Find controls across frameworks

Search ISO/IEC 27001, Essential Eight, and ASD ISM controls by key, title, summary or tag.

Search for controls

Press Enter to update the URL with your query. Use Escape to clear the field.

Start typing above to see matching controls from ISO/IEC 27001, the Essential Eight, and ASD ISM.

No controls matched your query. Try a different control key or keyword.

Annex A 5.1 📘 ISO/IEC 27001:2022

Policies for information security

Have clear, approved security policies that everyone knows about and follows.

ComplianceISO/IEC 27001:2022 +1

View details →

Annex A 5.10 📘 ISO/IEC 27001:2022

Acceptable Use Policies for Information and Assets

Create and communicate rules for how information and assets should be used to ensure security.

ISO/IEC 27001:2022Policy +1

View details →

Annex A 5.11 📘 ISO/IEC 27001:2022

Return of Organisation's Assets upon Departure

Ensure that employees and external parties return all company assets when their job or contract ends.

ISO/IEC 27001:2022Offboarding +1

View details →

Annex A 5.12 📘 ISO/IEC 27001:2022

Information Classification Policy and Practices

Classify data based on security needs so everyone handles it correctly.

ISO/IEC 27001:2022Information classification +1

View details →

Annex A 5.13 📘 ISO/IEC 27001:2022

Labelling of Information

Create and use clear labels to show how sensitive information is, so it is correctly handled.

ISO/IEC 27001:2022Labelling +1

View details →

Annex A 5.14 📘 ISO/IEC 27001:2022

Information Transfer Policies and Procedures

Ensure secure and controlled transfer of information within and outside the organisation.

ContractsISO/IEC 27001:2022 +1

View details →

Annex A 5.15 📘 ISO/IEC 27001:2022

Access Control Policies and Procedures

Set and apply rules for who can access information and systems based on their security needs.

ISO/IEC 27001:2022Access control +1

View details →

Annex A 5.16 📘 ISO/IEC 27001:2022

Identity life cycle management

Ensure all user and system identities are managed from creation to deactivation.

Identity & access managementISO/IEC 27001:2022 +1

View details →

Annex A 5.17 📘 ISO/IEC 27001:2022

Management of Authentication Information

Ensure secure and proper handling of passwords and authentication details.

ISO/IEC 27001:2022Authentication

View details →

Annex A 5.18 📘 ISO/IEC 27001:2022

Managing Access Rights to Information Assets

Regularly check and adjust who can access sensitive information based on business rules.

Access controlISO/IEC 27001:2022 +1

View details →

Annex A 5.19 📘 ISO/IEC 27001:2022

Managing Information Security in Supplier Relationships

Ensure suppliers of products/services do not pose security risks through defined processes.

ContractsISO/IEC 27001:2022 +1

View details →

Annex A 5.2 📘 ISO/IEC 27001:2022

Defining Information Security Roles and Responsibilities

Clearly assign security roles and duties to ensure nothing is overlooked.

ISO/IEC 27001:2022Roles and responsibilities +1

View details →

Annex A 5.20 📘 ISO/IEC 27001:2022

Integrating security clauses in supplier agreements

Ensure suppliers meet agreed security requirements relevant to their relationship.

ContractsSupplier management +1

View details →

Annex A 5.21 📘 ISO/IEC 27001:2022

Managing Information Security in the ICT Supply Chain

Ensure ICT supply chain security by managing risks with processes and procedures.

ISO/IEC 27001:2022ICT supply chain +1

View details →

Annex A 5.22 📘 ISO/IEC 27001:2022

Monitoring and Managing Supplier Services

Keep track of and adapt to changes in how suppliers handle security and service delivery.

ISO/IEC 27001:2022Supplier management +1

View details →

Annex A 5.23 📘 ISO/IEC 27001:2022

Using incidents to improve security controls

Learn from security incidents to prevent future issues by improving controls.

ISO/IEC 27001:2022Management responsibility +1

View details →

Annex A 5.24 📘 ISO/IEC 27001:2022

Information security incident management planning and preparation

Ensure your organisation is ready to manage security incidents with clear processes and responsible roles.

ISO/IEC 27001:2022Incident management +1

View details →

Annex A 5.25 📘 ISO/IEC 27001:2022

Assessment and decision on information security events

Evaluate security events to determine which are serious enough to be called incidents.

Incident managementISO/IEC 27001:2022

View details →

Annex A 5.26 📘 ISO/IEC 27001:2022

Response to Information Security Incidents

Ensure security incidents are handled quickly and effectively following set procedures.

ISO/IEC 27001:2022Incident management

View details →

Annex A 5.27 📘 ISO/IEC 27001:2022

Learning from information security incidents

Use knowledge from past incidents to boost security and prevent future issues.

ISO/IEC 27001:2022Incident management

View details →

Annex A 5.28 📘 ISO/IEC 27001:2022

Procedures for Collecting and Preserving Evidence

Set up clear steps to gather and maintain evidence of security incidents securely.

ComplianceLogging and monitoring +1

View details →

Annex A 5.29 📘 ISO/IEC 27001:2022

Maintain information security during disruptions

Plan to keep information secure even when normal operations are interrupted.

ISO/IEC 27001:2022Business continuity

View details →

Annex A 5.3 📘 ISO/IEC 27001:2022

Segregation of Duties

Ensure no one person can perform conflicting duties alone to prevent misuse.

ISO/IEC 27001:2022Segregation of duties +1

View details →

Annex A 5.30 📘 ISO/IEC 27001:2022

ICT Readiness for Business Continuity

Ensure ICT systems are ready to support business goals during disruptions through proper planning and testing.

ISO/IEC 27001:2022Business continuity

View details →

Annex A 5.31 📘 ISO/IEC 27001:2022

Compliance with Information Security Legal Requirements

Identify and stay updated on information security legal obligations to avoid breaches.

ComplianceISO/IEC 27001:2022 +1

View details →

Annex A 5.32 📘 ISO/IEC 27001:2022

Intellectual Property Rights Protection

Develop procedures to safeguard intellectual property rights to avoid legal issues.

ComplianceISO/IEC 27001:2022 +1

View details →

Annex A 5.33 📘 ISO/IEC 27001:2022

Protection of Records

Ensure records are safe from loss, damage, falsification, and unauthorised access.

ISO/IEC 27001:2022Records management

View details →

Annex A 5.34 📘 ISO/IEC 27001:2022

Privacy and Protection of Personally Identifiable Information

Ensure privacy and PII protection according to laws and contracts.

ISO/IEC 27001:2022Privacy +1

View details →

Annex A 5.35 📘 ISO/IEC 27001:2022

Independent review of information security

Ensure independent reviews of information security management at regular intervals or after significant changes.

ISO/IEC 27001:2022Independent review +1

View details →

Annex A 5.36 📘 ISO/IEC 27001:2022

Review compliance with information security policies

Regularly check if your organisation's security policies and rules are being followed.

ComplianceISO/IEC 27001:2022 +1

View details →

Annex A 5.37 📘 ISO/IEC 27001:2022

Documented Operating Procedures for Information Processing

Ensure procedures are written down and accessible to those who need them.

ComplianceISO/IEC 27001:2022 +1

View details →

Annex A 5.4 📘 ISO/IEC 27001:2022

Management responsibilities for information security

Managers must ensure everyone follows and supports the organisation's security policies.

ISO/IEC 27001:2022Policy, rules and standards compliance +1

View details →

Annex A 5.5 📘 ISO/IEC 27001:2022

Establish and Maintain Contact with Authorities

Ensure you can quickly contact authorities like police or regulators for security issues.

Incident managementISO/IEC 27001:2022 +1

View details →

Annex A 5.6 📘 ISO/IEC 27001:2022

Contact with special interest groups

Maintain ties with security groups to stay updated on threats and best practices.

ISO/IEC 27001:2022Information sharing +1

View details →

Annex A 5.7 📘 ISO/IEC 27001:2022

Threat Intelligence Collection and Analysis

Gather and study threat information to improve your security measures and readiness.

Logging and monitoringISO/IEC 27001:2022 +1

View details →

Annex A 5.8 📘 ISO/IEC 27001:2022

Information security in project management

Include security checks in all projects to prevent risks from new systems.

ComplianceISO/IEC 27001:2022 +1

View details →

Annex A 5.9 📘 ISO/IEC 27001:2022

Inventory management of information and associated assets

Keep an updated list of information and assets, specifying who owns and manages each.

ISO/IEC 27001:2022Asset inventory +1

View details →

Annex A 6.1 📘 ISO/IEC 27001:2022

Personnel Background Verification

Conduct background checks on all job candidates before hiring to manage risks.

ISO/IEC 27001:2022HR security +1

View details →

Annex A 6.2 📘 ISO/IEC 27001:2022

Terms and conditions of employment for security

Ensure job agreements state everyone's info security duties clearly.

ContractsISO/IEC 27001:2022 +1

View details →

Annex A 6.3 📘 ISO/IEC 27001:2022

Information security awareness, education and training programme

Ensure everyone gets regular training and updates on information security relevant to their job.

ISO/IEC 27001:2022Awareness and training +1

View details →

Annex A 6.4 📘 ISO/IEC 27001:2022

Disciplinary Process for Information Security Violations

Ensure staff understand consequences for breaking security rules to prevent violations.

ISO/IEC 27001:2022Policy, rules and standards compliance +1

View details →

Annex A 6.5 📘 ISO/IEC 27001:2022

Responsibilities after employment termination or role change

Ensure security responsibilities are clear when employment ends or roles change.

ISO/IEC 27001:2022Roles and responsibilities +1

View details →

Annex A 6.6 📘 ISO/IEC 27001:2022

Confidentiality and Non-disclosure Agreements

Ensure all relevant parties sign agreements to protect confidential information.

ISO/IEC 27001:2022Confidentiality agreements +1

View details →

Annex A 6.7 📘 ISO/IEC 27001:2022

Remote Working Security Measures

Implement security measures to protect company info when working outside the office.

ISO/IEC 27001:2022Access control

View details →

Annex A 6.8 📘 ISO/IEC 27001:2022

Mechanisms for Reporting Security Events

Ensure staff can quickly report security problems through official channels to prevent bigger issues.

Incident managementISO/IEC 27001:2022 +1

View details →

Annex A 7.1 📘 ISO/IEC 27001:2022

Physical Security Perimeters

Define clear physical boundaries to protect sensitive areas and assets from unauthorized access.

Physical securityISO/IEC 27001:2022 +1

View details →

Annex A 7.10 📘 ISO/IEC 27001:2022

Secure Management of Storage Media

Manage storage media safely from purchase to disposal based on your risk policies.

ISO/IEC 27001:2022Storage media +1

View details →

Annex A 7.11 📘 ISO/IEC 27001:2022

Protection from Utility Failures

Make sure key equipment is safe from power and utility failures to avoid data loss.

Business continuityISO/IEC 27001:2022 +1

View details →

Annex A 7.12 📘 ISO/IEC 27001:2022

Secure Cabling for Power and Data

Ensure cables are protected from interception, damage, or interference to prevent security risks.

ISO/IEC 27001:2022Cabling security

View details →

Annex A 7.13 📘 ISO/IEC 27001:2022

Proper Maintenance of Equipment

Ensure all equipment is regularly maintained to prevent failures and protect data.

ISO/IEC 27001:2022Equipment maintenance +1

View details →

Annex A 7.14 📘 ISO/IEC 27001:2022

Secure disposal or re-use of equipment

Ensure device data is erased or secured before disposal or reuse to prevent data breaches.

ISO/IEC 27001:2022Data loss prevention +1

View details →

Annex A 7.2 📘 ISO/IEC 27001:2022

Physical access controls for secure areas

Ensure only authorised people can enter secure areas and prevent unauthorised access.

Physical securityISO/IEC 27001:2022 +1

View details →

Annex A 7.3 📘 ISO/IEC 27001:2022

Physical Security for Offices and Facilities

Ensure physical security to prevent unauthorized access to offices and facilities.

Physical securityISO/IEC 27001:2022 +1

View details →

Annex A 7.4 📘 ISO/IEC 27001:2022

Continuous monitoring of physical access to premises

Use systems like CCTV and alarms to detect unauthorized physical entry.

Physical securityISO/IEC 27001:2022 +1

View details →

Annex A 7.5 📘 ISO/IEC 27001:2022

Protecting against physical and environmental threats

Plan and implement actions to prevent damage from natural and human threats to physical infrastructure.

Physical securityISO/IEC 27001:2022 +1

View details →

Annex A 7.6 📘 ISO/IEC 27001:2022

Security Measures for Working in Secure Areas

Implement security measures to control and protect activities in secure areas.

ISO/IEC 27001:2022Secure areas

View details →

Annex A 7.7 📘 ISO/IEC 27001:2022

Clear desk and clear screen policies

Ensure desks and screens are clear of sensitive info to prevent unauthorized access.

Clear desk and screenISO/IEC 27001:2022 +1

View details →

Annex A 7.8 📘 ISO/IEC 27001:2022

Equipment Siting and Protection

Ensure equipment is placed safely to prevent damage or unauthorised access.

Physical securityISO/IEC 27001:2022 +1

View details →

Annex A 7.9 📘 ISO/IEC 27001:2022

Security of Off-Site Assets

Ensure assets used outside the office are protected from theft or loss.

ISO/IEC 27001:2022Asset management +1

View details →

Annex A 8.1 📘 ISO/IEC 27001:2022

Protection of User Endpoint Devices

Ensure all laptops, mobiles, and tablets are secure to protect stored information.

ISO/IEC 27001:2022Endpoints +1

View details →

Annex A 8.10 📘 ISO/IEC 27001:2022

Secure deletion of information when no longer needed

Delete data you don't need anymore to reduce risk and comply with laws.

ComplianceData governance +1

View details →

Annex A 8.11 📘 ISO/IEC 27001:2022

Data Masking for Sensitive Information

Use data masking to hide sensitive info based on policy requirements and legal obligations.

ComplianceData governance +1

View details →

Annex A 8.12 📘 ISO/IEC 27001:2022

Data Leakage Prevention Measures

Implement measures to stop sensitive data from being leaked or stolen from your systems.

ISO/IEC 27001:2022Data loss prevention +1

View details →

Annex A 8.13 📘 ISO/IEC 27001:2022

Backup and Recovery Procedures for Data

Keep and test backups of data and systems regularly as per backup policy.

ISO/IEC 27001:2022Backups +1

View details →

Annex A 8.14 📘 ISO/IEC 27001:2022

Clock Synchronisation for Information Processing Systems

Make sure all system clocks are set to match authorised time sources to help track and analyse events.

ISO/IEC 27001:2022Time synchronisation

View details →

Annex A 8.15 📘 ISO/IEC 27001:2022

Logging of Activities and Events

Keep detailed logs of activities and events to detect attacks and ensure accountability.

Logging and monitoringISO/IEC 27001:2022 +1

View details →

Annex A 8.16 📘 ISO/IEC 27001:2022

Monitoring Networks and Systems for Anomalous Behaviour

Regularly check networks and systems for unusual activity to address potential security threats.

Logging and monitoringIncident management +1

View details →

Annex A 8.17 📘 ISO/IEC 27001:2022

Clock synchronization for information systems

Ensure all system clocks are set to the same time source to aid in event tracking and investigations.

ISO/IEC 27001:2022Time synchronisation +1

View details →

Annex A 8.18 📘 ISO/IEC 27001:2022

Securing Software Installations on Operational Systems

Control who can install software to prevent security risks and system inconsistencies.

ISO/IEC 27001:2022Software installation

View details →

Annex A 8.19 📘 ISO/IEC 27001:2022

Secure Software Installation Procedures

Ensure software installations are controlled to prevent security risks.

ISO/IEC 27001:2022Software installation +1

View details →

Annex A 8.2 📘 ISO/IEC 27001:2022

Management of Privileged Access Rights

Control and limit who gets special access to sensitive systems to keep them secure.

ISO/IEC 27001:2022Privileged access +1

View details →

Annex A 8.20 📘 ISO/IEC 27001:2022

Network and Network Devices Security

Secure and manage networks to prevent unauthorized access to your information.

Logging and monitoringISO/IEC 27001:2022 +1

View details →

Annex A 8.21 📘 ISO/IEC 27001:2022

Security of Network Services

Ensure network services are secure, reliable, and meet agreed-upon standards.

Supplier managementISO/IEC 27001:2022

View details →

Annex A 8.22 📘 ISO/IEC 27001:2022

Network Segregation for Security

Separate network groups to limit risks and control access between services, users, and systems.

ISO/IEC 27001:2022Network segmentation +1

View details →

Annex A 8.23 📘 ISO/IEC 27001:2022

Web Filtering to Reduce Malicious Website Exposure

Limit access to risky websites to avoid malware and phishing threats.

ISO/IEC 27001:2022Web filtering +1

View details →

Annex A 8.24 📘 ISO/IEC 27001:2022

Effective Use of Cryptography and Key Management

Create and enforce rules for using cryptography and managing keys effectively.

ISO/IEC 27001:2022Cryptography +1

View details →

Annex A 8.25 📘 ISO/IEC 27001:2022

Secure Development Lifecycle

Set rules for secure software and system development to avoid costly production issues.

ISO/IEC 27001:2022Secure SDLC +1

View details →

Annex A 8.26 📘 ISO/IEC 27001:2022

Defining Security Requirements for Applications

Ensure security needs are clear and approved when creating or buying applications.

ISO/IEC 27001:2022Application security +1

View details →

Annex A 8.27 📘 ISO/IEC 27001:2022

Secure system architecture and engineering principles

Create and use guidelines for building secure systems in all development projects.

ISO/IEC 27001:2022Secure by design +1

View details →

Annex A 8.28 📘 ISO/IEC 27001:2022

Secure Coding Practices in Software Development

Ensure software is built securely to prevent vulnerabilities.

ISO/IEC 27001:2022Secure coding +1

View details →

Annex A 8.29 📘 ISO/IEC 27001:2022

Security testing in development and acceptance

Ensure security tests are part of the development process to find issues early.

ISO/IEC 27001:2022Secure SDLC +1

View details →

Annex A 8.3 📘 ISO/IEC 27001:2022

Restrict access to information and assets

Limit access to information based on set policies to prevent unauthorised use.

ISO/IEC 27001:2022Access control

View details →

Annex A 8.30 📘 ISO/IEC 27001:2022

Management of Outsourced System Development

Ensure your organisation oversees and checks outsourced development to maintain security.

Secure SDLCContracts +1

View details →

Annex A 8.31 📘 ISO/IEC 27001:2022

Separation of Development, Test, and Production Environments

Ensure development, testing, and production systems are separate to avoid disrupting live services.

ISO/IEC 27001:2022Environment separation +1

View details →

Annex A 8.32 📘 ISO/IEC 27001:2022

Change management procedures for information systems

Ensure all system changes follow a formal, approved process to prevent issues.

ISO/IEC 27001:2022Change management +1

View details →

Annex A 8.33 📘 ISO/IEC 27001:2022

Test Information Selection and Protection

Choose and protect test data carefully to avoid exposing sensitive information.

Data governanceISO/IEC 27001:2022 +1

View details →

Annex A 8.34 📘 ISO/IEC 27001:2022

Protection of information systems during audits

Ensure audit activities are planned and agreed with management to prevent system disruptions.

AuditISO/IEC 27001:2022 +1

View details →

Annex A 8.4 📘 ISO/IEC 27001:2022

Access management for source code and tools

Control who can read and change source code to avoid risks and maintain security.

Secure codingISO/IEC 27001:2022 +1

View details →

Annex A 8.5 📘 ISO/IEC 27001:2022

Secure authentication technologies and procedures

Use secure methods to confirm identities and control access to systems and data.

ISO/IEC 27001:2022Authentication +1

View details →

Annex A 8.6 📘 ISO/IEC 27001:2022

Capacity Management for Resource Use

Ensure resources are monitored and adjusted to meet current and future needs to prevent system slowdowns or failures.

ISO/IEC 27001:2022Capacity management +1

View details →

Annex A 8.7 📘 ISO/IEC 27001:2022

Protection against malware

Implement measures and train users to prevent and detect malware threats.

ISO/IEC 27001:2022Malware protection +1

View details →

Annex A 8.8 📘 ISO/IEC 27001:2022

Configuration management for security

Ensure secure setup and maintenance of IT systems to avoid security risks.

ISO/IEC 27001:2022Configuration management +1

View details →

Annex A 8.9 📘 ISO/IEC 27001:2022

Configuration Management of IT Systems

Ensure IT systems have consistent, secure setups documented and maintained.

ISO/IEC 27001:2022Configuration management +1

View details →

E8-AC-ML1.1 🧭 ASD Essential Eight

Application control is implemented on workstations.

Make sure only approved software can run on office computers.

ML1 Essential EightE8 Application Control +1

View details →

E8-AC-ML1.2 🧭 ASD Essential Eight

Application control is applied to user profiles and temporary folders

Ensure application control covers user and temporary folders to block unapproved software.

ML1 Essential EightApplication security +1

View details →

E8-AC-ML1.3 🧭 ASD Essential Eight

Ensure only approved applications and scripts can run

Allow only company-approved applications and scripts to run on work computers.

ML1 Essential EightE8 Application Control +1

View details →

E8-AC-ML2.1 🧭 ASD Essential Eight

Application control is implemented on internet-facing servers

Ensure only approved applications can run on servers accessible from the internet.

