader than Use SHA-2 Certificates for Secure TLS Connections ISM-1375Broader than Use SHA-2 for Secure TLS Connections ISM-1446Broader than Use Approved Elliptic Curves for Encryption ISM-1449Broader than Protect SSH Private Keys with Passwords or Encryption ISM-1453Broader than Ensure PFS is Enabled for TLS Connections ISM-1454Broader than Enhancing Security with Encrypted RADIUS Communications ISM-1629Broader than Select Correct Modulus for Diffie-Hellman Encryption ISM-1712Broader than Ensure Secure Authenticator Communication for Wireless FT ISM-1759Broader than Ensure Strong Encryption with Diffie-Hellman ISM-1761Broader than Use NIST Curves for ECDH Encryption ISM-1762Broader than Use NIST P-384 Curve for ECDH Keys ISM-1763Broader than Use NIST P-384 Curve for ECDSA Signatures ISM-1764Broader than Use NIST P-384 Curve for ECDSA Signatures ISM-1765Broader than Use RSA with 3072-bit Modulus for Security ISM-1766Broader than Ensure Secure Hashing with SHA-2 Algorithm ISM-1767Broader than Use SHA-2 with Minimum 256-bit Output ISM-1768Broader than Use Appropriate SHA-2 Output Size for Hashing ISM-1769Broader than Using AES Encryption with Strong Key Lengths ISM-1770Broader than Utilise Strong AES Encryption Algorithms ISM-1771Broader than Use AES Encryption for IPsec Connections ISM-1772Broader than Use Secure Pseudorandom Functions for IPsec Connections ISM-1796Supports Digitally Sign Executable Software for Security ISM-1802Broader than Operate Approved High Assurance Cryptographic Equipment ISM-1917Partially overlaps Support Post-Quantum Cryptographic Algorithms by 2030 ISM-1928Supports Encrypt and Restrict Access to Microsoft AD and Entra Connect Server Backups ISM-1945Broader than Remove Enrollee Supplies Subject Flag from Templates ISM-1957Broader than Hardware Security Module Protection for Microsoft AD CS Private Keys ISM-1984Broader than Encrypt Event Logs in Transit Using ASD Cryptography ISM-1990Broader than Prefer FIPS 140-3 Validated ML-DSA and ML-KEM Implementations ISM-1991Broader than Implement ML-DSA for Enhanced Digital Signature Security ISM-1992Broader than Using Hedged Variant of ML-DSA for Digital Signatures ISM-1993Broader than Use Pre-Hashed ML-DSA Variants Only When Necessary ISM-1994Broader than Use Correct Hashing for ML-DSA Pre-hashed Variants ISM-1995Broader than Use ML-KEM for Secure Key Encapsulation ISM-1996Broader than Using Hybrid Schemes for Secure Encryption ISM-2010Broader than Ensure SPNs Use Strong Encryption in AD Services ISM-2017Broader than Encrypt DNS Traffic Between Clients and Servers ISM-2050Broader than Validate Digital Signature Certificates Securely ISM-2073Broader than Develop a Post-Quantum Cryptography Transition Plan ISM-2082Broader than Using Cryptographic BOM in Software Development ISM-2108Broader than Mobile Apps Encrypt Sensitive Data Using ASD-Approved Cryptography ISM-2109Partially overlaps Pre-Boot Authentication for Encrypted System Volume Media ISM-2163Broader than Enable MACsec Confidentiality Mode Using GCM-AES Cipher Suites ISM-2164Broader than Set MACsec Connectivity Association Lifetime Below 24 Hours ISM-2166Broader than MACsec Secure Association Lifetime Limited To Under Four Hours
Annex A 8.25 Secure Development Lifecycle	Technological controls	ISM-0401Partially overlaps Implement Secure by Design in Software Development ISM-0402Broader than Software Vulnerability Testing Using SAST, DAST and SCA ISM-0938Broader than Select Secure-by-Design Committed Vendors ISM-0971Broader than Use OWASP Standards in Web Application Development ISM-1238Broader than Incorporate Threat Modelling in Software Development ISM-1239Broader than Ensure Use of Robust Web Application Frameworks ISM-1240Broader than Ensure Input Validation and Sanitisation for Internet Data ISM-1241Broader than Ensuring Secure Web Application Output Encoding ISM-1275Broader than Ensure Secure Database Queries in Software ISM-1276Broader than Use Safe Database Query Methods ISM-1278Broader than Minimise Database Error Information in Software ISM-1419Broader than Software Development in Development Environments ISM-1616Supports Implementing a Vulnerability Disclosure Program ISM-1730Broader than Provide a Software Bill of Materials to Consumers ISM-1780Partially overlaps Apply SecDevOps for Secure Software Development ISM-1796Broader than Digitally Sign Executable Software for Security ISM-1797Broader than Ensure Software Updates are Securely Signed ISM-1798Broader than Develop Secure Configuration Guidelines for Software ISM-1849Broader than Implement OWASP Top 10 in Web Development ISM-1850Broader than Mitigate OWASP Top 10 in Web Applications ISM-1851Broader than Secure Development Using OWASP API Security Top 10 ISM-1922Broader than Use OWASP Standards in Mobile App Development ISM-2016Broader than Ensure Input Validation and Sanitisation for Security ISM-2025Broader than Using Issue Tracking for Software Development Tasks ISM-2028Broader than Test Software Artefacts for Security Weaknesses ISM-2029Broader than Restrict Third-Party Libraries to Trustworthy Sources ISM-2030Broader than Commit-Time Scanning Blocks Secrets From Source Repositories ISM-2031Broader than Secure System Build Tools Implementation ISM-2033Partially meets Document and Maintain Software Security Requirements ISM-2034Broader than Document and Review Security Design in Development ISM-2036Broader than Document Security Duties for Software Developers ISM-2039Broader than Review Threat Model During Software Development ISM-2040Broader than Ensure Secure Programming Practices in Software Development ISM-2041Broader than Ensure Use of Memory-Safe Programming Practices ISM-2042Partially overlaps Ensuring Security in Software Development Lifecycle ISM-2043Broader than Ensuring Readable and Maintainable Software Architecture ISM-2055Broader than Ensure Software Components Meet Build Standards ISM-2056Broader than Provide Provenance for Software Builds ISM-2057Broader than Document, Build and Test All Input Validation Rules ISM-2060Broader than Ensure Code Reviews for Secure Software Design ISM-2061Broader than Peer Reviews of Critical and Security-Related Software Components ISM-2064Broader than Ensure Secure Cookies with Signed Bearer Tokens ISM-2083Partially overlaps Provide a Cryptographic Bill of Materials to Software Users ISM-2121Depends on Prevent Using Developers Without Cyber Security Skills ISM-2122Broader than Use Suitable AI Models to Augment Software Security Testing ISM-2154Broader than Pinning Software Artefact Dependencies to Approved Versions in Source Code ISM-2155Broader than Reproducible Builds Enabling Independent Verification of Release Artefacts
Annex A 8.26 Defining Security Requirements for Applications	Technological controls	ISM-0971Broader than Use OWASP Standards in Web Application Development ISM-1238Depends on Incorporate Threat Modelling in Software Development ISM-1424Broader than Ensure Web Security Through Response Headers ISM-1552Broader than Secure Web Content with HTTPS Only ISM-1568Supports Ensure Security Commitment from Suppliers ISM-1634Partially overlaps System Owners Select and Tailor Controls in Consultation with Authorising Officer ISM-1739Partially overlaps Approve Security Architecture Before System Development ISM-1849Supports Implement OWASP Top 10 in Web Development ISM-1850Broader than Mitigate OWASP Top 10 in Web Applications ISM-1851Broader than Secure Development Using OWASP API Security Top 10 ISM-1917Broader than Support Post-Quantum Cryptographic Algorithms by 2030 ISM-1924Depends on Detect and Mitigate Adversarial Prompts in Generative AI Applications ISM-2033Partially overlaps Document and Maintain Software Security Requirements ISM-2039Supports Review Threat Model During Software Development ISM-2045Supports Keep Security Measures and Features Intact When Supporting Application Backwards Compatibility ISM-2046Broader than Ensure Secure Impersonation Logging Practices ISM-2059Broader than Restrict and Scan File Uploads for Security ISM-2063Broader than Ensure Web App Cookies Have Security Flags ISM-2064Broader than Ensure Secure Cookies with Signed Bearer Tokens ISM-2065Broader than Ensure Secure Session Cookies with High Entropy Tokens ISM-2067Depends on Ensure Single Logout for Single Sign-On Web Applications ISM-2110Partially overlaps Hardening User Applications with ASD and Vendor Guidance ISM-2113Broader than Configuring AI Applications to Require Human Approval Before High-Impact Actions