ML2 Essential EightE8 Application Control +1

View details →

E8-AC-ML2.10 🧭 ASD Essential Eight

Report cyber security incidents to ASD quickly

Notify ASD promptly when cyber security incidents occur or are discovered.

ML2 Incident managementEssential Eight +1

View details →

E8-AC-ML2.11 🧭 ASD Essential Eight

Cybersecurity incident response plan is enacted after incident identification

Activate the cybersecurity response plan as soon as an incident is identified.

ML2 Essential EightE8 Application Control +1

View details →

E8-AC-ML2.2 🧭 ASD Essential Eight

Application control excludes user profiles and temporary folders

Ensure application control is in place everywhere except user profiles and temp folders.

ML2 Essential EightE8 Application Control +1

View details →

E8-AC-ML2.3 🧭 ASD Essential Eight

Microsoft’s recommended application blocklist is implemented

Implement Microsoft's recommended blocklist to enhance security.

ML2 Essential EightE8 Application Control +1

View details →

E8-AC-ML2.4 🧭 ASD Essential Eight

Annual validation of application control rulesets

Check once a year or more that rules for allowing or blocking software are accurate.

ML2 Essential EightE8 Application Control +1

View details →

E8-AC-ML2.5 🧭 ASD Essential Eight

Allowed and blocked application control events are centrally logged

Ensure all application control events are logged in a central location for monitoring.

ML2 Logging and monitoringEssential Eight +1

View details →

E8-AC-ML2.6 🧭 ASD Essential Eight

Event logs are protected from unauthorised modification and deletion

Ensure that event logs are secure from being changed or deleted by unauthorized users.

ML2 Logging and monitoringEssential Eight +1

View details →

E8-AC-ML2.7 🧭 ASD Essential Eight

Event logs from internet-facing servers are analysed to detect cybersecurity events

Review logs from internet servers quickly to spot any security issues.

ML2 AuditLogging and monitoring +1

View details →

E8-AC-ML2.8 🧭 ASD Essential Eight

Cybersecurity events are analysed in a timely manner

Timely analysis of events to spot and manage security incidents.

ML2 Logging and monitoringEssential Eight +1

View details →

E8-AC-ML2.9 🧭 ASD Essential Eight

Cyber security incidents are reported promptly to CISO

Report security incidents quickly to the security chief or their team.

ML2 Essential EightE8 Application Control +1

View details →

E8-AC-ML3.1 🧭 ASD Essential Eight

Application control is implemented on non-internet-facing servers

Ensure only approved software can run on internal servers.

ML3 Essential EightE8 Application Control +1

View details →

E8-AC-ML3.2 🧭 ASD Essential Eight

Application control restricts driver execution to an approved set

Ensure only approved drivers can run to prevent malicious code execution.

ML3 Essential EightE8 Application Control +1

View details →

E8-AC-ML3.3 🧭 ASD Essential Eight

Microsoft’s vulnerable driver blocklist is implemented

Use Microsoft's blocklist to stop vulnerable drivers from running.

ML3 Vulnerability managementEssential Eight +1

View details →

E8-AC-ML3.4 🧭 ASD Essential Eight

Event logs from non-internet-facing servers are analysed

Check server logs regularly to find security issues early.

ML3 Logging and monitoringIncident management +1

View details →

E8-AC-ML3.5 🧭 ASD Essential Eight

Workstation event logs are promptly analysed for security events

Quickly check workstation logs to find any security events.

ML3 Logging and monitoringEssential Eight +1

View details →

E8-AH-ML1.1 🧭 ASD Essential Eight

Disable or remove Internet Explorer 11

Ensure Internet Explorer 11 is not used to increase security.

ML1 Essential EightE8 User Application Hardening +1

View details →

E8-AH-ML1.2 🧭 ASD Essential Eight

Web browsers must not execute Java content from the internet

Ensure web browsers block Java content from the internet to reduce security risks.

ML1 Essential EightE8 User Application Hardening +1

View details →

E8-AH-ML1.3 🧭 ASD Essential Eight

Web browsers block web ads from the internet

Ensure web browsers do not display internet ads to prevent potential security risks.

ML1 Essential EightE8 User Application Hardening +1

View details →

E8-AH-ML1.4 🧭 ASD Essential Eight

Web browser security settings locked down to users

Users should not be able to change web browser security settings.

ML1 Essential EightE8 User Application Hardening +1

View details →

E8-AH-ML2.1 🧭 ASD Essential Eight

Web browsers are hardened with the most restrictive guidance

Harden web browsers using the strictest security settings from ASD or vendor guides.

ML2 Essential EightE8 User Application Hardening +1

View details →

E8-AH-ML2.10 🧭 ASD Essential Eight

PDF software security settings cannot be changed by users

Prevent users from changing PDF software security settings to enhance safety.

ML2 Essential EightE8 User Application Hardening +1

View details →

E8-AH-ML2.11 🧭 ASD Essential Eight

Centrally log PowerShell module, script block, and transcription events

Ensure logging of PowerShell activities is centralized for monitoring.

ML2 Logging and monitoringEssential Eight +1

View details →

E8-AH-ML2.12 🧭 ASD Essential Eight

Command line process creation logging is centralized

Log all command line processes in a central location for monitoring.

ML2 Logging and monitoringEssential Eight +1

View details →

E8-AH-ML2.13 🧭 ASD Essential Eight

Protect event logs from unauthorized changes or deletion

Ensure event logs cannot be tampered with or erased without permission.

ML2 Logging and monitoringEssential Eight +1

View details →

E8-AH-ML2.14 🧭 ASD Essential Eight

Timely Analysis of Event Logs from Internet-Facing Servers

Regularly review event logs from internet-facing servers to spot security issues quickly.

ML2 Logging and monitoringEssential Eight +1

View details →

E8-AH-ML2.15 🧭 ASD Essential Eight

Timely Analysis of Cyber Security Events to Identify Incidents

Quickly review cyber events to find and manage security threats.

ML2 Logging and monitoringIncident management +1

View details →

E8-AH-ML2.16 🧭 ASD Essential Eight

Cybersecurity incidents must be reported immediately to the CISO

Report any cybersecurity incidents to the Chief Information Security Officer as soon as they happen.

ML2 Essential EightE8 User Application Hardening +1

View details →

E8-AH-ML2.17 🧭 ASD Essential Eight

Report cyber security incidents to ASD promptly

Report cyber security incidents to ASD as soon as they're found.

ML2 Incident managementEssential Eight +1

View details →

E8-AH-ML2.18 🧭 ASD Essential Eight

Cyber incident response plan is enacted after identification

Activate the response plan immediately after identifying a cyber incident.

ML2 Essential EightE8 User Application Hardening +1

View details →

E8-AH-ML2.2 🧭 ASD Essential Eight

Block Microsoft Office from creating child processes

Prevent Microsoft Office from starting other programs or activities on its own.

ML2 Essential EightE8 User Application Hardening +1

View details →

E8-AH-ML2.3 🧭 ASD Essential Eight

Block Microsoft Office from creating executable content

Prevent Microsoft Office from making executable files to stop malware.

ML2 Essential EightE8 User Application Hardening +1

View details →

E8-AH-ML2.4 🧭 ASD Essential Eight

Block Microsoft Office from injecting code into other processes

Stop Microsoft Office from putting code into other programs to prevent security risks.

ML2 Essential EightE8 User Application Hardening +1

View details →

E8-AH-ML2.5 🧭 ASD Essential Eight

Configure Microsoft Office to prevent activation of OLE packages

Ensure Microsoft Office is set up to stop risky linking and embedding features.

ML2 Essential EightE8 User Application Hardening +1

View details →

E8-AH-ML2.6 🧭 ASD Essential Eight

Office productivity suites are hardened using ASD and vendor guidance

Ensure office suites follow the strictest security guidelines to reduce risks.

ML2 Essential EightE8 User Application Hardening +1

View details →

E8-AH-ML2.7 🧭 ASD Essential Eight

Office productivity suite settings are immutable by users

Ensure users cannot change security settings in office applications.

ML2 Essential EightE8 User Application Hardening +1

View details →

E8-AH-ML2.8 🧭 ASD Essential Eight

Block PDF software from creating child processes

Prevent PDF programs from running other programs to improve security.

ML2 Essential EightE8 User Application Hardening +1

View details →

E8-AH-ML2.9 🧭 ASD Essential Eight

Ensure PDF software is securely configured using guidance.

Secure PDF applications based on guidance to protect against hacks.

ML2 Essential EightE8 User Application Hardening +1

View details →

E8-AH-ML3.1 🧭 ASD Essential Eight

.NET Framework 3.5, 3.0, 2.0 is disabled or removed

Ensure older versions of .NET Framework (3.5, 3.0, 2.0) are turned off or uninstalled.

ML3 Essential EightE8 User Application Hardening +1

View details →

E8-AH-ML3.2 🧭 ASD Essential Eight

Ensure Windows PowerShell 2.0 is disabled or removed

Disable or remove Windows PowerShell 2.0 to enhance security.

ML3 Essential EightE8 User Application Hardening +1

View details →

E8-AH-ML3.3 🧭 ASD Essential Eight

PowerShell is configured to use Constrained Language Mode

Limit PowerShell's capabilities to reduce security risks.

ML3 Essential EightE8 User Application Hardening +1

View details →

E8-AH-ML3.4 🧭 ASD Essential Eight

Analyze event logs from non-internet-facing servers for cyber threats

Regularly check server logs not exposed to the internet for signs of hacking.

ML3 Logging and monitoringEssential Eight +1

View details →

E8-AH-ML3.5 🧭 ASD Essential Eight

Timely Analysis of Workstation Event Logs for Cybersecurity

Quickly analyze workstation logs to detect security issues.

ML3 Logging and monitoringIncident management +1

View details →

E8-MF-ML1.1 🧭 ASD Essential Eight

Require multi-factor authentication for sensitive online services

Ensure users use multiple ways to verify their identity when accessing sensitive company data online.

ML1 Essential EightE8 Multi-factor Authentication +1

View details →

E8-MF-ML1.2 🧭 ASD Essential Eight

Multi-factor authentication for third-party services handling sensitive data

Use multi-factor authentication for third-party services with sensitive data to prevent unauthorized access.

ML1 Essential EightMaturity Level 1 +1

View details →

E8-MF-ML1.3 🧭 ASD Essential Eight

Use multi-factor authentication for non-sensitive third-party services

Use a second form of verification for accounts on services handling non-sensitive org data.

ML1 Essential EightE8 Multi-factor Authentication +1

View details →

E8-MF-ML1.4 🧭 ASD Essential Eight

Use multi-factor authentication for online services handling customer data

Ensure users use multi-factor logins for online services with sensitive customer data.

ML1 Essential EightE8 Multi-factor Authentication +1

View details →

E8-MF-ML1.5 🧭 ASD Essential Eight

Multi-factor authentication for third-party services with sensitive customer data

Use multi-factor authentication to secure accounts on third-party services that handle your sensitive customer data.

ML1 Essential EightE8 Multi-factor Authentication +1

View details →

E8-MF-ML1.6 🧭 ASD Essential Eight

Multi-factor authentication for customer access to online services handling sensitive data

Require multiple forms of ID for customer logins to protect sensitive online data.

ML1 Essential EightE8 Multi-factor Authentication +1

View details →

E8-MF-ML1.7 🧭 ASD Essential Eight

Multi-factor authentication combines two factors like a device and a PIN

Use something you have and something you know to secure access to important data.

ML1 Essential EightE8 Multi-factor Authentication +1

View details →

E8-MF-ML2.1 🧭 ASD Essential Eight

Multi-factor authentication for privileged users of systems

Ensure privileged users use more than just a password to access systems.

ML2 Essential EightE8 Multi-factor Authentication +1

View details →

E8-MF-ML2.10 🧭 ASD Essential Eight

Report cyber security incidents to the Chief Information Security Officer promptly

Notify the Chief Information Security Officer quickly after discovering cyber attacks.

ML2 Essential EightE8 Multi-factor Authentication +1

View details →

E8-MF-ML2.11 🧭 ASD Essential Eight

Report cybersecurity incidents to ASD immediately

Notify ASD quickly when a cybersecurity incident occurs or is discovered.

ML2 Incident managementEssential Eight +1

View details →

E8-MF-ML2.12 🧭 ASD Essential Eight

Cybersecurity incident response plan enacted after incident identification

Activate the response plan immediately once a cyber incident is detected.

ML2 Incident managementBusiness continuity +1

View details →

E8-MF-ML2.2 🧭 ASD Essential Eight

Use multi-factor authentication for unprivileged user access

Require additional authentication methods for regular system users.

ML2 Essential EightAuthentication +1

View details →

E8-MF-ML2.3 🧭 ASD Essential Eight

Multi-factor authentication online services must be phishing-resistant

Ensure two-factor authentication can't be bypassed by phishing attacks.

ML2 Essential EightE8 Multi-factor Authentication +1

View details →

E8-MF-ML2.5 🧭 ASD Essential Eight

Multi-factor authentication used for system access is phishing-resistant

Ensure system login methods resist phishing attacks using multiple authentication factors.

ML2 Essential EightE8 Multi-factor Authentication +1

View details →

E8-MF-ML2.6 🧭 ASD Essential Eight

MFA success and failure events are centrally logged

Ensure all successful and failed MFA attempts are logged in one central location.

ML2 Logging and monitoringEssential Eight +1

View details →

E8-MF-ML2.7 🧭 ASD Essential Eight

Protect event logs from unauthorized changes

Ensure event logs cannot be changed or deleted without permission.

ML2 Logging and monitoringEssential Eight +1

View details →

E8-MF-ML2.8 🧭 ASD Essential Eight

Timely analysis of event logs from internet-facing servers

Regularly check logs from online servers to quickly spot security issues.

ML2 Logging and monitoringIncident management +1

View details →

E8-MF-ML2.9 🧭 ASD Essential Eight

Cybersecurity events are analyzed to identify incidents timely

Timely analyze cybersecurity events to identify incidents quickly.

ML2 Logging and monitoringEssential Eight +1

View details →

E8-MF-ML3.1 🧭 ASD Essential Eight

Multi-factor authentication is used to authenticate users of data repositories

Use multiple verification methods to authorize access to data storage systems.

ML3 Essential EightE8 Multi-factor Authentication +1

View details →

E8-MF-ML3.2 🧭 ASD Essential Eight

Phishing-resistant multi-factor authentication for online customer services

Use multi-factor authentication that resists phishing for customers accessing online services.

ML3 Essential EightE8 Multi-factor Authentication +1

View details →

E8-MF-ML3.3 🧭 ASD Essential Eight

Phishing-resistant multi-factor authentication for data repositories

Use secure multi-factor authentication methods to protect data repositories against phishing attacks.

ML3 Essential EightE8 Multi-factor Authentication +1

View details →

E8-MF-ML3.4 🧭 ASD Essential Eight

Analyse event logs from non-internet-facing servers timely to detect security events

Regularly check event logs from internal servers to catch security issues quickly.

ML3 Logging and monitoringEssential Eight +1

View details →

E8-MF-ML3.5 🧭 ASD Essential Eight

Timely analysis of workstation event logs for cybersecurity events

Ensure workstation event logs are reviewed quickly to spot cybersecurity issues.

ML3 Logging and monitoringEssential Eight +1

View details →

E8-PA-ML1.1 🧭 ASD Essential Eight

Automated asset discovery at least fortnightly

Use automated tools every two weeks to find all devices for security checks.

ML1 Essential EightE8 Patch Applications +1

View details →

E8-PA-ML1.2 🧭 ASD Essential Eight

Up-to-date vulnerability scanner used for scanning activities

Use a current vulnerability scanner to check for security issues in your apps.

ML1 Essential EightVulnerability management +1

View details →

E8-PA-ML1.3 🧭 ASD Essential Eight

Daily vulnerability scanning for missing patches in online services

Use a daily scanner to find missing security updates for online services.

ML1 Essential EightE8 Patch Applications +1

View details →

E8-PA-ML1.4 🧭 ASD Essential Eight

Weekly scanning for missing patches or updates in key software

Use a tool every week to check and update key software like browsers and office apps to fix security issues.

ML1 AuditEssential Eight +1

View details →

E8-PA-ML1.5 🧭 ASD Essential Eight

Apply critical application patches within 48 hours

Ensure critical software updates are installed within 48 hours to prevent security risks.

ML1 Essential EightE8 Patch Applications +1

View details →

E8-PA-ML1.6 🧭 ASD Essential Eight

Apply non-critical patches for online services within two weeks

Install updates for online services within two weeks if not critical and no exploits exist.

ML1 Essential EightE8 Patch Applications +1

View details →

E8-PA-ML1.8 🧭 ASD Essential Eight

Unsupported online services are removed by the organization

Remove online services that the vendor no longer supports to enhance security.

ML1 Essential EightE8 Patch Applications +1

View details →

E8-PA-ML1.9 🧭 ASD Essential Eight

Removal of unsupported software and applications

Remove office, browser, and security software that is no longer supported by the vendor.

ML1 Essential EightE8 Patch Applications +1

View details →

E8-PA-ML2.1 🧭 ASD Essential Eight

Fortnightly vulnerability scanning for non-core applications

Use a vulnerability scanner every two weeks to find missing patches in non-core applications.

ML2 Essential EightE8 Patch Applications +1

View details →

E8-PA-ML2.2 🧭 ASD Essential Eight

Timely Patching of Non-Critical Application Vulnerabilities

Apply patches for non-critical apps within a month to fix vulnerabilities.

ML2 Essential EightE8 Patch Applications +1

View details →

E8-PA-ML3.1 🧭 ASD Essential Eight

Patch critical vulnerabilities in applications within 48 hours

Apply critical patches to important software within 48 hours of release.

ML3 Essential EightE8 Patch Applications +1

View details →

E8-PA-ML3.2 🧭 ASD Essential Eight

Apply patches for non-critical vulnerabilities within two weeks

Ensure software patches for non-critical flaws are installed within two weeks if no exploits exist.

ML3 Essential EightPatch management +1

View details →

E8-PA-ML3.3 🧭 ASD Essential Eight

Remove unsupported applications excluding certain categories

Ensure unsupported non-critical applications are removed for security.

ML3 Essential EightE8 Patch Applications +1

View details →

E8-PO-ML1.1 🧭 ASD Essential Eight

Automated bi-weekly asset discovery for vulnerability scanning

Use an automated tool to find all system assets every two weeks for security checks.

ML1 Essential EightE8 Patch Operating Systems +1

View details →

E8-PO-ML1.2 🧭 ASD Essential Eight

Use a vulnerability scanner with an updated database

Ensure a vulnerability scanner with current data is used to check for security issues.

ML1 Essential EightVulnerability management +1

View details →

E8-PO-ML1.3 🧭 ASD Essential Eight

Use a daily vulnerability scanner for internet-facing systems

Use a tool every day to find and fix missing updates on servers and network devices facing the internet.

ML1 Logging and monitoringEssential Eight +1

View details →

E8-PO-ML1.4 🧭 ASD Essential Eight

Use a vulnerability scanner fortnightly to find missing OS patches

Use a vulnerability scanner every two weeks to check for missing OS updates on internal systems.

ML1 Essential EightE8 Patch Operating Systems +1

View details →

E8-PO-ML1.5 🧭 ASD Essential Eight

Apply critical patches to internet-facing OS within 48 hours

Apply critical updates to internet-facing systems within 48 hours to prevent exploitation.

ML1 Essential EightE8 Patch Operating Systems +1

View details →

E8-PO-ML1.6 🧭 ASD Essential Eight

Timely application of non-critical patches for internet-facing OS vulnerabilities

Apply non-critical patches to internet-facing systems within two weeks if no exploits exist.

ML1 Essential EightE8 Patch Operating Systems +1

View details →

E8-PO-ML1.8 🧭 ASD Essential Eight

Replace unsupported operating systems

Ensure that all outdated and unsupported operating systems are replaced with supported versions.

ML1 Essential EightE8 Patch Operating Systems +1

View details →

E8-PO-ML3.1 🧭 ASD Essential Eight

Vulnerability scanner used fortnightly to identify missing driver patches

Use a vulnerability scanner every two weeks to find missing driver updates.

ML3 Essential EightE8 Patch Operating Systems +1

View details →

E8-PO-ML3.2 🧭 ASD Essential Eight

At least fortnightly use of a vulnerability scanner for firmware

Use a vulnerability scanner every two weeks to find and update missing firmware patches.

ML3 Essential EightE8 Patch Operating Systems +1

View details →

E8-PO-ML3.3 🧭 ASD Essential Eight

Apply critical patches to non-internet-facing OS within 48 hours

Quickly install critical updates on internal systems to fix security vulnerabilities.

ML3 Essential EightPatch management +1

View details →

E8-PO-ML3.4 🧭 ASD Essential Eight

Non-critical OS patches applied within one month if no exploits exist

Apply OS patches on internal devices within a month if they aren't critical and have no known exploits.

ML3 Essential EightE8 Patch Operating Systems +1

View details →

E8-PO-ML3.5 🧭 ASD Essential Eight

Apply critical driver patches within 48 hours

Ensure critical security updates for drivers are applied within 48 hours to prevent exploitation.