Annex A 8.27 Secure system architecture and engineering principles	Technological controls	ISM-0246Depends on Contact ASD for Emanation Security Assessment ISM-0401Partially meets Implement Secure by Design in Software Development ISM-0938Broader than Select Secure-by-Design Committed Vendors ISM-0971Broader than Use OWASP Standards in Web Application Development ISM-1238Broader than Incorporate Threat Modelling in Software Development ISM-1460Broader than Secure By Design Vendor Isolation Mechanisms ISM-1522Depends on Ensure CDSs Separate Upward and Downward Data Paths ISM-1739Partially overlaps Approve Security Architecture Before System Development ISM-1780Partially overlaps Apply SecDevOps for Secure Software Development ISM-1798Broader than Develop Secure Configuration Guidelines for Software ISM-1826Depends on Select Vendors Committed to Secure Design for Servers ISM-1850Broader than Mitigate OWASP Top 10 in Web Applications ISM-1885Broader than Implement Emanation Security Measures for Systems ISM-1917Broader than Support Post-Quantum Cryptographic Algorithms by 2030 ISM-2031Broader than Secure System Build Tools Implementation ISM-2033Partially overlaps Document and Maintain Software Security Requirements ISM-2034Broader than Document and Review Security Design in Development ISM-2039Broader than Review Threat Model During Software Development ISM-2042Partially overlaps Ensuring Security in Software Development Lifecycle ISM-2043Broader than Ensuring Readable and Maintainable Software Architecture ISM-2060Depends on Ensure Code Reviews for Secure Software Design ISM-2082Depends on Using Cryptographic BOM in Software Development ISM-2084Partially overlaps Document AI Model and System Characteristics ISM-2154Broader than Pinning Software Artefact Dependencies to Approved Versions in Source Code ISM-2158Broader than Treat Agentic AI Retrieved External Content as Untrusted Data
Annex A 8.28 Secure Coding Practices in Software Development	Technological controls	ISM-0401Partially meets Implement Secure by Design in Software Development ISM-0402Supports Software Vulnerability Testing Using SAST, DAST and SCA ISM-0938Broader than Select Secure-by-Design Committed Vendors ISM-0971Broader than Use OWASP Standards in Web Application Development ISM-1239Broader than Ensure Use of Robust Web Application Frameworks ISM-1241Broader than Ensuring Secure Web Application Output Encoding ISM-1275Broader than Ensure Secure Database Queries in Software ISM-1276Broader than Use Safe Database Query Methods ISM-1278Broader than Minimise Database Error Information in Software ISM-1460Partially overlaps Secure By Design Vendor Isolation Mechanisms ISM-1780Partially meets Apply SecDevOps for Secure Software Development ISM-1826Partially overlaps Select Vendors Committed to Secure Design for Servers ISM-1849Broader than Implement OWASP Top 10 in Web Development ISM-1850Broader than Mitigate OWASP Top 10 in Web Applications ISM-1851Broader than Secure Development Using OWASP API Security Top 10 ISM-1922Broader than Use OWASP Standards in Mobile App Development ISM-1924Depends on Detect and Mitigate Adversarial Prompts in Generative AI Applications ISM-2016Broader than Ensure Input Validation and Sanitisation for Security ISM-2030Broader than Commit-Time Scanning Blocks Secrets From Source Repositories ISM-2031Broader than Secure System Build Tools Implementation ISM-2037Depends on Train Software Developers Lacking Cyber Security Skills ISM-2040Equivalent Ensure Secure Programming Practices in Software Development ISM-2041Partially overlaps Ensure Use of Memory-Safe Programming Practices ISM-2042Partially overlaps Ensuring Security in Software Development Lifecycle ISM-2057Broader than Document, Build and Test All Input Validation Rules ISM-2058Broader than Ensure Data Validation Before Deserialisation ISM-2059Broader than Restrict and Scan File Uploads for Security ISM-2060Broader than Ensure Code Reviews for Secure Software Design ISM-2061Partially meets Peer Reviews of Critical and Security-Related Software Components ISM-2062Supports Unit and Integration Testing for Code Quality ISM-2064Broader than Ensure Secure Cookies with Signed Bearer Tokens ISM-2066Broader than Centralised Management of Web Application Sessions ISM-2085Broader than Prevent Exposure of AI Model Confidence Scores ISM-2158Broader than Treat Agentic AI Retrieved External Content as Untrusted Data