ML3 Essential EightE8 Patch Operating Systems +1

View details →

E8-PO-ML3.6 🧭 ASD Essential Eight

Apply non-critical driver patches within one month

Ensure drivers are updated within a month if the vulnerabilities are non-critical and no exploits exist.

ML3 Essential EightE8 Patch Operating Systems +1

View details →

E8-PO-ML3.7 🧭 ASD Essential Eight

Apply critical firmware patches within 48 hours

Ensure firmware vulnerabilities are fixed quickly, within 48 hours if critical.

ML3 Essential EightE8 Patch Operating Systems +1

View details →

E8-PO-ML3.8 🧭 ASD Essential Eight

Firmware vulnerabilities patched within one month if non-critical and no exploits

Apply patches for non-critical firmware vulnerabilities within a month if no exploits exist.

ML3 Essential EightE8 Patch Operating Systems +1

View details →

E8-PO-ML3.9 🧭 ASD Essential Eight

The latest or previous OS release is used

Ensure your operating system is up-to-date with the latest or previous version.

ML3 Essential EightE8 Patch Operating Systems +1

View details →

E8-RA-ML1.1 🧭 ASD Essential Eight

Validating privileged access requests upon initial request

Check and approve requests for admin access to systems and data at the start.

ML1 Essential EightE8 Restrict Admin Privileges +1

View details →

E8-RA-ML1.2 🧭 ASD Essential Eight

Dedicated privileged accounts for admin tasks

Ensure admins use special accounts only for their admin work.

ML1 Essential EightE8 Restrict Admin Privileges +1

View details →

E8-RA-ML1.3 🧭 ASD Essential Eight

Prevent privileged accounts from accessing internet, email, and web services

Block admin accounts from internet and email to enhance security.

ML1 Essential EightE8 Restrict Admin Privileges +1

View details →

E8-RA-ML1.4 🧭 ASD Essential Eight

Limit privileged accounts to essential online service access

Only allow privileged accounts the minimum access needed for online duties.

ML1 Access controlEssential Eight +1

View details →

E8-RA-ML1.5 🧭 ASD Essential Eight

Privileged users use separate privileged and unprivileged environments

Ensure privileged users have separate work environments for admin tasks and regular tasks.

ML1 Essential EightE8 Restrict Admin Privileges +1

View details →

E8-RA-ML1.6 🧭 ASD Essential Eight

Unprivileged accounts restricted from logging into privileged environments

Ensure that non-admin accounts cannot access admin-level systems.

ML1 Essential EightE8 Restrict Admin Privileges +1

View details →

E8-RA-ML1.7 🧭 ASD Essential Eight

Prevent privileged accounts from accessing unprivileged environments

Ensure privileged accounts can't be used in unsecured setups to limit risk.

ML1 Essential EightE8 Restrict Admin Privileges +1

View details →

E8-RA-ML2.1 🧭 ASD Essential Eight

Disable privileged access after 12 months without revalidation

Ensure privileged access is reviewed and renewed annually for continued access.

ML2 Essential EightE8 Restrict Admin Privileges +1

View details →

E8-RA-ML2.10 🧭 ASD Essential Eight

Timely analysis of cyber security events to identify incidents

Quickly review cyber events to spot security incidents.

ML2 Logging and monitoringEssential Eight +1

View details →

E8-RA-ML2.11 🧭 ASD Essential Eight

Report cyber incidents to the CISO promptly

Report security incidents to the security officer quickly after finding them.

ML2 Essential EightE8 Restrict Admin Privileges +1

View details →

E8-RA-ML2.12 🧭 ASD Essential Eight

Report cyber security incidents to ASD promptly

Notify ASD quickly about any cyber attacks or breaches.

ML2 Incident managementEssential Eight +1

View details →

E8-RA-ML2.13 🧭 ASD Essential Eight

Enact cyber incident response plan after an incident is identified

Start the response plan immediately after a cyber incident is detected.

ML2 Essential EightE8 Restrict Admin Privileges +1

View details →

E8-RA-ML2.2 🧭 ASD Essential Eight

Privileged access is disabled after 45 days of inactivity

Disable admin accounts if unused for 45 days to improve security.

ML2 Essential EightE8 Restrict Admin Privileges +1

View details →

E8-RA-ML2.3 🧭 ASD Essential Eight

Privileged environments are not virtualised within unprivileged environments

Ensure that secure environments are not run within less secure ones.

ML2 Essential EightE8 Restrict Admin Privileges +1

View details →

E8-RA-ML2.4 🧭 ASD Essential Eight

Conduct administrative activities through jump servers

Require admins to use secure jump servers for management tasks.

ML2 Essential EightE8 Restrict Admin Privileges +1

View details →

E8-RA-ML2.5 🧭 ASD Essential Eight

Long, unique, and managed credentials for admin accounts

Ensure admin account credentials are strong, unique, and well-managed.

ML2 Essential EightE8 Restrict Admin Privileges +1

View details →

E8-RA-ML2.6 🧭 ASD Essential Eight

Privileged access events are centrally logged.

Keep logs of admin actions in a central place to monitor for misuse.

ML2 Logging and monitoringEssential Eight +1

View details →

E8-RA-ML2.7 🧭 ASD Essential Eight

Centrally log privileged account and group management events

Ensure logs of admin account and group changes are stored in one place.

ML2 Logging and monitoringEssential Eight +1

View details →

E8-RA-ML2.8 🧭 ASD Essential Eight

Event logs are protected from unauthorised changes and losses

Ensure event logs cannot be changed or deleted without authorization.

ML2 Logging and monitoringEssential Eight +1

View details →

E8-RA-ML2.9 🧭 ASD Essential Eight

Event logs are analysed promptly for security events

Quickly check logs from servers open to the internet for security issues.

ML2 Logging and monitoringEssential Eight +1

View details →

E8-RA-ML3.1 🧭 ASD Essential Eight

Limit privileged access to what is necessary for duties

Ensure privileged access is granted only when needed to perform specific duties.

ML3 Essential EightE8 Restrict Admin Privileges +1

View details →

E8-RA-ML3.2 🧭 ASD Essential Eight

Use Secure Admin Workstations for Administrative Tasks

Conduct admin activities on secure, dedicated workstations only.

ML3 Essential EightE8 Restrict Admin Privileges +1

View details →

E8-RA-ML3.3 🧭 ASD Essential Eight

Just-in-time administration is used for administering systems and applications.

Grant high-level access only when needed and for limited times to enhance security.

ML3 Access controlEssential Eight +1

View details →

E8-RA-ML3.4 🧭 ASD Essential Eight

Memory integrity functionality is enabled

Ensure features that protect memory from exploits are enabled to prevent unauthorized code execution.

ML3 Essential EightE8 Restrict Admin Privileges +1

View details →

E8-RA-ML3.5 🧭 ASD Essential Eight

Local Security Authority protection functionality is enabled

Ensure LSA protection is on to prevent malware from stealing credentials.

ML3 Essential EightE8 Restrict Admin Privileges +1

View details →

E8-RA-ML3.6 🧭 ASD Essential Eight

Enable Credential Guard for secure credential storage

Enable Credential Guard to protect credentials from attacks by isolating them.

ML3 Essential EightE8 Restrict Admin Privileges +1

View details →

E8-RA-ML3.7 🧭 ASD Essential Eight

Enable Remote Credential Guard functionality

Prevent admin credentials from being exposed during remote logins.

ML3 Essential EightE8 Restrict Admin Privileges +1

View details →

E8-RA-ML3.8 🧭 ASD Essential Eight

Timely analysis of event logs from non-internet-facing servers

Review logs of internal servers promptly to spot security threats.

ML3 Logging and monitoringEssential Eight +1

View details →

E8-RA-ML3.9 🧭 ASD Essential Eight

Timely analysis of workstation event logs for security events

Regularly check logs on office computers to find security issues early.

ML3 Logging and monitoringEssential Eight +1

View details →

E8-RB-ML1.1 🧭 ASD Essential Eight

Backups aligned with business continuity needs

Ensure backups match business needs and help restore data after incidents.

ML1 Essential EightE8 Regular Backups +1

View details →

E8-RB-ML1.2 🧭 ASD Essential Eight

Ensure backups are synchronised for restoration to a common point in time

Ensure data, applications, and settings are backed up together to restore them to the same point in time.

ML1 Business continuityEssential Eight +1

View details →

E8-RB-ML1.3 🧭 ASD Essential Eight

Backups retained securely and resiliently

Ensure backups are kept securely and can withstand failures.

ML1 Essential EightE8 Regular Backups +1

View details →

E8-RB-ML1.4 🧭 ASD Essential Eight

Test backup restoration to a common point during disaster recovery

Ensure data and apps can be restored to a common point using backups in disaster scenarios.

ML1 AuditEssential Eight +1

View details →

E8-RB-ML1.5 🧭 ASD Essential Eight

Unprivileged accounts cannot access others' backups

Ensure that unprivileged accounts can't access other users' backups.

ML1 Essential EightE8 Regular Backups +1

View details →

E8-RB-ML1.6 🧭 ASD Essential Eight

Prevent unprivileged accounts from modifying and deleting backups

Ensure non-admin users cannot change or remove backup files.

ML1 BackupsAccess control +1

View details →

E8-RB-ML2.1 🧭 ASD Essential Eight

Prevent privileged accounts from accessing others' backups

Ensure only backup administrators can access all backup data.

ML2 Essential EightE8 Regular Backups +1

View details →

E8-RB-ML2.2 🧭 ASD Essential Eight

Privileged accounts cannot modify or delete backups.

Ensure privileged users can't change or remove backups, except backup admins.

ML2 Essential EightE8 Regular Backups +1

View details →

E8-RB-ML3.1 🧭 ASD Essential Eight

Unprivileged accounts cannot access their own backups

Ensure basic user accounts are unable to access or manage their backup data.

ML3 Essential EightE8 Regular Backups +1

View details →

E8-RB-ML3.2 🧭 ASD Essential Eight

Privileged accounts cannot access their own backups

Ensure accounts with special access cannot view their own backup data.

ML3 Essential EightE8 Regular Backups +1

View details →

E8-RB-ML3.3 🧭 ASD Essential Eight

Backup administrators cannot modify or delete backups during retention

Ensure backup admins can't change or remove backups until retention ends.

ML3 Essential EightE8 Regular Backups +1

View details →

E8-RM-ML1.1 🧭 ASD Essential Eight

Disable Microsoft Office macros for users without a business need

Ensure only users with a specific business need can run Microsoft Office macros.

ML1 Access controlEssential Eight +1

View details →

E8-RM-ML1.2 🧭 ASD Essential Eight

Block Microsoft Office macros from the internet

Prevent macros in files from the internet from being opened in Microsoft Office.

ML1 Essential EightE8 Restrict Office Macros +1

View details →

E8-RM-ML1.3 🧭 ASD Essential Eight

Enable antivirus scanning for Microsoft Office macros

Ensure antivirus scanning is active for macros in Microsoft Office documents.

ML1 Essential EightE8 Restrict Office Macros +1

View details →

E8-RM-ML1.4 🧭 ASD Essential Eight

Prevent users from changing Microsoft Office macro security settings

Ensure users cannot alter macro settings in Microsoft Office applications.

ML1 Essential EightE8 Restrict Office Macros +1

View details →

E8-RM-ML2.1 🧭 ASD Essential Eight

Microsoft Office macros are blocked from making Win32 API calls

Block Office macros from running code that interacts directly with Windows.

ML2 Essential EightE8 Restrict Office Macros +1

View details →

E8-RM-ML3.1 🧭 ASD Essential Eight

Restrict Microsoft Office macros to only trusted or sandboxed environments

Allow only macros from trusted locations, sandboxes, or signed by trusted publishers.

ML3 Essential EightE8 Restrict Office Macros +1

View details →

E8-RM-ML3.2 🧭 ASD Essential Eight

Check Microsoft Office macros for malicious code before signing or trusting

Ensure Office macros are safe from malicious code before trusting or signing.

ML3 Essential EightE8 Restrict Office Macros +1

View details →

E8-RM-ML3.3 🧭 ASD Essential Eight

Only privileged users can modify content in Trusted Locations

Ensure that only specific users can edit trusted macro locations to prevent malicious code.

ML3 Logging and monitoringEssential Eight +1

View details →

E8-RM-ML3.4 🧭 ASD Essential Eight

Untrusted Publisher Macros Cannot Be Enabled via Message Bar or Backstage View

Block untrusted Microsoft Office macros from being enabled using standard interface warnings.

ML3 Essential EightE8 Restrict Office Macros +1

View details →

E8-RM-ML3.5 🧭 ASD Essential Eight

Block enabling of non-V3 signed Microsoft Office macros via Message Bar

Prevent enabling of macros not signed with V3 signatures using standard Office UI controls.

ML3 Essential EightE8 Restrict Office Macros +1

View details →

E8-RM-ML3.6 🧭 ASD Essential Eight

Validate list of trusted publishers in Microsoft Office annually

Regularly check and confirm trusted publishers in Microsoft Office to prevent unauthorized macro use.

ML3 Essential EightE8 Restrict Office Macros +1

View details →

ISM-0009 🛡️ ASD Information Security Manual (ISM)

Identify Supplementary Controls for System Security

System owners consult officers to add extra security controls based on system specifics and organisational risk tolerance.

ASD Information Security ManualGuidelines for cyber security roles +1

View details →

ISM-0027 🛡️ ASD Information Security Manual (ISM)

Australian National Control of Sensitive Data Systems

Only Australian nationals should control systems handling specific secure government data.

ContractsASD Information Security Manual +1

View details →

ISM-0039 🛡️ ASD Information Security Manual (ISM)

Develop and Maintain a Cyber Security Strategy

Ensure there is a continuous and effective plan for safeguarding cyber activities and data.

ASD Information Security ManualGuidelines for cyber security documentation +1

View details →

ISM-0041 🛡️ ASD Information Security Manual (ISM)

Develop a Detailed System Security Plan

Create a security plan detailing system purpose, management, and additional controls.

ComplianceASD Information Security Manual +1

View details →

ISM-0042 🛡️ ASD Information Security Manual (ISM)

Maintain Effective System Administration Practices

Ensure systems are managed effectively with developed and maintained procedures.

GovernanceManagement responsibility +1

View details →

ISM-0043 🛡️ ASD Information Security Manual (ISM)

Develop Cyber Security Incident Response Plans

Systems must have a plan for handling and reporting cyber security incidents to ensure quick and effective responses.

ASD Information Security ManualGovernance +1

View details →

ISM-0047 🛡️ ASD Information Security Manual (ISM)

Approval Process for Cyber Security Documentation

Cyber security documents need approval from the chief security officer or system officer based on their scope.

ASD Information Security ManualGuidelines for cyber security documentation +1

View details →

ISM-0072 🛡️ ASD Information Security Manual (ISM)

Ensure Security in Contracts with Service Providers

Service contracts must include security measures for data protection and be regularly reviewed to ensure they're effective.

ContractsASD Information Security Manual +1

View details →

ISM-0078 🛡️ ASD Information Security Manual (ISM)

Australian Supervision of AUSTEO/AGAO Data Systems

Only Australian nationals should control systems handling sensitive Australian data.

Identity & access managementASD Information Security Manual +1

View details →

ISM-0100 🛡️ ASD Information Security Manual (ISM)

Regular IRAP Assessment of Sensitive Gateways

Sensitive gateways must have an IRAP assessment at least every two years using the latest ISM standards.

ASD Information Security ManualGuidelines for gateways +1

View details →

ISM-0109 🛡️ ASD Information Security Manual (ISM)

Restrict Sensitive Emails in Distribution Lists

Confirm all members' nationalities before sending sensitive Australian data to email lists.

ML3 ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-0120 🛡️ ASD Information Security Manual (ISM)

Ensure Cyber Security Personnel Have Necessary Tools

Cyber security staff must have the tools and data to spot system threats quickly.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-0123 🛡️ ASD Information Security Manual (ISM)

Report Cyber Security Incidents Promptly

Inform the chief information security officer quickly after any cyber incident is found.

ML2 Incident managementRoles and responsibilities +1

View details →

ISM-0125 🛡️ ASD Information Security Manual (ISM)

Maintaining a Cyber Security Incident Register

Create and keep a log of any cyber security incidents that occur.

Incident managementRecords management +1

View details →

ISM-0133 🛡️ ASD Information Security Manual (ISM)

Responding to Data Spills by Restricting Access

When a data spill occurs, notify the data owner and limit access to protect information.

Access controlASD Information Security Manual +1

View details →

ISM-0137 🛡️ ASD Information Security Manual (ISM)

Seek Legal Advice for Intrusion Evidence Collection

Before collecting evidence of cyber intrusions, get legal advice.

Incident managementLaws and regulations +1

View details →

ISM-0138 🛡️ ASD Information Security Manual (ISM)

Ensure Integrity of Evidence in Investigations

Investigators ensure evidence stays intact during investigations by documenting actions and following legal guidelines.

AuditLogging and monitoring +1

View details →

ISM-0140 🛡️ ASD Information Security Manual (ISM)

Prompt Reporting of Cyber Incidents to ASD

Report cyber incidents to ASD immediately when they're identified.

ML2 Incident managementInformation sharing +1

View details →

ISM-0141 🛡️ ASD Information Security Manual (ISM)

Report Cyber Incidents Promptly to Designated Contacts

Service providers must report cyber incidents quickly to a specified contact as part of their contract.

Incident managementContracts +1

View details →

ISM-0142 🛡️ ASD Information Security Manual (ISM)

Report Cryptographic Equipment Compromises Promptly

Notify security officers quickly if cryptographic equipment or keys might be compromised.

Incident managementCryptography +1

View details →

ISM-0161 🛡️ ASD Information Security Manual (ISM)

Ensure Security of Unused IT Equipment and Media

IT equipment and media are protected against unauthorized access when not actively being used.

Equipment protectionASD Information Security Manual +1

View details →

ISM-0164 🛡️ ASD Information Security Manual (ISM)

Prevent Unauthorised Viewing of System Displays

Ensure that unauthorised individuals can't see computer screens or keyboards in secure areas.

Clear desk and screenPhysical security +1

View details →

ISM-0181 🛡️ ASD Information Security Manual (ISM)

Ensure Cabling Meets Australian Standards

Install cables according to Australian Standards as required by the communications authority.

ComplianceRegulatory notification +1

View details →

ISM-0187 🛡️ ASD Information Security Manual (ISM)

Exclusive Secret Cable Bundling in Infrastructure

SECRET cables must be kept separate in their own bundles or conduits to enhance security.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-0194 🛡️ ASD Information Security Manual (ISM)

Sealing Conduit Joints in Shared Facilities

Use visible glue to seal plastic and TOP SECRET conduit joints in shared spaces.

Secure facilitiesASD Information Security Manual +1

View details →

ISM-0195 🛡️ ASD Information Security Manual (ISM)

Seal Removable Covers on TOP SECRET Cables

Use special seals to secure TOP SECRET cable covers in shared spaces to prevent tampering.

Cabling securitySecure facilities +1

View details →

ISM-0198 🛡️ ASD Information Security Manual (ISM)

Consultation for Penetrating Audio Secure Rooms

Before entering top secret audio rooms, consult ASIO and follow their guidance.

Physical securitySecure facilities +1

View details →

ISM-0201 🛡️ ASD Information Security Manual (ISM)

Labelling Requirements for TOP SECRET Conduits

TOP SECRET conduits must have labels every 5 metres, marked 'TS RUN', and be at least 2.5 cm by 1 cm in size.

LabellingSecure communications +1

View details →

ISM-0206 🛡️ ASD Information Security Manual (ISM)

Develop and Maintain Cable Labelling Processes

Ensure cables are labelled correctly by setting up and following specific procedures.

Cabling securityLabelling +1

View details →

ISM-0208 🛡️ ASD Information Security Manual (ISM)

Maintain a Comprehensive Cable Register

Keep a detailed record of each cable, including ID, colour, and location, to ensure proper cable management and security.

Cabling securityAsset management +1

View details →

ISM-0211 🛡️ ASD Information Security Manual (ISM)

Regular Maintenance of a Cable Register

Ensure that all cables are tracked and verified regularly using a cable register to maintain effective infrastructure management.

Cabling securityEquipment maintenance +1

View details →

ISM-0213 🛡️ ASD Information Security Manual (ISM)

Segregate Patch Panels for Secret-Level Cables

Secret and top secret cables must be connected to separate patch panels for security.

Cabling securityASD Information Security Manual +1

View details →

ISM-0216 🛡️ ASD Information Security Manual (ISM)

Ensure Separate Cabinets for TOP SECRET Patch Panels

TOP SECRET patch panels must be within their own separate cabinets to enhance security.

Access controlSecure facilities +1

View details →

ISM-0217 🛡️ ASD Information Security Manual (ISM)

Secure Separation of Non-TOP SECRET and TOP SECRET Panels

Install barriers and restrict access to mix different security level patch panels in cabinets.

Access controlEnvironment separation +1

View details →

ISM-0218 🛡️ ASD Information Security Manual (ISM)

Label and Protect Long TS Fibre-Optic Leads

Ensure long TS fibre-optic cables are protected, easy to inspect, and labelled at the equipment end.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-0225 🛡️ ASD Information Security Manual (ISM)

Prevent Unauthorised RF and IR Device Entry

Ensure no unauthorised RF or IR devices are brought into high-security areas.

Physical securityASD Information Security Manual +1

View details →

ISM-0229 🛡️ ASD Information Security Manual (ISM)

Guidelines for Discussing Sensitive Information Over Phones

Staff are informed about what sensitive information can be talked about on phone calls.

Secure communicationsAwareness and training +1

View details →

ISM-0230 🛡️ ASD Information Security Manual (ISM)

Advising on Risks of Non-Secure Telephone Systems

Staff are informed about security dangers of using unsecured phones for sensitive talks.

Awareness and trainingSecure communications +1

View details →

ISM-0231 🛡️ ASD Information Security Manual (ISM)

Visual Indication for Secure Telephone Connections

Telephone systems must show a visual cue for the security level of a call when using encryption.

Secure communicationsCryptography +1

View details →

ISM-0232 🛡️ ASD Information Security Manual (ISM)

Encrypt External Traffic for Sensitive Calls

Sensitive phone calls should be encrypted to prevent eavesdropping when using outside systems.

CryptographySecure communications +1

View details →

ISM-0233 🛡️ ASD Information Security Manual (ISM)

Ensure Encryption for Sensitive Cordless Communications

Do not use cordless phones or headsets for sensitive calls unless the communications are encrypted.

Secure communicationsCryptography +1

View details →

ISM-0235 🛡️ ASD Information Security Manual (ISM)

Use of Speakerphones in TOP SECRET Areas

Speakerphones can only be used in secure rooms when discussing TOP SECRET matters.

Secure areasAccess control +1

View details →

ISM-0236 🛡️ ASD Information Security Manual (ISM)

Implement Off-hook Audio Protection on Telephones

Use features to prevent phone conversations being heard in sensitive areas.

Configuration managementSecure communications +1

View details →

ISM-0240 🛡️ ASD Information Security Manual (ISM)

Prevent Sensitive Data in Messaging Services

Do not send sensitive information using paging or messaging apps.

Information transferASD Information Security Manual +1

View details →

ISM-0245 🛡️ ASD Information Security Manual (ISM)

Prevent MFD Connections to Digital Phone Systems

Do not connect multifunction devices (MFDs) to digital telephone systems.

User devicesASD Information Security Manual +1

View details →

ISM-0246 🛡️ ASD Information Security Manual (ISM)

Early Emanation Threat Assessment in System Lifecycle

Assess security risks from system emissions early in the design and development stages.

Secure SDLCSecure by design +1

View details →

ISM-0249 🛡️ ASD Information Security Manual (ISM)

Contact ASD for Emanation Threat Assessments

System owners must contact ASD for security assessment if deploying SECRET or TOP SECRET systems on mobile platforms.

Vulnerability managementThreat intelligence +1

View details →

ISM-0250 🛡️ ASD Information Security Manual (ISM)

Ensure IT Equipment Meets EMI/EMC Standards

IT equipment is required to comply with standards to prevent electromagnetic interference.

ComplianceASD Information Security Manual +1

View details →

ISM-0252 🛡️ ASD Information Security Manual (ISM)

Annual Cyber Security Awareness for Personnel

All staff receive yearly training on using and protecting systems, and reporting incidents.

Awareness and trainingSecurity culture +1

View details →

ISM-0258 🛡️ ASD Information Security Manual (ISM)

Establish and Maintain a Web Usage Policy

Develop and maintain a policy to manage how the web is used and accessed.

Internet accessPolicy +1

View details →

ISM-0260 🛡️ ASD Information Security Manual (ISM)

Ensure All Web Access Uses Proxies

All web access must go through web proxies to control and monitor internet use.

Web filteringInternet access +1

View details →

ISM-0261 🛡️ ASD Information Security Manual (ISM)

Log Web Proxy Activity for Security Analysis

Record details of websites accessed through web proxies, including web address and user info, for security tracking.

Logging and monitoringInternet access +1

View details →

ISM-0263 🛡️ ASD Information Security Manual (ISM)

Inspect and Decrypt TLS Traffic through Gateways

Gateways decrypt and check TLS internet traffic for safety reasons.

Network securityCryptography +1

View details →

ISM-0264 🛡️ ASD Information Security Manual (ISM)

Develop and Maintain an Email Usage Policy

Create and uphold a policy to guide the use of email communications.

PolicyAcceptable use +1

View details →

ISM-0267 🛡️ ASD Information Security Manual (ISM)

Blocking Access to Unapproved Webmail Services

Prevent access to webmail services that haven't been approved by the organisation.

Web filteringASD Information Security Manual +1

View details →

ISM-0269 🛡️ ASD Information Security Manual (ISM)

Restrict Sensitive Emails to Verified Recipients

Sensitive emails must not go to groups unless all recipients' nationalities are confirmed.

Access controlASD Information Security Manual +1

View details →

ISM-0270 🛡️ ASD Information Security Manual (ISM)

Apply Protective Markings to Emails Based on Sensitivity

Emails must be marked to show their highest confidentiality level based on content.

LabellingInformation classification +1

View details →

ISM-0271 🛡️ ASD Information Security Manual (ISM)

Prevent Automatic Email Marking by Protective Tools

Protective tools for emails don't automatically add security labels to your messages.

LabellingInformation classification +1

View details →

ISM-0272 🛡️ ASD Information Security Manual (ISM)

Prevent Unauthorised Protective Marking Selection

Ensure users cannot choose classification levels the system cannot handle.

Information classificationAccess control +1

View details →

ISM-0280 🛡️ ASD Information Security Manual (ISM)

Choose PP-evaluated Products Over EAL-based Ones

Prefer products evaluated against protection profiles over those with EAL evaluations for procurement purposes.

Assurance and auditSupplier management +1

View details →

ISM-0285 🛡️ ASD Information Security Manual (ISM)

Ensuring Evaluated Products Follow Delivery Procedures

Products must be delivered according to any specified delivery methods in evaluation documents.

Supplier managementAsset management +1

View details →

ISM-0286 🛡️ ASD Information Security Manual (ISM)

Consult ASD for High Assurance IT Delivery Procedures

Contact ASD for delivery procedures when buying high-security IT equipment.

Assurance and auditICT supply chain +1

View details →

ISM-0289 🛡️ ASD Information Security Manual (ISM)

Implement and Manage Evaluated Products Correctly

Ensure evaluated products are set up and run correctly following vendor instructions and evaluated settings.

Configuration managementManagement responsibility +1

View details →

ISM-0290 🛡️ ASD Information Security Manual (ISM)

Secure Configuration of High Assurance IT Equipment

Ensure high-grade IT gear is set up and operated per ASD standards for security.

Configuration managementEquipment protection +1

View details →

ISM-0293 🛡️ ASD Information Security Manual (ISM)

Classify IT Equipment by Data Sensitivity

Label IT equipment based on the sensitivity of the data it handles.

Equipment protectionInformation classification +1

View details →

ISM-0294 🛡️ ASD Information Security Manual (ISM)

Label IT Equipment with Protective Markings

Ensure regular IT equipment is labelled to show its sensitivity level, but this doesn't apply to high assurance equipment.

LabellingEquipment protection +1

View details →

ISM-0296 🛡️ ASD Information Security Manual (ISM)

Approval Required for High Assurance IT Equipment Labelling

Seek approval before labelling high assurance IT equipment to ensure security standards.

LabellingEquipment protection +1

View details →

ISM-0298 🛡️ ASD Information Security Manual (ISM)

Centralised System Patch and Update Management

Ensure patches and updates are applied correctly using a centralised system for better security.

Vulnerability managementEquipment maintenance +1

View details →

ISM-0300 🛡️ ASD Information Security Manual (ISM)

Apply System Security Patches with Approval

Security patches for critical IT must be approved and applied as directed by ASD.

Vulnerability managementIT change +1

View details →

ISM-0304 🛡️ ASD Information Security Manual (ISM)

Remove Unsupported Applications for System Security

Applications no longer supported by vendors, except some key types, should be removed for security.

ML3 Application securityAsset management +1

View details →

ISM-0305 🛡️ ASD Information Security Manual (ISM)

On-Site Maintenance by Cleared Technicians

IT equipment maintenance and repairs must be done on-site by technicians with appropriate security clearances.

Roles and responsibilitiesASD Information Security Manual +1

View details →

ISM-0306 🛡️ ASD Information Security Manual (ISM)

Escort Unauthorised Technicians for IT Repairs

Ensure unauthorised IT repair technicians are escorted by a qualified person to protect data and equipment integrity.

Roles and responsibilitiesAccess control +1

View details →

ISM-0307 🛡️ ASD Information Security Manual (ISM)

Ensure Proper Sanitisation Before IT Maintenance

Clean IT equipment and media if maintenance is done by non-cleared technicians.

Data deletionEquipment maintenance +1

View details →

ISM-0310 🛡️ ASD Information Security Manual (ISM)

Ensure Off-site IT Repairs Are Conducted at Approved Facilities

IT equipment sent for repair off-site must be taken to facilities that can handle its security level.

Supplier managementSecure facilities +1

View details →

ISM-0311 🛡️ ASD Information Security Manual (ISM)

Ensuring Sanitisation of IT Equipment Media

Remove or clean media from IT equipment to ensure data is not left on the device.

Data deletionEquipment disposal and re-use +1

View details →

ISM-0312 🛡️ ASD Information Security Manual (ISM)

Return Overseas Equipment for Destruction

Sensitive IT gear overseas must be sent back to Australia for destruction if it can't be cleaned there.

Equipment disposal and re-useData deletion +1

View details →

ISM-0313 🛡️ ASD Information Security Manual (ISM)

Develop and Maintain IT Equipment Sanitisation Procedures

Organisations must create and uphold processes for properly cleaning and disposing of IT equipment.

Equipment disposal and re-useData deletion +1

View details →

ISM-0315 🛡️ ASD Information Security Manual (ISM)

Ensure Destruction of High Assurance IT Equipment

High assurance IT equipment must be destroyed before disposal to prevent data leaks.

Equipment disposal and re-useAsset management +1

View details →

ISM-0316 🛡️ ASD Information Security Manual (ISM)

Formal Decision on IT Equipment Disposal

Before IT equipment is publicly released, it must be sanitised and authorised after a formal decision.

AuditEquipment disposal and re-use +1

View details →

ISM-0317 🛡️ ASD Information Security Manual (ISM)

Ensuring Data Erasure on Printer Cartridges and Drums

Print three full pages of random text to ensure no data remains on printer cartridges or drums.

Data deletionEquipment disposal and re-use +1

View details →

ISM-0318 🛡️ ASD Information Security Manual (ISM)

Safely Disposing of Unsanitised Printer Components

Destroy printer cartridges or print drums if they can't be sanitised, like other memory devices.

Equipment disposal and re-useData deletion +1

View details →

ISM-0321 🛡️ ASD Information Security Manual (ISM)

Contact ASD for Guidance on Secure IT Disposal

Ensure secure disposal of certain IT equipment by consulting the ASD for requirements.

Equipment disposal and re-useAsset management +1

View details →

ISM-0323 🛡️ ASD Information Security Manual (ISM)

Classifying Media by Data Sensitivity

Media should be classified by the highest level of data sensitivity it contains.

Storage mediaInformation classification +1

View details →

ISM-0325 🛡️ ASD Information Security Manual (ISM)

Reclassify Media to Higher Sensitivity

Media connected to more sensitive systems is upgraded to match the highest security level.

ASD Information Security ManualGovernance +1

View details →

ISM-0330 🛡️ ASD Information Security Manual (ISM)

Proper Sanitisation and Reclassification of Media

Before lowering media classification, it must be cleaned or destroyed and a formal decision made.

Information classificationASD Information Security Manual +1

View details →

ISM-0332 🛡️ ASD Information Security Manual (ISM)

Label Media with Sensitivity or Classification

Label physical media, except internal hard drives, to show its security level or classification.

Storage mediaInformation classification +1

View details →

ISM-0336 🛡️ ASD Information Security Manual (ISM)

Maintain a Comprehensive IT Equipment Register

Keep a regularly updated record of all IT equipment connected to the network.

Asset inventoryAsset management +1

View details →

ISM-0337 🛡️ ASD Information Security Manual (ISM)

Ensure Media is Used with Authorised Systems

Media must only be used with systems that are authorised for its sensitivity level.

Storage mediaASD Information Security Manual +1

View details →

ISM-0341 🛡️ ASD Information Security Manual (ISM)

Disable Automatic Execution for Removable Media

Ensure removable media cannot run programs automatically when inserted.

Configuration managementStorage media +1

View details →

ISM-0343 🛡️ ASD Information Security Manual (ISM)

Disabling Unnecessary Access to Removable Media

Disable writing to removable media unless it's necessary for business.

Access controlStorage media +1

View details →

ISM-0345 🛡️ ASD Information Security Manual (ISM)

Disable External Interfaces for Direct Memory Access

Disable external communication ports that could directly access system memory to prevent unauthorised access.

Configuration managementUser devices +1

View details →

ISM-0347 🛡️ ASD Information Security Manual (ISM)

Use Write-Once Media for Secure Data Transfers

When moving data between different security levels, make sure to use media that can't be changed, unless the destination can ensure it's read-only.

Information transferStorage media +1

View details →

ISM-0348 🛡️ ASD Information Security Manual (ISM)

Develop and Maintain Media Sanitisation Procedures

Organisations must create, apply, and keep up media sanitisation methods and procedures.

Storage mediaEquipment disposal and re-use +1

View details →

ISM-0350 🛡️ ASD Information Security Manual (ISM)

Destroy Unsanitizable Media Before Disposal

Media that can't be cleaned of data must be destroyed before getting rid of it.

Equipment disposal and re-useStorage media +1

View details →

ISM-0351 🛡️ ASD Information Security Manual (ISM)

Proper Method for Volatile Media Sanitisation

Turn off power to the storage device for 10 minutes to fully clear data.

Storage mediaEquipment disposal and re-use +1

View details →

ISM-0352 🛡️ ASD Information Security Manual (ISM)

Secure Volatile Media by Overwriting with Random Data

Ensure SECRET and TOP SECRET media are made unreadable by overwriting with random data and verifying it.

Data deletionStorage media +1

View details →

ISM-0354 🛡️ ASD Information Security Manual (ISM)

Ensuring Proper Sanitisation of Magnetic Media

Erase non-volatile magnetic media by overwriting with random data, ensuring old data cannot be accessed.

Storage mediaEquipment disposal and re-use +1

View details →

ISM-0356 🛡️ ASD Information Security Manual (ISM)

Classify Magnetic Media After Sanitisation

After cleaning, classified magnetic media must still be treated as classified.

Information classificationStorage media +1

View details →

ISM-0357 🛡️ ASD Information Security Manual (ISM)

Sanitising Non-volatile EPROM Media

Erase and overwrite EPROM with UV exposure and a random pattern to ensure data is completely removed.

Data deletionEquipment disposal and re-use +1

View details →

ISM-0358 🛡️ ASD Information Security Manual (ISM)

Classification Retention for Sanitised EPROM and EEPROM

Even after erasure, certain memory devices stay classified as SECRET or TOP SECRET.

Information classificationEquipment disposal and re-use +1

View details →

ISM-0359 🛡️ ASD Information Security Manual (ISM)

Proper Sanitisation of Non-Volatile Flash Memory

Non-volatile flash memory is wiped by overwriting it twice with random data, then checked to ensure it's clean.

Data deletionEquipment disposal and re-use +1

View details →

ISM-0360 🛡️ ASD Information Security Manual (ISM)

Classification Retention After Flash Memory Sanitisation

Even after being sanitised, flash drives for SECRET and TOP SECRET still need to be treated as classified data.

Information classificationData deletion +1

View details →

ISM-0361 🛡️ ASD Information Security Manual (ISM)

Using Degaussers for Magnetic Media Destruction

Magnetic media is destroyed by ensuring the degausser has the right strength and orientation of the magnetic field.

Equipment disposal and re-useData deletion +1

View details →

ISM-0362 🛡️ ASD Information Security Manual (ISM)

Follow Manufacturer's Directions for Degaussing

Ensure magnetic media is degaussed according to the manufacturer's instructions to properly erase data.

Management responsibilityASD Information Security Manual +1

View details →

ISM-0363 🛡️ ASD Information Security Manual (ISM)

Develop and Maintain Media Destruction Processes

Ensure your organisation creates and follows proper media destruction procedures to securely dispose of data.

Data deletionEquipment disposal and re-use +1

View details →

ISM-0368 🛡️ ASD Information Security Manual (ISM)

Ensuring Media Particles Are No Larger Than 9 mm

Destroy media so resulting particles are no bigger than 9 mm to prevent data recovery.

Data deletionEquipment disposal and re-use +1

View details →

ISM-0370 🛡️ ASD Information Security Manual (ISM)

Supervise Media Destruction with Cleared Personnel

Ensure destroyed media is supervised by a qualified person for security purposes.

AuditRoles and responsibilities +1

View details →

ISM-0371 🛡️ ASD Information Security Manual (ISM)

Ensure Proper Supervision of Media Destruction

Staff must oversee media destruction to ensure it is done correctly and completely.

Data deletionRecords management +1

View details →

ISM-0372 🛡️ ASD Information Security Manual (ISM)

Supervision of Media Destruction Procedures

Media destruction must be overseen by at least two security-cleared staff members.

AuditEquipment disposal and re-use +1

View details →

ISM-0373 🛡️ ASD Information Security Manual (ISM)

Supervise and Certify Accountable Material Destruction

Supervisors ensure accountable material is destroyed properly and sign a certificate to confirm it.

AuditEquipment disposal and re-use +1

View details →

ISM-0374 🛡️ ASD Information Security Manual (ISM)

Develop and Maintain Media Disposal Procedures

Organizations must create and uphold procedures for securely disposing of media.

Equipment disposal and re-usePolicy +1

View details →

ISM-0375 🛡️ ASD Information Security Manual (ISM)

Decide on Public Release of Data Storage Media

After data is erased or destroyed, a formal decision allows media to be sent to the public.

Equipment disposal and re-useData deletion +1

View details →

ISM-0378 🛡️ ASD Information Security Manual (ISM)

Remove Labels from Media Before Disposal

Remove all identifying labels from media before throwing it away to ensure no information can be traced back.

Equipment disposal and re-useLabelling +1

View details →

ISM-0380 🛡️ ASD Information Security Manual (ISM)

Disable Unneeded OS Accounts and Services

Remove or turn off unnecessary user accounts and services on operating systems to improve security.

Configuration managementIdentity & access management +1

View details →

ISM-0382 🛡️ ASD Information Security Manual (ISM)

Restrict Unprivileged User Actions on Applications

Ordinary users cannot remove or turn off approved apps on their own.

Application securityAccess control +1

View details →

ISM-0383 🛡️ ASD Information Security Manual (ISM)

Change Default OS User Accounts During Setup

Change or disable default OS user accounts during setup to enhance security.

Credentials and secretsSecure by design +1

View details →

ISM-0385 🛡️ ASD Information Security Manual (ISM)

Ensure Servers Operate Independently Through Separation

Servers are set up to work independently without interference from others.

Environment separationLeast privilege +1

View details →

ISM-0393 🛡️ ASD Information Security Manual (ISM)

Classify Databases Based on Data Sensitivity

Databases should be classified according to how sensitive the data they contain is.

ASD Information Security ManualGovernance +1

View details →

ISM-0400 🛡️ ASD Information Security Manual (ISM)

Segregation of Environments in Software Development

Development areas are kept separate to enhance security and efficiency in software projects.

Secure SDLCASD Information Security Manual +1

View details →

ISM-0401 🛡️ ASD Information Security Manual (ISM)

Implement Secure by Design in Software Development

Follow Secure by Design practices throughout software development to ensure security.

Secure by designSoftware development +1

View details →

ISM-0402 🛡️ ASD Information Security Manual (ISM)

Comprehensive Software Vulnerability Testing

Software undergoes thorough vulnerability testing both before and after release to spot undiscovered security issues.

AuditASD Information Security Manual +1

View details →

ISM-0405 🛡️ ASD Information Security Manual (ISM)

Validation for Unprivileged System Access Requests

Requests for basic system access are checked when they are first made.

Access controlASD Information Security Manual +1

View details →

ISM-0407 🛡️ ASD Information Security Manual (ISM)

Maintain Secure User Access Records

Keep a secure record of who accessed the system, who authorised it, and details of their access levels.

Identity & access managementASD Information Security Manual +1

View details →

ISM-0408 🛡️ ASD Information Security Manual (ISM)

System Login Security Reminder Banner

A login message that reminds users of their security duties when accessing the system.

ASD Information Security ManualGovernance +1

View details →

ISM-0409 🛡️ ASD Information Security Manual (ISM)

Restrict Foreign Nationals' Access to Sensitive Data

Foreign nationals can't access certain sensitive data unless security measures prevent it.

ASD Information Security ManualAccess control +1

View details →

ISM-0411 🛡️ ASD Information Security Manual (ISM)

Restrict System Access for Foreign Nationals

Foreign nationals need strict controls to access systems handling AGAO data.

ASD Information Security ManualAccess control +1

View details →

ISM-0414 🛡️ ASD Information Security Manual (ISM)

Ensure Unique Identification for System Access

People accessing systems must have unique identifiers to ensure accountability.