Annex A 8.29 Security testing in development and acceptance	Technological controls	ISM-0401Partially meets Implement Secure by Design in Software Development ISM-0402Broader than Software Vulnerability Testing Using SAST, DAST and SCA ISM-0971Broader than Use OWASP Standards in Web Application Development ISM-1238Supports Incorporate Threat Modelling in Software Development ISM-1524Broader than Ensure Rigorous Testing of Content Filters ISM-1780Partially meets Apply SecDevOps for Secure Software Development ISM-1791Partially overlaps Assess Integrity of Delivered IT and OT Products ISM-1850Supports Mitigate OWASP Top 10 in Web Applications ISM-1922Partially overlaps Use OWASP Standards in Mobile App Development ISM-2026Partially overlaps Scan Software Artefacts for Malicious Content ISM-2028Partially overlaps Test Software Artefacts for Security Weaknesses ISM-2032Broader than Ensure Automated Tests Are Completed Before Building ISM-2033Depends on Document and Maintain Software Security Requirements ISM-2039Supports Review Threat Model During Software Development ISM-2042Partially meets Ensuring Security in Software Development Lifecycle ISM-2054Broader than Ensure No Vulnerabilities in Third-Party Software Components ISM-2057Partially meets Document, Build and Test All Input Validation Rules ISM-2060Partially overlaps Ensure Code Reviews for Secure Software Design ISM-2061Partially overlaps Peer Reviews of Critical and Security-Related Software Components ISM-2062Partially meets Unit and Integration Testing for Code Quality ISM-2102Broader than Periodically Test Software Artefacts for Weaknesses ISM-2119Depends on Utilise AI Models in Vulnerability Assessments and Penetration Tests ISM-2122Broader than Use Suitable AI Models to Augment Software Security Testing
Annex A 8.30 Management of Outsourced System Development	Technological controls	ISM-0401Partially overlaps Implement Secure by Design in Software Development ISM-0402Supports Software Vulnerability Testing Using SAST, DAST and SCA ISM-0731Partially overlaps CISO Oversight of Cyber Supply Chain Risks ISM-1395Partially overlaps Ensuring Data Protection by Service Providers ISM-1452Partially overlaps Perform Supply Chain Risk Assessments for System Suppliers ISM-1738Partially overlaps Verify Compliance with Security Requirements ISM-1780Partially overlaps Apply SecDevOps for Secure Software Development ISM-1791Partially overlaps Assess Integrity of Delivered IT and OT Products ISM-1826Partially overlaps Select Vendors Committed to Secure Design for Servers ISM-2033Partially overlaps Document and Maintain Software Security Requirements
Annex A 8.31 Separation of Development, Test, and Production Environments	Technological controls	ISM-0385Partially overlaps Maintain Effective Functional Separation Between Servers ISM-0400Equivalent Segregation of Environments in Software Development ISM-1273Partially overlaps Segregate Environments for Database Servers ISM-1274Broader than Ensure Non-Production Databases Match Production Security ISM-1419Equivalent Software Development in Development Environments ISM-1420Partially overlaps Ensure Non-Production Security Matches Production ISM-2143Partially overlaps Unique Per-Application Credentials Not Shared Across Environments
Annex A 8.32 Change management procedures for information systems	Technological controls	ISM-0042Partially meets Maintain Effective System Administration Practices ISM-0300Partially overlaps Apply System Security Patches with Approval ISM-0597Broader than Consult ASD Before Changing CDS Connectivity ISM-0912Partially meets Establish and Manage System Configuration Changes ISM-1079Partially overlaps Seek Approval for High Assurance IT Repairs ISM-1143Supports Develop and Maintain Patch Management Procedures ISM-1211Partially overlaps System Administration Performed Under Change and Configuration Management Plan ISM-1419Broader than Software Development in Development Environments ISM-1598Partially overlaps Inspect IT Equipment Post-Maintenance for Unauthorised Changes ISM-1816Depends on Prevent Unauthorised Changes to Software Sources ISM-1944Broader than Remove EDITF_ATTRIBUTESUBJECTALTNAME2 Flag From AD CS Certification Authorities ISM-1948Broader than Certificate Manager Approval for Templates Allowing Supplied SANs ISM-2025Depends on Using Issue Tracking for Software Development Tasks ISM-2161Depends on Verify Network Device Firmware and Configuration Against Known-Good Baseline
Annex A 8.33 Test Information Selection and Protection	Technological controls	ISM-0831Partially overlaps Ensure Proper Handling of Sensitive Media
Annex A 8.34 Protection of information systems during audits	Technological controls	ISM-1524Partially overlaps Ensure Rigorous Testing of Content Filters ISM-1563Partially overlaps Assessor Produces Security Assessment Report Covering Required Content ISM-1636Partially overlaps Security Control Assessment of Systems by Own or IRAP Assessors ISM-1967Partially overlaps ASD Assessor Security Control Assessment of TOP SECRET Systems