Identity & access managementASD Information Security Manual +1

View details →

ISM-0415 🛡️ ASD Information Security Manual (ISM)

Strict Control of Shared User Accounts

Ensure shared user accounts are used carefully, with each user clearly identified to maintain security.

ASD Information Security ManualAccess control +1

View details →

ISM-0417 🛡️ ASD Information Security Manual (ISM)

Use Passwords When Multi-Factor Authentication Isn't Supported

If systems can't use multi-factor authentication, they should use passwords for single-factor authentication.

ASD Information Security ManualGovernance +1

View details →

ISM-0418 🛡️ ASD Information Security Manual (ISM)

Keep Physical Credentials Separate from Systems

Store physical credentials away from systems except when logging in.

ASD Information Security ManualGovernance +1

View details →

ISM-0420 🛡️ ASD Information Security Manual (ISM)

Identify Nationality of Foreign Personnel in System

Ensure foreign nationals using the system are identified by their nationality for sensitive data security.

Identity & access managementASD Information Security Manual +1

View details →

ISM-0421 🛡️ ASD Information Security Manual (ISM)

Require Minimum 15-Character Passwords for Security

Passwords for sensitive systems must have at least 15 characters to enhance security.

ASD Information Security ManualGovernance +1

View details →

ISM-0422 🛡️ ASD Information Security Manual (ISM)

Ensuring Strong Passwords for TOP SECRET Systems

Passwords on TOP SECRET systems should be at least 20 characters to ensure strong security.

ASD Information Security ManualGovernance +1

View details →

ISM-0428 🛡️ ASD Information Security Manual (ISM)

Enforcement of Secure Session Locking Measures

Sessions lock after inactivity or maximum duration, blocking access until users re-authenticate with all required factors.

ASD Information Security ManualGovernance +1

View details →

ISM-0430 🛡️ ASD Information Security Manual (ISM)

Immediate Suspension of Unneeded System Access

Revoke system access for individuals as soon as it's no longer needed.

Access controlASD Information Security Manual +1

View details →

ISM-0432 🛡️ ASD Information Security Manual (ISM)

Document System Access Requirements in Security Plans

System access rules must be documented in each system's security plan to ensure proper access management.

ASD Information Security ManualAccess control +1

View details →

ISM-0434 🛡️ ASD Information Security Manual (ISM)

Ensure Personnel Employment Screening and Security Clearance

Staff need job screening and security clearance for system access.

ASD Information Security ManualAccess control +1

View details →

ISM-0435 🛡️ ASD Information Security Manual (ISM)

Pre-Access Briefings for System Resources

Staff must be briefed before accessing system resources.

ASD Information Security ManualAccess control +1

View details →

ISM-0441 🛡️ ASD Information Security Manual (ISM)

Ensuring Limited Access for Temporary System Use

When given temporary system access, personnel can only see data needed for their job.

ASD Information Security ManualAccess control +1

View details →

ISM-0443 🛡️ ASD Information Security Manual (ISM)

Restrict Temporary Access to Secure Systems

Temporary access is not allowed for systems handling highly sensitive information.

ASD Information Security ManualAccess control +1

View details →

ISM-0445 🛡️ ASD Information Security Manual (ISM)

Dedicated Accounts for Privileged User Activities

Privileged users must have separate accounts for administrative tasks to enhance security.

ML1 Logging and monitoringASD Information Security Manual +1

View details →

ISM-0446 🛡️ ASD Information Security Manual (ISM)

Restrict Privileged Access for Foreign Nationals

Foreign nationals can't access Australian systems with sensitive data privileges.

Privileged accessASD Information Security Manual +1

View details →

ISM-0447 🛡️ ASD Information Security Manual (ISM)

Restrict Privileged Access for Foreign Nationals

Foreign nationals can't have privileged access to systems handling AGAO data except if seconded.

ASD Information Security ManualAccess control +1

View details →

ISM-0455 🛡️ ASD Information Security Manual (ISM)

Enable Data Recovery for Encrypted Data

Ensure encrypted data can be accessed if the encryption key is lost or damaged.

ASD Information Security ManualGovernance +1

View details →

ISM-0457 🛡️ ASD Information Security Manual (ISM)

Use Evaluated Crypto for Sensitive Data Encryption

Use approved cryptographic tools to encrypt sensitive or protected data to ensure security.

ComplianceASD Information Security Manual +1

View details →

ISM-0459 🛡️ ASD Information Security Manual (ISM)

Implement Full or Partial Disk Encryption for Data Protection

Encrypt all or parts of a drive to ensure data cannot be accessed without the correct permissions.

ASD Information Security ManualGovernance +1

View details →

ISM-0460 🛡️ ASD Information Security Manual (ISM)

Use HACE for Encrypting Sensitive Media

HACE ensures the encryption of media with SECRET or TOP SECRET data is secure.

ASD Information Security ManualGovernance +1

View details →

ISM-0462 🛡️ ASD Information Security Manual (ISM)

Managing Encryption Access for IT Equipment and Media

IT systems are treated according to their original sensitivity when accessed using encryption.

ASD Information Security ManualGovernance +1

View details →

ISM-0465 🛡️ ASD Information Security Manual (ISM)

Use Evaluated Cryptographic Tools for Sensitive Data

Use evaluated cryptographic tools to protect sensitive data on insecure or public networks.

ASD Information Security ManualGovernance +1

View details →

ISM-0467 🛡️ ASD Information Security Manual (ISM)

Using HACE for Secure Communication of Data

Use HACE to secure SECRET and TOP SECRET data on less secure networks.

ASD Information Security ManualGovernance +1

View details →

ISM-0469 🛡️ ASD Information Security Manual (ISM)

Protect Data with ASD-Approved Cryptographic Protocols

Use approved cryptographic methods to secure data when it's communicated over networks.

ASD Information Security ManualGovernance +1

View details →

ISM-0471 🛡️ ASD Information Security Manual (ISM)

Use Only High Assurance Cryptographic Algorithms

Ensure cryptographic tools use only ASD-approved or high-assurance algorithms for security.

ASD Information Security ManualGovernance +1

View details →

ISM-0472 🛡️ ASD Information Security Manual (ISM)

Using Proper Modulus Size for Diffie-Hellman Keys

Ensure Diffie-Hellman encryption uses at least a 2048 bits modulus for secure key agreements.

ASD Information Security ManualGovernance +1

View details →

ISM-0474 🛡️ ASD Information Security Manual (ISM)

Using Secure Elliptic Curve Diffie-Hellman Encryption

Use ECDH with a base point order and key size of at least 224 bits, preferably NIST P-384, for secure key agreements.

ASD Information Security ManualGovernance +1

View details →

ISM-0475 🛡️ ASD Information Security Manual (ISM)

Use P-384 Curve for Secure Digital Signatures

Ensure stronger digital signature security by using ECDSA with a key size of at least 224 bits, ideally the P-384 curve.

ASD Information Security ManualGovernance +1

View details →

ISM-0476 🛡️ ASD Information Security Manual (ISM)

Ensuring Strong RSA Modulus for Digital Security

Use a minimum 2048-bit RSA modulus for better security in digital signatures and key transport.

ASD Information Security ManualGovernance +1

View details →

ISM-0477 🛡️ ASD Information Security Manual (ISM)

Separate RSA Key Pairs for Different Functions

Use separate RSA key pairs for signing and key transportation to enhance security.

ASD Information Security ManualGovernance +1

View details →

ISM-0479 🛡️ ASD Information Security Manual (ISM)

Avoid Using ECB Mode for Symmetric Encryption

Symmetric encryption should not use ECB mode as it is less secure.

ASD Information Security ManualGovernance +1

View details →

ISM-0481 🛡️ ASD Information Security Manual (ISM)

Ensure Use of High Assurance Cryptographic Protocols

Ensure only approved secure cryptographic protocols are used in equipment and software.

CryptographyPolicy +1

View details →

ISM-0484 🛡️ ASD Information Security Manual (ISM)

Configure SSH for Enhanced Security

Ensure the SSH service is secure by limiting access, disabling root login, and enforcing strict authentication measures.

Configuration managementASD Information Security Manual +1

View details →

ISM-0485 🛡️ ASD Information Security Manual (ISM)

Use Public Key Authentication for SSH Access

Ensure SSH connections use public key authentication for enhanced security.

AuthenticationASD Information Security Manual +1

View details →

ISM-0487 🛡️ ASD Information Security Manual (ISM)

Disable Certain Features for Passwordless SSH Logins

When logging in without a password via SSH, certain access features like port forwarding and X11 are disabled to enhance security.

Access controlConfiguration management +1

View details →

ISM-0488 🛡️ ASD Information Security Manual (ISM)

Use Forced Commands for SSH Without Passwords

Ensure SSH without passwords uses specific commands and checks parameters for security.

Access controlConfiguration management +1

View details →

ISM-0489 🛡️ ASD Information Security Manual (ISM)

SSH-Agent Key Expiry and Screen Lock Requirements

SSH-agent caches must be used on systems with screen locks and expire after 4 hours of inactivity.

Access controlASD Information Security Manual +1

View details →

ISM-0490 🛡️ ASD Information Security Manual (ISM)

Ensure S/MIME 3.0 or Later is Used

Only use S/MIME version 3.0 or later for secure email communications.

ASD Information Security ManualGovernance +1

View details →

ISM-0494 🛡️ ASD Information Security Manual (ISM)

Use of IPsec Tunnel and Transport Modes

IPsec connections should use tunnel mode; if using transport mode, ensure an IP tunnel is used.

ASD Information Security ManualGovernance +1

View details →

ISM-0496 🛡️ ASD Information Security Manual (ISM)

Use ESP Protocol for Secure IPsec Connections

ESP protocol is needed to securely encrypt and authenticate IPsec connections.

ASD Information Security ManualGovernance +1

View details →

ISM-0498 🛡️ ASD Information Security Manual (ISM)

Ensure Short Lifetimes for IPsec Associations

IPsec connections should expire in less than four hours to maintain security.

ASD Information Security ManualGovernance +1

View details →

ISM-0499 🛡️ ASD Information Security Manual (ISM)

Ensure Compliance with ASD Communication Security Policies

Follow ASD's security rules for operating and managing communication systems safely.

ComplianceASD Information Security Manual +1

View details →

ISM-0501 🛡️ ASD Information Security Manual (ISM)

Transport of Keyed Cryptographic Equipment

Cryptographic equipment is moved securely depending on the sensitivity of its keys.

ASD Information Security ManualGovernance +1

View details →

ISM-0507 🛡️ ASD Information Security Manual (ISM)

Develop and Maintain Cryptographic Key Management Processes

Ensure systems have established processes for managing cryptographic keys securely and efficiently.

ASD Information Security ManualGovernance +1

View details →

ISM-0516 🛡️ ASD Information Security Manual (ISM)

Comprehensive Network Diagrams for Critical Components

Create network diagrams showing connections, critical servers, and security devices for proper documentation.

ASD Information Security ManualGovernance +1

View details →

ISM-0518 🛡️ ASD Information Security Manual (ISM)

Maintain Comprehensive Network Documentation

Ensure that network documentation is regularly created, updated, and kept available to support network management.

ASD Information Security ManualGovernance +1

View details →

ISM-0520 🛡️ ASD Information Security Manual (ISM)

Prevent Unauthorised Network Device Connections

Ensure only approved devices can connect to the network, blocking unauthorised access.

ASD Information Security ManualGovernance +1

View details →

ISM-0521 🛡️ ASD Information Security Manual (ISM)

Disable Unused IPv6 on Dual-Stack Devices

Turn off IPv6 capabilities on network devices unless they are actively being used.

ASD Information Security ManualGovernance +1

View details →

ISM-0529 🛡️ ASD Information Security Manual (ISM)

Avoid Using VLANs for Different Security Domains

Do not use VLANs to separate networks with different security levels.

ASD Information Security ManualGovernance +1

View details →

ISM-0530 🛡️ ASD Information Security Manual (ISM)

Administer VLANs from Trusted Security Domains

VLANs must be managed from the most secure and trusted part of the network.

ASD Information Security ManualGovernance +1

View details →

ISM-0534 🛡️ ASD Information Security Manual (ISM)

Disable Unused Network Device Ports

Network devices should have any unused physical ports turned off to prevent unauthorized access.

ASD Information Security ManualGovernance +1

View details →

ISM-0535 🛡️ ASD Information Security Manual (ISM)

Prevent VLAN Trunk Sharing Across Security Domains

Ensure network devices do not use shared paths for VLANs from different security areas.

ASD Information Security ManualGovernance +1

View details →

ISM-0536 🛡️ ASD Information Security Manual (ISM)

Segregate Public Wireless Networks from Organisation Networks

Public Wi-Fi must be separate from other organisation networks to ensure security.

ASD Information Security ManualGovernance +1

View details →

ISM-0546 🛡️ ASD Information Security Manual (ISM)

Use Video and Voice-Aware Firewalls at Gateways

Ensure firewalls and proxies can handle video and voice data for secure conferencing and calls.

ASD Information Security ManualGovernance +1

View details →

ISM-0547 🛡️ ASD Information Security Manual (ISM)

Secure Protocols for Video and IP Telephony

Video and IP calls must use secure protocols to keep communications private and safe.

ASD Information Security ManualGovernance +1

View details →

ISM-0548 🛡️ ASD Information Security Manual (ISM)

Ensure Secure Protocols for Video and IP Calls

Video and IP calls must use secure protocols to protect communication.

ASD Information Security ManualGovernance +1

View details →

ISM-0549 🛡️ ASD Information Security Manual (ISM)

Separate Video Call Traffic from Other Data

Keep video calls and internet phone traffic apart from regular data for security.

ASD Information Security ManualGovernance +1

View details →

ISM-0551 🛡️ ASD Information Security Manual (ISM)

Ensure Secure IP Telephony Device Authentication

Ensure only authorised IP phones can register and use the network, blocking unauthorised and unused functionalities.

ASD Information Security ManualGovernance +1

View details →

ISM-0553 🛡️ ASD Information Security Manual (ISM)

Authenticate Video Calls and Manage Settings

Ensure all video call actions and settings changes are verified with authentication and authorisation.

ASD Information Security ManualGovernance +1

View details →

ISM-0554 🛡️ ASD Information Security Manual (ISM)

Secure Two-Way Authentication for Video Calls

Video calls must use secure two-way authentication to ensure calls are encrypted and cannot be reused.

ASD Information Security ManualGovernance +1

View details →

ISM-0555 🛡️ ASD Information Security Manual (ISM)

Ensure Authentication for IP Telephony Actions

Users must be verified for all actions such as registering phones and accessing voicemail on IP telephony networks.

ASD Information Security ManualGovernance +1

View details →

ISM-0556 🛡️ ASD Information Security Manual (ISM)

Ensure Traffic Separation for Video Conferencing and Telephony

Keep video conferencing and IP phone data separate from other data using VLANs or similar methods.

ASD Information Security ManualGovernance +1

View details →

ISM-0558 🛡️ ASD Information Security Manual (ISM)

Restrict IP Phone Network Access in Public Areas

Public area IP phones cannot connect to data networks or access voicemail and directories.

ASD Information Security ManualGovernance +1

View details →

ISM-0559 🛡️ ASD Information Security Manual (ISM)

Restrict Microphone and Webcam Use in SECRET Areas

Don't use microphones or webcams on non-classified computers in areas handling SECRET projects.

ASD Information Security ManualGovernance +1

View details →

ISM-0565 🛡️ ASD Information Security Manual (ISM)

Email Security for Protective Markings

Email servers stop and track emails with wrong markings to prevent mistakes.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-0567 🛡️ ASD Information Security Manual (ISM)

Restrict Email Relay to Specific Domains

Ensure email servers only relay emails within their own domains to prevent misuse.

ASD Information Security ManualGovernance +1

View details →

ISM-0569 🛡️ ASD Information Security Manual (ISM)

Centralise Email Routing via Gateways

Emails are processed through central gateways for improved control and security.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-0570 🛡️ ASD Information Security Manual (ISM)

Maintain Backup Email Gateways to Primary Standards

Alternative email gateways must be kept to the same standards as the main gateway to ensure consistency.

ASD Information Security ManualGovernance +1

View details →

ISM-0571 🛡️ ASD Information Security Manual (ISM)

Ensure Secure Email Transmission via Gateways

Emails should be sent through secure and encrypted channels using central gateways.

ASD Information Security ManualGovernance +1

View details →

ISM-0572 🛡️ ASD Information Security Manual (ISM)

Enable Opportunistic TLS for Email Server Encryption

Ensure email servers use encryption to protect emails sent over public networks.

ASD Information Security ManualGovernance +1

View details →

ISM-0574 🛡️ ASD Information Security Manual (ISM)

Use SPF to Authorise Email Servers

SPF helps confirm which email servers are allowed to send emails for your organisation's domain.

ASD Information Security ManualGovernance +1

View details →

ISM-0576 🛡️ ASD Information Security Manual (ISM)

Develop and Maintain Cyber Security Incident Plans

Organisations must create and keep an updated cyber security incident management and response plan.

ASD Information Security ManualGuidelines for cyber security incidents +1

View details →

ISM-0580 🛡️ ASD Information Security Manual (ISM)

Develop and Maintain Event Logging Policies

Ensure a policy is in place to record and monitor events.

AuditLogging and monitoring +1

View details →

ISM-0582 🛡️ ASD Information Security Manual (ISM)

Central Logging of Windows Security Events

Important Windows security events are collected in a central location to monitor system activities.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-0585 🛡️ ASD Information Security Manual (ISM)

Capture Detailed Information in Event Logs

Record details like time, user, and equipment for each logged event.

AuditLogging and monitoring +1

View details →

ISM-0588 🛡️ ASD Information Security Manual (ISM)

Develop and Maintain MFD Usage Policy

Establish a policy to guide the proper use of multifunction devices.

ASD Information Security ManualGuidelines for information technology equipment +1

View details →

ISM-0589 🛡️ ASD Information Security Manual (ISM)

Limit Document Sensitivity on MFDs Based on Network Classification

Multifunction devices should not scan or copy documents that are more sensitive than the network they are connected to can handle.

ASD Information Security ManualGuidelines for information technology equipment +1

View details →

ISM-0590 🛡️ ASD Information Security Manual (ISM)

Ensure Strong Authentication for Multi-Function Devices

Multi-function devices should have security measures as strong as those for computers they connect to.

ASD Information Security ManualGuidelines for information technology equipment +1

View details →

ISM-0591 🛡️ ASD Information Security Manual (ISM)

Use Evaluated Peripheral Switches Securely

Use verified switches to safely share devices between different computer systems.

ASD Information Security ManualGovernance +1

View details →

ISM-0597 🛡️ ASD Information Security Manual (ISM)

Consult ASD Before Changing CDS Connectivity

Consult ASD when adding connections to cross domain systems and follow their guidance.

ASD Information Security ManualGovernance +1

View details →

ISM-0610 🛡️ ASD Information Security Manual (ISM)

Train Users on Secure Use of CDSs

Users must be trained on securely using CDSs before they can access them.

Awareness and trainingASD Information Security Manual +1

View details →

ISM-0611 🛡️ ASD Information Security Manual (ISM)

Restrict Privileges for Gateway Administrators

Gateway admins have only the necessary access permissions for their tasks.

Least privilegePrivileged access +1

View details →

ISM-0612 🛡️ ASD Information Security Manual (ISM)

Training for Gateway System Administrators

Gateway system admins must be formally trained to operate and manage the gateways effectively.

ASD Information Security ManualGuidelines for gateways +1

View details →

ISM-0613 🛡️ ASD Information Security Manual (ISM)

Requirement for Gateway System Administrators Nationality

Only Australian nationals can manage gateways to certain secure networks.

ComplianceHR security +1

View details →

ISM-0616 🛡️ ASD Information Security Manual (ISM)

Ensure Separation of Duties for Gateway Admins

Different people handle administrative tasks for gateways to reduce security risks.

Segregation of dutiesAdmin accounts +1

View details →

ISM-0619 🛡️ ASD Information Security Manual (ISM)

User Authentication for Network Gateway Access

Ensure users verify their identity before accessing networks through gateways.

AuthenticationIdentity & access management +1

View details →

ISM-0622 🛡️ ASD Information Security Manual (ISM)

Ensuring Network Authentication via Gateways

IT devices must prove their identity to access networks through gateways.

AuthenticationNetwork security +1

View details →

ISM-0626 🛡️ ASD Information Security Manual (ISM)

Implementing CDS for Secure Network Segmentation

Cross Domain Solutions connect SECRET or TOP SECRET networks with other networks securely.

Network segmentationInformation sharing +1

View details →

ISM-0628 🛡️ ASD Information Security Manual (ISM)

Implementing Secure Network Gateways

Set up gateways to securely connect networks from different security levels.

Network securityNetwork segmentation +1

View details →

ISM-0629 🛡️ ASD Information Security Manual (ISM)

Manage Gateways Between Different Security Domains

Secure shared network components by assigning management to higher security system admins or a trusted third party.

Management responsibilityNetwork security +1

View details →

ISM-0631 🛡️ ASD Information Security Manual (ISM)

Restrict Data Flows with Authorised Gateways

Gateways should block any data transfers not specifically approved.

Network securityAccess control +1

View details →

ISM-0634 🛡️ ASD Information Security Manual (ISM)

Central Logging for Gateway Security Events

Log gateway events and alerts to monitor data flows and detect intrusion attempts.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-0635 🛡️ ASD Information Security Manual (ISM)

Ensure Network Paths are Isolated in CDSs

Systems manage separate and secure network paths for upward and downward data movements to prevent security breaches.

Network segmentationASD Information Security Manual +1

View details →

ISM-0637 🛡️ ASD Information Security Manual (ISM)

Implementing Demilitarised Zones in Gateways

Gateways use demilitarised zones to safely allow outside parties access to organisational services.

Network segmentationFirewalls +1

View details →

ISM-0639 🛡️ ASD Information Security Manual (ISM)

High Assurance Evaluation for Diode Gateways

Ensure diodes for secure data flow in sensitive networks are thoroughly evaluated for high security.

Assurance and auditFirewalls +1

View details →

ISM-0643 🛡️ ASD Information Security Manual (ISM)

Use of Diodes for Unidirectional Gateway Security

Use special devices (diodes) to ensure data flows one way only between networks, enhancing security.

Network securityASD Information Security Manual +1

View details →

ISM-0645 🛡️ ASD Information Security Manual (ISM)

High Assurance Evaluation of Unidirectional Gateways

Ensure diodes used between secure and public networks are highly evaluated for safety.

Assurance and auditASD Information Security Manual +1

View details →

ISM-0649 🛡️ ASD Information Security Manual (ISM)

Filter Gateway Files for Allowed Types

Ensure only permitted file types are imported or exported through gateways.

Web filteringASD Information Security Manual +1

View details →

ISM-0651 🛡️ ASD Information Security Manual (ISM)

Block Malicious or Uninspectable Files

Block files flagged as harmful or that cannot be scanned to prevent threats.

ASD Information Security ManualGovernance +1

View details →

ISM-0652 🛡️ ASD Information Security Manual (ISM)

Quarantine Suspicious Files for Review

Files flagged as risky are held until checked and cleared or blocked.

ASD Information Security ManualGovernance +1

View details →

ISM-0657 🛡️ ASD Information Security Manual (ISM)

Scanning Data for Threats Before Manual Import

Ensure data is checked for viruses and threats before being imported into systems.

ASD Information Security ManualGuidelines for data transfers +1

View details →

ISM-0659 🛡️ ASD Information Security Manual (ISM)

Filtering Content of Gateway and CDS Files

Files passing through gateways or security systems are checked for unwanted or harmful content.

ASD Information Security ManualGovernance +1

View details →

ISM-0660 🛡️ ASD Information Security Manual (ISM)

Monthly Verification of Data Transfer Logs for SECRET Systems

Check logs every month to ensure safe data transfers in top-secret systems.

Logging and monitoringAudit +1

View details →

ISM-0661 🛡️ ASD Information Security Manual (ISM)

User Accountability for Data Transfers

Users are responsible for the data they move between systems.

ASD Information Security ManualGuidelines for data transfers +1

View details →

ISM-0663 🛡️ ASD Information Security Manual (ISM)

Develop and Maintain Data Transfer Procedures

Ensure data transfers are securely conducted with proper procedures in place.

ASD Information Security ManualGuidelines for data transfers +1

View details →

ISM-0664 🛡️ ASD Information Security Manual (ISM)

Authorisation of Secret Data Exports

Ensure data from high-security systems is checked and approved before export.

ASD Information Security ManualGuidelines for data transfers +1

View details →

ISM-0665 🛡️ ASD Information Security Manual (ISM)

Verification Required for Exporting Secret Data

Only verified and authorised people or services can handle SECRET or TOP SECRET data exports.

ASD Information Security ManualGuidelines for data transfers +1

View details →

ISM-0669 🛡️ ASD Information Security Manual (ISM)

Security Measures for Manual Data Export

Check signatures and keywords when exporting data at SECRET or TOP SECRET levels.

AuditASD Information Security Manual +1

View details →

ISM-0670 🛡️ ASD Information Security Manual (ISM)

Central Logging of CDS Security Events

Ensure all key security events of Cross Domain Solutions are logged centrally for monitoring.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-0675 🛡️ ASD Information Security Manual (ISM)

Ensure Data Exports are Digitally Signed

Data from SECRET and TOP SECRET systems must be signed by a trusted source before export.

ASD Information Security ManualGuidelines for data transfers +1

View details →

ISM-0677 🛡️ ASD Information Security Manual (ISM)

Ensure File Integrity Through Signature Validation

Files with digital signatures or checksums must be verified at system boundaries to ensure integrity.

ASD Information Security ManualGovernance +1

View details →

ISM-0682 🛡️ ASD Information Security Manual (ISM)

Disable Bluetooth on SECRET/TS Mobile Devices

Bluetooth must be turned off on mobile devices with SECRET or TOP SECRET information to prevent data leaks.

ASD Information Security ManualGuidelines for enterprise mobility +1

View details →

ISM-0687 🛡️ ASD Information Security Manual (ISM)

Use Approved Platforms for Secure Mobile Access

Use only ASD-approved mobile platforms for accessing SECRET or TOP SECRET data.

ASD Information Security ManualGovernance +1

View details →

ISM-0694 🛡️ ASD Information Security Manual (ISM)

Restrict Access of Private Devices to Secret Systems

Private devices must not access data or systems classified as SECRET or TOP SECRET.

ASD Information Security ManualAccess control +1

View details →

ISM-0701 🛡️ ASD Information Security Manual (ISM)

CISO Management of Cyber Security Personnel

The Chief Information Security Officer (CISO) manages cyber security staff in the organisation.

Management responsibilityRoles and responsibilities +1

View details →

ISM-0702 🛡️ ASD Information Security Manual (ISM)

Using Cryptographic Sanitisation on Mobile Devices

Ensures cryptographic keys are erased on SECRET or TOP SECRET devices in emergencies.

CryptographyUser devices +1

View details →

ISM-0705 🛡️ ASD Information Security Manual (ISM)

Disable Split Tunnelling for VPN Connections

Ensure that devices accessing the organisation's network through VPN do not use split tunnelling for security.

Network securityASD Information Security Manual +1

View details →

ISM-0714 🛡️ ASD Information Security Manual (ISM)

Appointment of CISO for Cyber Security Leadership

Ensure a CISO is appointed to lead and guide the organisation's cyber security efforts.

Policy, rules and standards complianceASD Information Security Manual +1

View details →

ISM-0717 🛡️ ASD Information Security Manual (ISM)

CISO Oversight of Cyber Security Personnel

The CISO is in charge of managing the organisation's cyber security staff.

ASD Information Security ManualGuidelines for cyber security roles +1

View details →

ISM-0718 🛡️ ASD Information Security Manual (ISM)

CISO Reporting to Board on Cyber Security

The CISO must regularly update the board or executive committee on cyber security issues.

GovernanceManagement responsibility +1

View details →

ISM-0720 🛡️ ASD Information Security Manual (ISM)

Develop and Maintain a Cyber Security Communication Strategy

The CISO creates and updates a strategy to share the organisation's cyber security goals effectively.

Information sharingManagement responsibility +1

View details →

ISM-0724 🛡️ ASD Information Security Manual (ISM)

Implement Cyber Security Metrics and KPIs

The CISO sets up metrics and indicators to measure and track cyber security performance in the organisation.

Logging and monitoringGovernance +1

View details →

ISM-0725 🛡️ ASD Information Security Manual (ISM)

Coordinate Cyber Security Steering Committees

The CISO ensures cyber security and business strategies align by holding regular meetings with key executives.

GovernanceRoles and responsibilities +1

View details →

ISM-0726 🛡️ ASD Information Security Manual (ISM)

Coordinate Security Risk Management Activities

The CISO ensures business and security teams work together effectively on managing security risks.

GovernanceInformation sharing +1

View details →

ISM-0731 🛡️ ASD Information Security Manual (ISM)

CISO Oversight of Cyber Supply Chain Risks

The CISO is responsible for managing risks in their organisation's cyber supply chain.

GovernanceManagement responsibility +1

View details →

ISM-0732 🛡️ ASD Information Security Manual (ISM)

Manage and Allocate Cyber Security Budget

The CISO is responsible for handling the organisation's dedicated cyber security funds.

Management responsibilityGovernance +1

View details →

ISM-0733 🛡️ ASD Information Security Manual (ISM)

Ensure CISO Awareness of Cyber Incidents

The CISO should be informed about all cyber security incidents in the organisation.

Roles and responsibilitiesIncident management +1

View details →

ISM-0734 🛡️ ASD Information Security Manual (ISM)

CISO Role in Disaster Recovery Planning

The CISO helps to ensure recovery plans are in place to maintain essential services during a disaster.

Roles and responsibilitiesBusiness continuity +1

View details →

ISM-0735 🛡️ ASD Information Security Manual (ISM)

Secure Facilities for Classified Systems

Classified systems are kept in secure locations fitting their classification level.

Secure facilitiesSecure areas +1

View details →

ISM-0810 🛡️ ASD Information Security Manual (ISM)

Secure Facilities Based on System Classification

Ensure classified systems are in facilities suitable for their security needs.

Physical securitySecure facilities +1

View details →

ISM-0813 🛡️ ASD Information Security Manual (ISM)

Ensure Secure Access to Critical Infrastructure

Make sure rooms with servers and security equipment are always locked or secured.

Physical securitySecure facilities +1

View details →

ISM-0817 🛡️ ASD Information Security Manual (ISM)

Reporting Suspicious Online Contact Awareness

Staff learn to recognise and report suspicious online contact.

Incident managementASD Information Security Manual +1

View details →

ISM-0820 🛡️ ASD Information Security Manual (ISM)

Prevent Posting Work Info to Unauthorised Services

Employees should avoid sharing work details on websites not approved by the organisation.

ASD Information Security ManualGovernance +1

View details →

ISM-0821 🛡️ ASD Information Security Manual (ISM)

Understanding Risks of Sharing Personal Information Online

Staff should be aware of online privacy risks and use settings to control who sees their personal info.

ASD Information Security ManualGovernance +1

View details →

ISM-0824 🛡️ ASD Information Security Manual (ISM)

Avoid Using Unauthorised Online File Services

Staff should not use online services for files unless approved to avoid security risks.

Cloud securityASD Information Security Manual +1

View details →

ISM-0829 🛡️ ASD Information Security Manual (ISM)

Detect Unauthorised RF Devices in Secure Areas

Use security measures to find and handle unauthorised RF devices in secure zones.

Physical securityASD Information Security Manual +1

View details →

ISM-0831 🛡️ ASD Information Security Manual (ISM)

Ensure Proper Handling of Sensitive Media

Handle media carefully based on its sensitivity to keep information safe.

ASD Information Security ManualGovernance +1

View details →

ISM-0835 🛡️ ASD Information Security Manual (ISM)

Classification Retention of Sanitised TOP SECRET Volatile Media

Even after sanitisation, some volatile media retain their TOP SECRET classification depending on data storage duration and repetition.

ASD Information Security ManualGovernance +1

View details →

ISM-0836 🛡️ ASD Information Security Manual (ISM)

Overwriting EEPROM for Complete Data Sanitisation

Erase EEPROM data by overwriting it with random data and checking it to ensure it's properly wiped.

ASD Information Security ManualGovernance +1

View details →

ISM-0839 🛡️ ASD Information Security Manual (ISM)

Prohibit Outsourcing of Media Destruction

Do not allow external companies to destroy media with sensitive data.

ASD Information Security ManualGovernance +1

View details →

ISM-0840 🛡️ ASD Information Security Manual (ISM)

Certified Services for Outsourced Media Destruction

Use certified services for destroying non-accountable material to ensure security and compliance with ASIO guidelines.

ComplianceASD Information Security Manual +1

View details →

ISM-0843 🛡️ ASD Information Security Manual (ISM)

Ensure Workstation Security with Application Control

Application control is used to secure workstations by managing which programs can run.

ML1 AuditASD Information Security Manual +1

View details →

ISM-0846 🛡️ ASD Information Security Manual (ISM)

Application Control Restrictions for Users

Users can't avoid application control except for administrators and emergency accounts.

ASD Information Security ManualGovernance +1

View details →

ISM-0853 🛡️ ASD Information Security Manual (ISM)

Automatic Termination of Inactive User Sessions

User sessions are ended and computers rebooted daily and after inactivity to enhance security.

ASD Information Security ManualGovernance +1

View details →

ISM-0854 🛡️ ASD Information Security Manual (ISM)

Access Restrictions for AUSTEO and AGAO Data

AUSTEO and AGAO data is only accessible via government-controlled systems within authorised facilities.

ASD Information Security ManualAccess control +1

View details →

ISM-0861 🛡️ ASD Information Security Manual (ISM)

Enable DKIM Signing for Organisational Emails

Ensure emails from your organisation's domains use DKIM to verify authenticity and prevent forgery.

ASD Information Security ManualGovernance +1

View details →

ISM-0863 🛡️ ASD Information Security Manual (ISM)

Prevent Installation of Unapproved Mobile Apps

Mobile devices block users from installing apps that are not approved by the organisation.

ASD Information Security ManualGovernance +1

View details →

ISM-0864 🛡️ ASD Information Security Manual (ISM)

Prevent Modifications to Security Settings on Mobile Devices

Mobile devices ensure users cannot change or disable security features once set up.

ASD Information Security ManualGovernance +1

View details →

ISM-0866 🛡️ ASD Information Security Manual (ISM)

Ensure Privacy While Viewing Data in Public

Don't look at sensitive data on mobile devices in public unless you can shield your screen from others.

ASD Information Security ManualGuidelines for enterprise mobility +1

View details →

ISM-0869 🛡️ ASD Information Security Manual (ISM)

Encrypting Storage on Mobile Devices

Ensure all mobile device storage and removable media are encrypted for security.

ASD Information Security ManualGovernance +1

View details →

ISM-0870 🛡️ ASD Information Security Manual (ISM)

Secure Storage and Handling of Mobile Devices

Ensure mobile devices are secure when not in use to prevent unauthorized access.

ASD Information Security ManualGuidelines for enterprise mobility +1

View details →

ISM-0871 🛡️ ASD Information Security Manual (ISM)

Supervise Mobile Devices During Active Use

Ensure mobile devices are watched carefully whenever they are in use to avoid loss or theft.

Physical securityASD Information Security Manual +1

View details →

ISM-0874 🛡️ ASD Information Security Manual (ISM)

Use VPNs for Internet Access on Mobile and Computers

Mobile devices and computers should use a VPN to connect to the internet to enhance security.

ASD Information Security ManualGuidelines for enterprise mobility +1

View details →

ISM-0888 🛡️ ASD Information Security Manual (ISM)

Annual Review of Cyber Security Documentation

Cyber security documents are checked yearly to ensure they are up-to-date.

ComplianceAudit +1

View details →

ISM-0912 🛡️ ASD Information Security Manual (ISM)

Establish and Manage System Configuration Changes

Ensure systems have a plan for managing changes, including approvals and notifications for both routine and urgent updates.

ASD Information Security ManualGovernance +1

View details →

ISM-0917 🛡️ ASD Information Security Manual (ISM)

Procedures for Handling Malicious Code Infections

Systems with malware are isolated, scanned, cleansed, or restored to stop the infection.

Incident managementASD Information Security Manual +1

View details →

ISM-0926 🛡️ ASD Information Security Manual (ISM)

Ensure Cables Are Not Salmon Pink or Red

Do not use salmon pink or red for non-classified, sensitive, or protected cables.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-0931 🛡️ ASD Information Security Manual (ISM)

Off-hook Audio Protection Using Push-to-Talk Devices

In SECRET and TOP SECRET areas, special handsets or headsets are used to prevent unintended audio transmission.

ASD Information Security ManualGuidelines for communications systems +1

View details →

ISM-0938 🛡️ ASD Information Security Manual (ISM)

Select Secure-by-Design Committed Vendors

Choose vendors who prioritise secure design and development in their applications.

Supplier managementASD Information Security Manual +1

View details →

ISM-0947 🛡️ ASD Information Security Manual (ISM)

Sanitise Media After Data Transfers Between Domains

Clean rewriteable media after transferring data between systems of different security levels.

ASD Information Security ManualGovernance +1

View details →

ISM-0955 🛡️ ASD Information Security Manual (ISM)

Implementing Application Control Measures

Ensure applications are controlled using secure hashing, valid certificates, or designated paths.

ASD Information Security ManualGovernance +1

View details →

ISM-0958 🛡️ ASD Information Security Manual (ISM)

Implement Domain Name Allow and Block Lists

Create a list of approved or blocked domains for secure web traffic management.

ASD Information Security ManualGuidelines for gateways +1

View details →

ISM-0961 🛡️ ASD Information Security Manual (ISM)

Restrict Active Content with Web Filters

Web filters block active content from unapproved websites.

ASD Information Security ManualGuidelines for gateways +1

View details →

ISM-0963 🛡️ ASD Information Security Manual (ISM)

Implementing Web Content Filters for Safety

Web filters help block harmful content from the internet.

ASD Information Security ManualGuidelines for gateways +1

View details →

ISM-0971 🛡️ ASD Information Security Manual (ISM)

Use OWASP Standards in Web Application Development

Developers must use OWASP standards for building secure web applications.

ASD Information Security ManualGovernance +1

View details →

ISM-0974 🛡️ ASD Information Security Manual (ISM)

Implement Multi-factor Authentication for User Access

Unprivileged system users must use multi-factor authentication to log in to enhance security.

ML2 ASD Information Security ManualGovernance +1

View details →

ISM-0988 🛡️ ASD Information Security Manual (ISM)

Ensure Accurate Time Source for Event Logs

Logs must use a reliable time source for accuracy and consistency.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-0994 🛡️ ASD Information Security Manual (ISM)

Use ECDH for Secure Key Exchanges

ECDH is preferred over DH for secure data exchanges.

ASD Information Security ManualGovernance +1

View details →

ISM-0998 🛡️ ASD Information Security Manual (ISM)

Using Integrity Algorithms for IPsec Connections

Use specific algorithms for authenticating IPsec connections, preferring none if AES-GCM is used.

ASD Information Security ManualGovernance +1

View details →

ISM-0999 🛡️ ASD Information Security Manual (ISM)

Use DH or ECDH for Secure Key Establishment

For IPsec connections, use DH/ECDH methods to securely establish keys with specific group sizes for better security.

ASD Information Security ManualGovernance +1

View details →

ISM-1000 🛡️ ASD Information Security Manual (ISM)

Utilising Perfect Forward Secrecy for IPsec

Use PFS to ensure past IPsec keys can't be used if current ones are compromised.

ASD Information Security ManualGovernance +1

View details →

ISM-1006 🛡️ ASD Information Security Manual (ISM)

Prevent Unauthorised Access to Network Traffic

Security measures are in place to ensure that only authorised users can access network management systems.

ASD Information Security ManualGovernance +1

View details →

ISM-1013 🛡️ ASD Information Security Manual (ISM)

Limit Wireless Range with RF Shielding

RF shielding is used to control the wireless signal range and keep it limited to an organisation's secure area.

ASD Information Security ManualGovernance +1

View details →

ISM-1014 🛡️ ASD Information Security Manual (ISM)

Implement Individual Logins for Secure IP Phone Use

Ensure each user has a unique login when using IP phones for secret conversations.

ASD Information Security ManualGovernance +1

View details →

ISM-1019 🛡️ ASD Information Security Manual (ISM)

Develop a Denial of Service Response Plan

Create and maintain a plan to handle service disruptions for video calls and IP telephony.

Incident managementASD Information Security Manual +1

View details →

ISM-1023 🛡️ ASD Information Security Manual (ISM)

Notify Parties of Blocked Emails

Notify people if their sent or received emails are blocked due to marking issues.

Incident managementASD Information Security Manual +1

View details →

ISM-1024 🛡️ ASD Information Security Manual (ISM)

Verify Senders for Email Failure Notifications

Only verified senders get notified if their email cannot be delivered.

ASD Information Security ManualGovernance +1

View details →

ISM-1026 🛡️ ASD Information Security Manual (ISM)

Verification of DKIM Signatures on Incoming Emails

Ensure that DKIM signatures on received emails are checked to identify legitimate sources.

ASD Information Security ManualGovernance +1

View details →

ISM-1027 🛡️ ASD Information Security Manual (ISM)

Configure Email Distribution Lists to Preserve DKIM Signatures

Ensure email lists don't invalidate DKIM signatures from external senders.

ASD Information Security ManualGovernance +1

View details →

ISM-1028 🛡️ ASD Information Security Manual (ISM)

Use NIDS/NIPS for Gateway Network Security

Install systems at network gateways to monitor and protect against unauthorised access or threats from other networks.

Incident managementASD Information Security Manual +1

View details →

ISM-1030 🛡️ ASD Information Security Manual (ISM)

Deploy NIDS/NIPS for Gateway Traffic Monitoring

Install and configure systems to detect and alert on unauthorized network traffic past the main firewall.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-1034 🛡️ ASD Information Security Manual (ISM)

Disable Legacy Authentication Methods in Networks

Ensure older and less secure authentication methods are not used to protect network security.

ASD Information Security ManualGovernance +1

View details →

ISM-1036 🛡️ ASD Information Security Manual (ISM)

Locating Multifunction Devices for Oversight

Ensure multifunction devices are in viewable areas to monitor their usage.

Logging and monitoringSecure facilities +1

View details →

ISM-1037 🛡️ ASD Information Security Manual (ISM)

Regular Testing for Security of Gateways

Gateways are tested every six months and after changes to ensure they meet security standards.