How to use this mapping

Read it in whichever direction you are being assessed. If ISO 27001 is your primary framework, use the table to find the ASD ISM controls that cover the same ground, so evidence you already hold can be reused instead of rebuilt. If ASD ISM is what you are being held to, work back from the counterpart column to see which ISO 27001 controls contribute. A mapping means the two controls address related risk, not that satisfying one satisfies the other, so always read the relationship label before relying on it.

ISO 27001 ASD ISM All mappings

Frequently asked questions

Does meeting ISO 27001 mean I meet the ASD ISM?

No. The mapping shows where the two frameworks address related risk, not that one satisfies the other. ISO/IEC 27001:2022 Annex A controls are broad outcome statements, while ISM controls are specific and often technical, so a single Annex A control typically corresponds to many ISM controls and rarely covers all of them. Use the mapping to reuse evidence, then check each ISM control on its own terms.

Why does one ISO 27001 control map to so many ISM controls?

Because the two are written at different levels of detail. An Annex A control such as access control states an outcome in a sentence or two. The ISM breaks the same ground into many separate, testable requirements covering privileged access, authentication, session handling and logging. A one-to-many relationship is the normal shape of this mapping rather than a sign of duplication.

What do the relationship labels mean?

Each pairing carries a label describing how the two controls relate. Partially meets means the mapped control covers part of the requirement. Partially overlaps means they share ground without either containing the other. Supports means one helps achieve the other. Depends on means one relies on the other being in place. Equivalent is reserved for genuinely matching requirements and is rare.

Is this mapping official?

No. Neither ISO nor the Australian Signals Directorate publishes an official crosswalk between these two frameworks. This mapping is produced by Control Stack from the control text of both frameworks and reviewed for topic fidelity. Treat it as a working aid for planning and evidence reuse, not as an authoritative statement from either body.

ISO 27001 to ASD ISM

ISO 27001 to ASD ISM

How to use this mapping

Frequently asked questions

Control status

New task