ASD Information Security ManualGuidelines for gateways +1

View details →

ISM-1053 🛡️ ASD Information Security Manual (ISM)

Secure Physical Access for Classified Equipment

Ensure physical security for critical equipment based on its classification.

Physical securityASD Information Security Manual +1

View details →

ISM-1055 🛡️ ASD Information Security Manual (ISM)

Disable Insecure LAN Manager Authentication

Systems must disable outdated LAN Manager and NT LAN Manager authentication to enhance security.

ASD Information Security ManualGovernance +1

View details →

ISM-1059 🛡️ ASD Information Security Manual (ISM)

Ensure All Data on Media is Encrypted

All data stored on devices must be secure and not readable to protect it from unauthorized access.

ASD Information Security ManualGovernance +1

View details →

ISM-1065 🛡️ ASD Information Security Manual (ISM)

Reset Device Settings Before Media Sanitisation

Reset hidden and configuration settings on hard drives before erasing them to ensure nothing is overlooked.

ASD Information Security ManualGovernance +1

View details →

ISM-1067 🛡️ ASD Information Security Manual (ISM)

Secure Erase for Non-Volatile Magnetic Media

Use secure erase plus software to fully overwrite data on hard drives, including hidden areas.

ASD Information Security ManualGovernance +1

View details →

ISM-1071 🛡️ ASD Information Security Manual (ISM)

Assign System Ownership for Better Oversight

Every system should have a specific person responsible for managing it.

ASD Information Security ManualGuidelines for cyber security roles +1

View details →

ISM-1073 🛡️ ASD Information Security Manual (ISM)

Ensure Provider Contracts for System Access

Service providers need a contract before accessing or managing your systems.

Supplier managementASD Information Security Manual +1

View details →

ISM-1074 🛡️ ASD Information Security Manual (ISM)

Controlling Access to Critical IT Infrastructure

Ensure keys to server and communication rooms are securely managed.

ASD Information Security ManualPhysical security +1

View details →

ISM-1076 🛡️ ASD Information Security Manual (ISM)

Sanitising Screens with Image Burn-in

To remove screen burn-in, display a solid white image on the screen for a long time.

ASD Information Security ManualGovernance +1

View details →

ISM-1078 🛡️ ASD Information Security Manual (ISM)

Develop and Maintain Telephone System Usage Policy

Create and keep a policy for how phones should be used within the organisation.

Physical securityASD Information Security Manual +1

View details →

ISM-1079 🛡️ ASD Information Security Manual (ISM)

Seek Approval for High Assurance IT Repairs

Get ASD's approval before repairing sensitive IT systems.

ASD Information Security ManualGovernance +1

View details →

ISM-1080 🛡️ ASD Information Security Manual (ISM)

Use Approved Encryption for Data at Rest

Use an approved encryption algorithm to protect stored data from unauthorized access.

ASD Information Security ManualGovernance +1

View details →

ISM-1082 🛡️ ASD Information Security Manual (ISM)

Develop and Maintain Mobile Device Usage Policy

Ensure a policy is in place to guide how mobile devices are used in the organisation.

ASD Information Security ManualGuidelines for enterprise mobility +1

View details →

ISM-1083 🛡️ ASD Information Security Manual (ISM)

Advise Personnel on Mobile Communication Sensitivity

Personnel are informed about what levels of classified communication are allowed on mobile devices.

ASD Information Security ManualGuidelines for enterprise mobility +1

View details →

ISM-1084 🛡️ ASD Information Security Manual (ISM)

Transporting Mobile Devices Securely

If you can't secure a mobile device, it must be carried in a security bag or similar for safe transport.

ASD Information Security ManualGuidelines for enterprise mobility +1

View details →

ISM-1085 🛡️ ASD Information Security Manual (ISM)

Ensure Mobile Devices Encrypt Data Communications

Mobile devices must use encryption when sending sensitive data over public networks.

ASD Information Security ManualGovernance +1

View details →

ISM-1088 🛡️ ASD Information Security Manual (ISM)

Report Potential Compromises of Mobile Devices Overseas

Inform your employer immediately if your mobile device is compromised or shows unusual behaviour while overseas.

Incident managementASD Information Security Manual +1

View details →

ISM-1089 🛡️ ASD Information Security Manual (ISM)

Prevent Lower Email Protective Marking Selection

Email reply or forward tools must not allow reducing security markings from the original.

ASD Information Security ManualGuidelines for email +1

View details →

ISM-1091 🛡️ ASD Information Security Manual (ISM)

Change Keying Material When Compromised

Change encryption keys if they are compromised to maintain security.

ASD Information Security ManualGovernance +1

View details →

ISM-1095 🛡️ ASD Information Security Manual (ISM)

Proper Labelling of Wall Outlet Boxes

Label wall outlet boxes with system, cable, and box identifiers for easy identification.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-1096 🛡️ ASD Information Security Manual (ISM)

Ensure Proper Labelling of Cables for Identification

Label cables on both ends for easy identification and inspection of where they start and end.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-1098 🛡️ ASD Information Security Manual (ISM)

Terminate Cable Systems at Cabinet Boundaries

In TOP SECRET areas, cables connecting to cabinets outside server rooms stop at the cabinet edge.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-1100 🛡️ ASD Information Security Manual (ISM)

Terminating TOP SECRET Cables in Cabinets

TOP SECRET cables must be connected only in designated TOP SECRET cabinets for security purposes.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-1101 🛡️ ASD Information Security Manual (ISM)

Terminate Cabling Closely in Top Secret Areas

In TOP SECRET areas, ensure cables are terminated very close to cabinets for security.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-1102 🛡️ ASD Information Security Manual (ISM)

Terminate Cable Reticulation Close to Cabinet

Ensure cables are ended near cabinets to improve connection and organization.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-1103 🛡️ ASD Information Security Manual (ISM)

Terminate Cables Outside Cabinets in Secure Areas

In top secret areas, cables must end at the cabinet's edge unless in server or communications rooms.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-1105 🛡️ ASD Information Security Manual (ISM)

Ensure Wall Outlets Have Appropriate Cable Security

Wall outlets for SECRET and TOP SECRET should only have cables that match these classifications.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-1107 🛡️ ASD Information Security Manual (ISM)

Colour Restrictions for Wall Outlet Boxes

Wall outlet boxes must not be coloured salmon pink or red to ensure proper classification.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-1109 🛡️ ASD Information Security Manual (ISM)

Ensure Clear Plastic Covers for Wall Outlets

Wall outlet covers must be transparent plastic to visually inspect without obstruction.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-1111 🛡️ ASD Information Security Manual (ISM)

Ensure Fibre-Optic Cables Replace Copper Cables

Use fibre-optic cables instead of copper to improve data security and efficiency in cabling infrastructure.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-1112 🛡️ ASD Information Security Manual (ISM)

Ensure Cables Are Inspectable Every Five Metres

Cables outside TOP SECRET areas should be easy to inspect every five metres for security checks.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-1114 🛡️ ASD Information Security Manual (ISM)

Ensure Separation in Cable Reticulation Systems

Cables and conduits in shared spaces must be visibly separated or partitioned to ensure safety and organisation.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-1115 🛡️ ASD Information Security Manual (ISM)

Ensure Cables Use Conduits in Walls

Ensures cables in walls are protected by running through flexible or plastic conduits.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-1116 🛡️ ASD Information Security Manual (ISM)

Ensure Separation Between Top Secret and Other Cabinets

Ensure there's a visible gap between top secret and other cabinets for security reasons.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-1119 🛡️ ASD Information Security Manual (ISM)

Ensure Cables in TOP SECRET Areas are Inspectable

Cables in highly secure areas must be checked along their entire length for any issues.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-1122 🛡️ ASD Information Security Manual (ISM)

Secure TOP SECRET Cable Wall Exits

Ensure TOP SECRET cables that pass through walls to lower security areas are protected by conduits and sealed.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-1123 🛡️ ASD Information Security Manual (ISM)

Ensure UPS Powers All Top Secret IT Equipment

All Top Secret IT equipment must use power from a board with a UPS to maintain functionality during power outages.

ASD Information Security ManualGuidelines for communications infrastructure

View details →

ISM-1130 🛡️ ASD Information Security Manual (ISM)

Use Enclosed Systems for Shared Facility Cables

Ensure cables in shared buildings are placed in closed pathways to prevent tampering.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-1133 🛡️ ASD Information Security Manual (ISM)

Prevent Installation of TOP SECRET Cables in Shared Walls

In shared buildings, do not place TOP SECRET cables within walls shared with other spaces.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-1137 🛡️ ASD Information Security Manual (ISM)

Contact ASD for Emanation Threat Assessment

Owners must ask ASD to assess security threats for high-security systems in fixed facilities.

ASD Information Security ManualGuidelines for information technology equipment +1

View details →

ISM-1139 🛡️ ASD Information Security Manual (ISM)

Require Latest Version of TLS for Security

Ensure only the latest TLS version is used to secure connections.

ASD Information Security ManualGovernance +1

View details →

ISM-1143 🛡️ ASD Information Security Manual (ISM)

Develop and Maintain Patch Management Procedures

Ensure patches for systems are regularly updated and processes are in place to manage this.

ASD Information Security ManualGovernance +1

View details →

ISM-1145 🛡️ ASD Information Security Manual (ISM)

Apply Privacy Filters to Protect Device Screens

Privacy filters help keep sensitive information on mobile screens private in public spaces.

ASD Information Security ManualGuidelines for enterprise mobility +1

View details →

ISM-1146 🛡️ ASD Information Security Manual (ISM)

Separation of Work and Personal Online Accounts

Keep separate accounts for work and personal use online to enhance security.

Identity & access managementASD Information Security Manual +1

View details →

ISM-1151 🛡️ ASD Information Security Manual (ISM)

Verify Email Authenticity Using SPF

SPF helps confirm if an email really comes from who it claims to, preventing fake emails.

ASD Information Security ManualGovernance +1

View details →

ISM-1157 🛡️ ASD Information Security Manual (ISM)

Use NSA-evaluated Degaussers for Media Destruction

When destroying media, use degaussers approved by the NSA to ensure effectiveness.

ASD Information Security ManualGovernance +1

View details →

ISM-1158 🛡️ ASD Information Security Manual (ISM)

High Assurance Evaluation for Network Diodes

Diodes ensure secure, one-way data flow between secret and other networks.

ASD Information Security ManualGovernance +1

View details →

ISM-1160 🛡️ ASD Information Security Manual (ISM)

Use NSA-evaluated Degaussers for Media Destruction

Only use NSA-approved degaussers to securely erase data from storage media.

ASD Information Security ManualGovernance +1

View details →

ISM-1163 🛡️ ASD Information Security Manual (ISM)

Regular System Vulnerability Scanning and Testing

Systems need regular checks for vulnerabilities, with tests before major updates and annually.

AuditASD Information Security Manual +1

View details →

ISM-1164 🛡️ ASD Information Security Manual (ISM)

Use Clear Plastic for Shared Facility Cabling Covers

In shared spaces, use clear plastic for cables on ceilings, floors, and walls to ensure visibility.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-1171 🛡️ ASD Information Security Manual (ISM)

Block Direct IP Access to Websites

Web filters prevent website access if using an IP address instead of a domain name.

ASD Information Security ManualGuidelines for gateways +1

View details →

ISM-1173 🛡️ ASD Information Security Manual (ISM)

Use Multi-Factor Authentication for Privileged Users

Privileged users must verify their identity using multiple forms of identification to log into systems.

ML2 ASD Information Security ManualGovernance +1

View details →

ISM-1175 🛡️ ASD Information Security Manual (ISM)

Restrict Privileged Users from Internet Access

Privileged accounts can't access the internet or web services unless explicitly allowed.

ML1 ASD Information Security ManualAccess control +1

View details →

ISM-1178 🛡️ ASD Information Security Manual (ISM)

Limit Network Documentation for Third Parties

When sharing network details, only provide what's needed for others to fulfill their contracts.

ContractsASD Information Security Manual +1

View details →

ISM-1181 🛡️ ASD Information Security Manual (ISM)

Segregate Networks by Server Criticality

Networks have separate zones based on the importance of servers, services, and data.

ASD Information Security ManualGovernance +1

View details →

ISM-1182 🛡️ ASD Information Security Manual (ISM)

Implement Network Traffic Control Measures

Restrict network traffic flow to ensure it only supports business needs.

ASD Information Security ManualGovernance +1

View details →

ISM-1183 🛡️ ASD Information Security Manual (ISM)

Implement Hard Fail SPF Records for Email Security

Use a strict SPF record to ensure only authorised servers send emails on behalf of the organisation.

ASD Information Security ManualGovernance +1

View details →

ISM-1186 🛡️ ASD Information Security Manual (ISM)

Ensure IPv6 Network Security Appliances Are Used

Use network security devices that support IPv6 to protect networks using IPv6 or both IPv6 and IPv4.

Supplier managementASD Information Security Manual +1

View details →

ISM-1187 🛡️ ASD Information Security Manual (ISM)

Check Data for Improper Markings Before Export

When exporting data manually, ensure it doesn't have improper protective markings.

ASD Information Security ManualGuidelines for data transfers +1

View details →

ISM-1192 🛡️ ASD Information Security Manual (ISM)

Inspecting and Filtering Data with Gateways

Gateways check and filter data to ensure only safe data passes through the network.

ASD Information Security ManualGuidelines for gateways +1

View details →

ISM-1195 🛡️ ASD Information Security Manual (ISM)

Enforce Policy with Evaluated Mobile Device Management

Use certified management solutions to ensure mobile devices follow security policies.

ASD Information Security ManualGovernance +1

View details →

ISM-1196 🛡️ ASD Information Security Manual (ISM)

Keep Mobile Devices Undiscoverable via Bluetooth

Bluetooth on mobile devices is only discoverable during pairing to protect sensitive information.

ASD Information Security ManualGuidelines for enterprise mobility +1

View details →

ISM-1198 🛡️ ASD Information Security Manual (ISM)

Secure Bluetooth Pairing for Mobile Devices

Ensure Bluetooth connections for devices are only made with intended, authorised equipment.

ASD Information Security ManualGuidelines for enterprise mobility +1

View details →

ISM-1199 🛡️ ASD Information Security Manual (ISM)

Remove Unnecessary Bluetooth Pairings on Devices

Remove Bluetooth pairings on certain mobile devices when they are no longer needed.

ASD Information Security ManualGuidelines for enterprise mobility +1

View details →

ISM-1200 🛡️ ASD Information Security Manual (ISM)

Secure Bluetooth Pairing for Mobile Devices

Use secure methods when pairing Bluetooth on sensitive mobile devices, like numeric comparison.

ASD Information Security ManualGuidelines for enterprise mobility +1

View details →

ISM-1203 🛡️ ASD Information Security Manual (ISM)

Risk Assessment for System Security

System owners work with authorising officers to assess threats and risks for each system.

ASD Information Security ManualGuidelines for cyber security roles +1

View details →

ISM-1211 🛡️ ASD Information Security Manual (ISM)

System Admin Activities Follow Change Management Plan

Admins follow a defined plan for system changes to ensure proper management.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-1213 🛡️ ASD Information Security Manual (ISM)

Analyse Network Traffic Post-Intrusion Remediation

Capture and analyse network traffic for a week to ensure hackers are removed after an intrusion.

Logging and monitoringIncident management +1

View details →

ISM-1216 🛡️ ASD Information Security Manual (ISM)

Ensure Correct Labelling of Non-conformant Cables

Non-standard cable colours for SECRET and TOP SECRET must be labelled correctly at inspection points.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-1217 🛡️ ASD Information Security Manual (ISM)

Remove Identifying Labels from IT Equipment Before Disposal

Before throwing away IT equipment, remove any labels that show ownership or use.

ASD Information Security ManualGovernance +1

View details →

ISM-1218 🛡️ ASD Information Security Manual (ISM)

Sanitise Overseas IT Equipment Handling Sensitive Data

Overseas IT equipment with sensitive data must be sanitised where it is located.

ASD Information Security ManualGovernance +1

View details →

ISM-1219 🛡️ ASD Information Security Manual (ISM)

Inspect and Destroy MFD Print Drums for Toner

Check printers for leftover toner on drums or rollers and destroy them if it can't be cleaned.

ASD Information Security ManualGovernance +1

View details →

ISM-1220 🛡️ ASD Information Security Manual (ISM)

Inspect and Destroy Retained Images on Printer Platens

Check printer surfaces, and destroy them if they have any leftover text or images.

ASD Information Security ManualGovernance +1

View details →

ISM-1221 🛡️ ASD Information Security Manual (ISM)

Processes for Sanitising Memory in Network Devices

Network devices should be cleared of data using specific steps to ensure memory is secure.

ASD Information Security ManualGovernance +1

View details →

ISM-1222 🛡️ ASD Information Security Manual (ISM)

Destroy Unsanitised Televisions and Monitors

Televisions and monitors that can't be cleaned of data are to be physically destroyed.

ASD Information Security ManualGovernance +1

View details →

ISM-1223 🛡️ ASD Information Security Manual (ISM)

Methods for Sanitising Network Device Memory

Network device memory is cleaned by following specific guidance or doing a reset and reinstalling firmware.

ASD Information Security ManualGovernance +1

View details →

ISM-1227 🛡️ ASD Information Security Manual (ISM)

Randomly Generate User Account Credentials

User account passwords must be created randomly to enhance security.

ASD Information Security ManualGovernance +1

View details →

ISM-1228 🛡️ ASD Information Security Manual (ISM)

Analyse Cyber Security Events Promptly

Timely analysis of security events to spot incidents.

ML2 Logging and monitoringASD Information Security Manual +1

View details →

ISM-1233 🛡️ ASD Information Security Manual (ISM)

Use IKE Version 2 for IPsec Key Exchange

Ensure secure IPsec connection by using IKE version 2 for exchanging keys.

ASD Information Security ManualGovernance +1

View details →

ISM-1234 🛡️ ASD Information Security Manual (ISM)

Protect Email Systems with Content Filtering

Checks emails for harmful content to keep systems safe.

ASD Information Security ManualGovernance +1

View details →

ISM-1235 🛡️ ASD Information Security Manual (ISM)

Restrict Add-ons to Approved Set in Applications

Only use organisation-approved add-ons for applications to ensure security.

ASD Information Security ManualGovernance +1

View details →

ISM-1236 🛡️ ASD Information Security Manual (ISM)

Blocking Malicious and Anonymous Domain Names

Web filters block known harmful domains and those registered anonymously or for free.

ASD Information Security ManualGuidelines for gateways +1

View details →

ISM-1237 🛡️ ASD Information Security Manual (ISM)

Implement Web Content Filters for Outbound Traffic

Use web filters on outgoing internet traffic to block unsuitable content where necessary.

ASD Information Security ManualGuidelines for gateways +1

View details →

ISM-1238 🛡️ ASD Information Security Manual (ISM)

Incorporate Threat Modelling in Software Development

Use threat modelling to identify potential risks when developing software.

ASD Information Security ManualGovernance +1

View details →

ISM-1239 🛡️ ASD Information Security Manual (ISM)

Ensure Use of Robust Web Application Frameworks

Develop web apps using strong frameworks to enhance security.

ASD Information Security ManualGovernance +1

View details →

ISM-1240 🛡️ ASD Information Security Manual (ISM)

Ensure Input Validation and Sanitisation for Internet Data

All internet-received inputs for software must be validated and cleaned to prevent security issues.

ASD Information Security ManualGovernance +1

View details →

ISM-1241 🛡️ ASD Information Security Manual (ISM)

Ensuring Secure Web Application Output Encoding

Web applications must correctly encode all their outputs to prevent security risks.

ASD Information Security ManualGovernance +1

View details →

ISM-1243 🛡️ ASD Information Security Manual (ISM)

Develop and Maintain a Database Register

Create and regularly check a list of databases to keep them organised and up-to-date.

ASD Information Security ManualGovernance +1

View details →

ISM-1245 🛡️ ASD Information Security Manual (ISM)

Clean Up Temporary Files Post-Installation

Delete temporary files and logs after server applications are installed to maintain security.

ASD Information Security ManualGovernance +1

View details →

ISM-1246 🛡️ ASD Information Security Manual (ISM)

Apply Strict Server Application Hardening Guidelines

Servers are secured using the most restrictive guidance from ASD and vendors to protect against vulnerabilities.

ASD Information Security ManualGovernance +1

View details →

ISM-1247 🛡️ ASD Information Security Manual (ISM)

Disable or Remove Unneeded Server Features

Remove unnecessary accounts and features from servers to enhance security.

ASD Information Security ManualGovernance +1

View details →

ISM-1249 🛡️ ASD Information Security Manual (ISM)

Limit Server Application User Privileges

Server apps must run separately with only the necessary permissions to operate.

ASD Information Security ManualGovernance +1

View details →

ISM-1250 🛡️ ASD Information Security Manual (ISM)

Limit Server Application User Account Privileges

Server applications have restricted user account access to the server's file system.

ASD Information Security ManualGovernance +1

View details →

ISM-1255 🛡️ ASD Information Security Manual (ISM)

Restrict Database User Access Based on Duties

Users can only access or change database information if it's part of their job.

ASD Information Security ManualGovernance +1

View details →

ISM-1256 🛡️ ASD Information Security Manual (ISM)

Implement File-Based Access Controls for Databases

Use file permissions to safeguard database files from unauthorised access.

ASD Information Security ManualGovernance +1

View details →

ISM-1260 🛡️ ASD Information Security Manual (ISM)

Secure Server Applications by Changing Default Credentials

Change or remove default user accounts and passwords in server apps to enhance security from the start.

ASD Information Security ManualGovernance +1

View details →

ISM-1263 🛡️ ASD Information Security Manual (ISM)

Enforce Unique Accounts for Server Administration

Administrators must use unique accounts to manage each server application.

ASD Information Security ManualAccess control +1

View details →

ISM-1268 🛡️ ASD Information Security Manual (ISM)

Enforce Need-to-Know Access in Databases

Only authorised users can access database contents by using specific privileges, roles, and techniques to protect the data.

ASD Information Security ManualGovernance +1

View details →

ISM-1269 🛡️ ASD Information Security Manual (ISM)

Ensure Databases and Web Servers are Separated

Databases and web servers should be kept separate to enhance security.

ASD Information Security ManualGovernance +1

View details →

ISM-1270 🛡️ ASD Information Security Manual (ISM)

Separate Network Segments for Database Servers

Databases should be on a different network than user computers to enhance security.

ASD Information Security ManualGovernance +1

View details →

ISM-1271 🛡️ ASD Information Security Manual (ISM)

Restrict Network Access to Database Servers

Database server communications are limited to necessary network resources only.

ASD Information Security ManualGovernance +1

View details →

ISM-1272 🛡️ ASD Information Security Manual (ISM)

Restrict Database Server Network Access to Localhost

Ensure databases only listen on the local machine if remote connections are not needed, enhancing security.

ASD Information Security ManualGovernance +1

View details →

ISM-1273 🛡️ ASD Information Security Manual (ISM)

Segregate Environments for Database Servers

Keep development and production database servers separate to ensure secure operations.

ASD Information Security ManualGovernance +1

View details →

ISM-1274 🛡️ ASD Information Security Manual (ISM)

Ensure Non-Production Databases Match Production Security

Production data can only be used in non-production areas if they are secured equally as well.

ASD Information Security ManualGovernance +1

View details →

ISM-1275 🛡️ ASD Information Security Manual (ISM)

Ensure Secure Database Queries in Software

Checks ensure database queries from software are legitimate and correctly formatted.

ASD Information Security ManualGovernance +1

View details →

ISM-1276 🛡️ ASD Information Security Manual (ISM)

Use Safe Database Query Methods

Software should use parameterised queries or stored procedures to safely access databases.

ASD Information Security ManualGovernance +1

View details →

ISM-1277 🛡️ ASD Information Security Manual (ISM)

Encrypt Data Between Database and Web Servers

Ensure data between database and web servers is kept secure by encrypting it.

ASD Information Security ManualGovernance +1

View details →

ISM-1278 🛡️ ASD Information Security Manual (ISM)

Minimise Database Error Information in Software

Software should reveal minimal database structure details in error messages.

ASD Information Security ManualGovernance +1

View details →

ISM-1284 🛡️ ASD Information Security Manual (ISM)

Ensure Content Validation for Gateway Files

Check files coming in and out of gateways to ensure they meet security standards.

ASD Information Security ManualGovernance +1

View details →

ISM-1286 🛡️ ASD Information Security Manual (ISM)

Ensure Content Conversion at Gateways

Files going through gateways must be converted to ensure security and compatibility.

ASD Information Security ManualGovernance +1

View details →

ISM-1287 🛡️ ASD Information Security Manual (ISM)

Ensure Gateway and CDS File Content Sanitisation

Files passing through gateways or CDSs are cleaned to remove harmful content.

ASD Information Security ManualGovernance +1

View details →

ISM-1288 🛡️ ASD Information Security Manual (ISM)

Antivirus Scanning of Gateway Files

Files going through gateways are checked with several antivirus programs for safety.

ASD Information Security ManualGovernance +1

View details →

ISM-1289 🛡️ ASD Information Security Manual (ISM)

Ensure Content Filtering of Archive Files at Gateways

Files in archive formats must be opened for security checks when they pass through security gateways.

ASD Information Security ManualGovernance +1

View details →

ISM-1290 🛡️ ASD Information Security Manual (ISM)

Controlled Unpacking of Archive Files for Filtering

Ensure unpacked archive files do not disrupt system filters or cause unavailability.

ASD Information Security ManualGovernance +1

View details →

ISM-1293 🛡️ ASD Information Security Manual (ISM)

Decryption of Files for Content Filtering

Files are decrypted at gateways to ensure they're safe before passing through.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-1294 🛡️ ASD Information Security Manual (ISM)

Partial Monthly Verification of Data Transfer Logs

Data transfer logs are checked monthly to ensure some accuracy and compliance.

ComplianceLogging and monitoring +1

View details →

ISM-1296 🛡️ ASD Information Security Manual (ISM)

Protect Network Devices in Public Areas

Ensure network devices in public areas are secure from damage and unauthorised access.

Physical securityASD Information Security Manual +1

View details →

ISM-1297 🛡️ ASD Information Security Manual (ISM)

Change Default Credentials on Network Devices

Ensure default accounts on network devices are changed or disabled for security.

ASD Information Security ManualGuidelines for enterprise mobility +1

View details →

ISM-1298 🛡️ ASD Information Security Manual (ISM)

Advise Personnel on Overseas Mobile Device Security

Inform staff about privacy and security risks when taking mobile devices abroad.

ASD Information Security ManualGuidelines for enterprise mobility +1

View details →

ISM-1299 🛡️ ASD Information Security Manual (ISM)

Personnel Awareness for Secure Mobile Device Usage

This guideline advises on secure mobile device use to prevent data theft or compromise.

ASD Information Security ManualGuidelines for enterprise mobility +1

View details →

ISM-1300 🛡️ ASD Information Security Manual (ISM)

Mobile Device Security After Overseas Travel

Upon returning from overseas, clean your devices, reset any lost credentials, and report any security concerns.

Incident managementASD Information Security Manual +1

View details →

ISM-1304 🛡️ ASD Information Security Manual (ISM)

Secure Network Devices by Changing Default Credentials

During setup, change or remove default login details for network devices to enhance security.

ASD Information Security ManualGovernance +1

View details →

ISM-1311 🛡️ ASD Information Security Manual (ISM)

Prevent Use of Insecure SNMP Versions on Networks

Avoid using SNMP versions 1 and 2, as they are insecure for network management.

ASD Information Security ManualGovernance +1

View details →

ISM-1312 🛡️ ASD Information Security Manual (ISM)

Changing Default SNMP Community Strings on Devices

To enhance security, change default SNMP passwords and disable write access on network devices.

ASD Information Security ManualGovernance +1

View details →

ISM-1314 🛡️ ASD Information Security Manual (ISM)

Ensure Wireless Devices are Wi-Fi Alliance Certified

All wireless devices must have Wi-Fi Alliance certification for security standards.

ASD Information Security ManualGovernance +1

View details →

ISM-1315 🛡️ ASD Information Security Manual (ISM)

Disable Wireless Network Administrative Interfaces

Ensure that administrative access to wireless routers cannot be done through wireless connections.

ASD Information Security ManualGovernance +1

View details →

ISM-1316 🛡️ ASD Information Security Manual (ISM)

Ensure Default Wireless SSIDs Are Changed

Change default wireless network names to enhance security.

ASD Information Security ManualGovernance +1

View details →

ISM-1317 🛡️ ASD Information Security Manual (ISM)

Secure Naming of Non-Public Wireless Networks

Ensure non-public WiFi network names (SSIDs) don't reveal info about the organisation or location.

ASD Information Security ManualGovernance +1

View details →

ISM-1318 🛡️ ASD Information Security Manual (ISM)

Prevent SSID Broadcasting on Access Points

Wireless networks should have their SSID broadcasting disabled for security.

ASD Information Security ManualGovernance +1

View details →

ISM-1319 🛡️ ASD Information Security Manual (ISM)

Avoid Static IP Addressing on Wireless Networks

Don't use fixed IP addresses for devices on wireless networks to enhance security.

ASD Information Security ManualGovernance +1

View details →

ISM-1320 🛡️ ASD Information Security Manual (ISM)

Avoid Using MAC Filtering for Wireless Access Control

Do not use MAC address filtering to control devices connecting to your wireless network.

ASD Information Security ManualGovernance +1

View details →

ISM-1321 🛡️ ASD Information Security Manual (ISM)

Implement EAP-TLS for Secure Wireless Authentication

Use secure EAP-TLS with certificates to authenticate devices and disable other methods.

ASD Information Security ManualGovernance +1

View details →

ISM-1322 🛡️ ASD Information Security Manual (ISM)

Assessing 802.1X Components in Wireless Networks

Use evaluated devices and servers for secure wireless network authentication.

ASD Information Security ManualGovernance +1

View details →

ISM-1323 🛡️ ASD Information Security Manual (ISM)

Requiring Certificates for Wireless Network Access

Devices and users must have certificates to connect to wireless networks.

ASD Information Security ManualGovernance +1

View details →

ISM-1324 🛡️ ASD Information Security Manual (ISM)

Certificate Generation for Secure Authentication

Certificates must be created using approved secure tools to verify identities.

ASD Information Security ManualGovernance +1

View details →

ISM-1327 🛡️ ASD Information Security Manual (ISM)

Secure Certificates for Network Authentication

Certificates must be secured using access controls, encryption, and authentication to prevent unauthorised access.

ASD Information Security ManualGovernance +1

View details →

ISM-1330 🛡️ ASD Information Security Manual (ISM)

Limit PMK Caching Duration on Wireless Networks

Ensure that stored authentication data for networks isn't kept for more than a day.

ASD Information Security ManualGovernance +1

View details →

ISM-1332 🛡️ ASD Information Security Manual (ISM)

Ensure Wireless Traffic is Secure with WPA3-Enterprise

Use WPA3-Enterprise 192-bit mode to secure information transferred over wireless networks.

ASD Information Security ManualGovernance +1

View details →

ISM-1334 🛡️ ASD Information Security Manual (ISM)

Ensure Frequency Separation in Wireless Networks

Wireless networks should use different frequencies to avoid interference with each other.

ASD Information Security ManualGovernance +1

View details →

ISM-1335 🛡️ ASD Information Security Manual (ISM)

Enabling 802.11w to Protect Wireless Management Frames

Ensure wireless networks use the 802.11w standard to secure management frames from tampering.

ASD Information Security ManualGovernance +1

View details →

ISM-1338 🛡️ ASD Information Security Manual (ISM)

Use Lower-Powered Wireless Access Points for Coverage

Deploy many low-power wireless access points to cover an area instead of few high-power ones.

ASD Information Security ManualGovernance +1

View details →

ISM-1341 🛡️ ASD Information Security Manual (ISM)

Implement HIPS or EDR on Workstations

Ensure your computers are protected by constantly monitoring for threats.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-1359 🛡️ ASD Information Security Manual (ISM)

Establish and Maintain Removable Media Policy

Organisations must create and uphold a policy for using removable media safely.

ASD Information Security ManualGovernance +1

View details →

ISM-1361 🛡️ ASD Information Security Manual (ISM)

Use Approved Equipment for Media Destruction

Use officially approved devices for destroying media to ensure proper disposal.

ASD Information Security ManualGovernance +1

View details →

ISM-1364 🛡️ ASD Information Security Manual (ISM)

Separate VLANs by Security Domains

Ensure VLANs from different security domains use separate network interfaces to avoid cross-traffic.

ASD Information Security ManualGovernance +1

View details →

ISM-1366 🛡️ ASD Information Security Manual (ISM)

Ensure Timely Security Updates for Mobile Devices

Apply security updates to mobile devices immediately upon availability to prevent security breaches.

ASD Information Security ManualGovernance +1

View details →

ISM-1369 🛡️ ASD Information Security Manual (ISM)

Ensure TLS Connections Use AES-GCM Encryption

Use AES-GCM to securely encrypt information sent over TLS connections.

ASD Information Security ManualGovernance +1

View details →

ISM-1370 🛡️ ASD Information Security Manual (ISM)

Ensure Only Server-Initiated TLS Renegotiation

Only the server can start secure renegotiation for TLS connections to maintain security.

ASD Information Security ManualGovernance +1

View details →

ISM-1372 🛡️ ASD Information Security Manual (ISM)

Secure Key Establishment Using DH or ECDH in TLS

Use DH or ECDH methods to securely establish keys for encrypted internet connections.

ASD Information Security ManualGovernance +1

View details →

ISM-1373 🛡️ ASD Information Security Manual (ISM)

Ensure TLS Connections do not use Anonymous DH

Do not use Anonymous Diffie-Hellman for secure connections to prevent security vulnerabilities.

ASD Information Security ManualGovernance +1

View details →

ISM-1374 🛡️ ASD Information Security Manual (ISM)

Use SHA-2 Certificates for Secure TLS Connections

Use secure certificates to prevent eavesdropping on data sent over the internet.

ASD Information Security ManualGovernance +1

View details →

ISM-1375 🛡️ ASD Information Security Manual (ISM)

Use SHA-2 for Secure TLS Connections

TLS connections must use SHA-2 for better security, acting as a key and message verifier.

ASD Information Security ManualGovernance +1

View details →

ISM-1380 🛡️ ASD Information Security Manual (ISM)

Use Separate Privileged and Unprivileged Environments

Privileged users should work in distinct environments to increase security and reduce risks.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1385 🛡️ ASD Information Security Manual (ISM)

Segregation of Administrative Infrastructure from Networks

Administrative systems are isolated from the main network and internet to enhance security.

ASD Information Security ManualGovernance +1

View details →

ISM-1386 🛡️ ASD Information Security Manual (ISM)

Restrict Network Management Traffic Origin

Only authorised admin systems should manage network settings, ensuring security and control.

ASD Information Security ManualGovernance +1

View details →

ISM-1387 🛡️ ASD Information Security Manual (ISM)

Use Jump Servers for Administrative Activities

Ensure all admin tasks are done through safer, intermediary servers to enhance security.

ML2 Admin accountsASD Information Security Manual +1

View details →

ISM-1389 🛡️ ASD Information Security Manual (ISM)

Analyse Executable Files in Sandboxes

Files coming through gateways are tested in a safe environment to catch suspicious activities.

ASD Information Security ManualGovernance +1

View details →

ISM-1392 🛡️ ASD Information Security Manual (ISM)

Restrict File Modifications via Path Rules

Only certain users can change files and folders as allowed by system rules.

ASD Information Security ManualGovernance +1

View details →

ISM-1395 🛡️ ASD Information Security Manual (ISM)

Ensuring Data Protection by Service Providers

Service providers must protect any entrusted data adequately.

ContractsSupplier management +1

View details →

ISM-1400 🛡️ ASD Information Security Manual (ISM)

Enforce Data Separation on Personal Devices

Ensure work data on personal devices is kept separate from personal data for security.

ASD Information Security ManualGuidelines for enterprise mobility +1

View details →

ISM-1401 🛡️ ASD Information Security Manual (ISM)

Implement Multi-Factor Authentication for Security

Users need to use multiple identification methods to ensure secure access.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1402 🛡️ ASD Information Security Manual (ISM)

Protecting Stored Credentials with Security Measures

Store credentials securely using a password manager, hardware module, or by enhancing them with techniques before saving.

ASD Information Security ManualGovernance +1

View details →

ISM-1403 🛡️ ASD Information Security Manual (ISM)

Lock User Accounts After Failed Login Attempts

User accounts lock after five wrong passwords to increase security.

ASD Information Security ManualGovernance +1

View details →

ISM-1404 🛡️ ASD Information Security Manual (ISM)

Disabling Inactive User Access After 45 Days

If a user doesn't use their system access for 45 days, it's disabled to keep the system secure.

ASD Information Security ManualAccess control +1

View details →

ISM-1405 🛡️ ASD Information Security Manual (ISM)

Implement a Centralised Event Logging Facility

Ensure all event logs are collected and managed in one central location for analysis and security monitoring.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-1406 🛡️ ASD Information Security Manual (ISM)

Use SOEs for Workstations and Servers

Use pre-configured software setups for all computers and servers to ensure consistency and security.

ASD Information Security ManualGovernance +1

View details →

ISM-1407 🛡️ ASD Information Security Manual (ISM)

Ensure Use of Current OS Versions

Use the latest or previous operating system version to keep systems up-to-date.

ML3 ASD Information Security ManualGovernance +1

View details →

ISM-1408 🛡️ ASD Information Security Manual (ISM)

Use 64-bit Operating Systems Where Supported

Use 64-bit operating systems if they are supported by your computer.

ASD Information Security ManualGovernance +1

View details →

ISM-1409 🛡️ ASD Information Security Manual (ISM)

Implement Restrictive OS Hardening Guidelines

Ensure operating systems follow strictest security guidelines from ASD or vendors.

ASD Information Security ManualGovernance +1

View details →

ISM-1412 🛡️ ASD Information Security Manual (ISM)

Web Browser Hardening with Strict Guidelines

Web browsers must be set with the strictest security settings per ASD and vendor guides.

ML2 ASD Information Security ManualGovernance +1

View details →

ISM-1416 🛡️ ASD Information Security Manual (ISM)

Implement Firewalls to Control Network Connections

Use software firewalls to control what apps and services can connect to your network.

ASD Information Security ManualGovernance +1

View details →

ISM-1417 🛡️ ASD Information Security Manual (ISM)

Comprehensive Antivirus Protection on Systems

Ensure antivirus programs fully protect and scan computers daily to prevent infections.

ASD Information Security ManualGovernance +1

View details →

ISM-1418 🛡️ ASD Information Security Manual (ISM)

Disable Unnecessary Removable Media Access

If you don't need to use removable devices for work, access to them should be blocked.

ASD Information Security ManualGovernance +1

View details →

ISM-1419 🛡️ ASD Information Security Manual (ISM)

Ensure Software Changes Occur in Development Environments

Software changes should only be done in a development environment to prevent issues in production.

Secure SDLCChange management +1

View details →

ISM-1420 🛡️ ASD Information Security Manual (ISM)

Ensure Non-Production Security Matches Production

Data from live systems can't be used in test setups unless test setups are just as secure.

ASD Information Security ManualGovernance +1

View details →

ISM-1422 🛡️ ASD Information Security Manual (ISM)

Prevent Unauthorised Access to Software Source

Ensure only authorised users can access the main software source to keep it secure.

ASD Information Security ManualGovernance +1

View details →

ISM-1424 🛡️ ASD Information Security Manual (ISM)

Ensure Web Security Through Response Headers

Web servers use security headers to protect web applications from attacks.

ASD Information Security ManualGovernance +1

View details →

ISM-1427 🛡️ ASD Information Security Manual (ISM)

Prevent IP Source Address Spoofing in Gateways

Gateways block fake IP addresses to protect network entries.

ASD Information Security ManualGuidelines for gateways +1

View details →

ISM-1428 🛡️ ASD Information Security Manual (ISM)

Disable IPv6 Tunnelling Unless Necessary

IPv6 tunnelling on network devices should be disabled unless absolutely needed.

ASD Information Security ManualGovernance +1

View details →

ISM-1429 🛡️ ASD Information Security Manual (ISM)

Block IPv6 Tunnelling at Network Boundaries

Network security must block IPv6 tunnels at all external connections to prevent unauthorised data flow.

Physical securityASD Information Security Manual +1

View details →

ISM-1430 🛡️ ASD Information Security Manual (ISM)

Configure IPv6 Addresses with DHCPv6 in Stateful Mode

Use DHCPv6 to manage and log IPv6 addresses centrally for enhanced network organisation.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-1431 🛡️ ASD Information Security Manual (ISM)

Strategies for Mitigating Denial-of-Service Attacks

Discuss with cloud providers how to handle costs and actions for denial-of-service attacks to maintain service continuity.

ASD Information Security ManualGovernance +1

View details →

ISM-1432 🛡️ ASD Information Security Manual (ISM)

Protect Online Services from Domain Hijacking

Ensure online service domain security by locking registration and verifying details.

ASD Information Security ManualGovernance +1

View details →

ISM-1436 🛡️ ASD Information Security Manual (ISM)

Segregate Critical Services to Prevent DoS Attacks

Critical online services are kept separate to reduce the risk of service disruption from attacks.

ASD Information Security ManualGovernance +1

View details →

ISM-1437 🛡️ ASD Information Security Manual (ISM)

Utilising Cloud Providers for Hosting Online Services

Online services are hosted using cloud service providers for improved service continuity.

Cloud securityBusiness continuity +1

View details →

ISM-1438 🛡️ ASD Information Security Manual (ISM)

Ensure High Availability by Using CDNs

Use CDNs to keep websites running smoothly and available when needed.

Business continuityASD Information Security Manual +1

View details →

ISM-1439 🛡️ ASD Information Security Manual (ISM)

Restrict IP Disclosure in CDNs

Avoid sharing web server IPs and limit access to them by CDNs and authorised networks for security.

ASD Information Security ManualGovernance +1

View details →

ISM-1446 🛡️ ASD Information Security Manual (ISM)

Use Approved Elliptic Curves for Encryption

Ensure secure cryptography by using NIST-approved elliptic curves for encryption.

ASD Information Security ManualGovernance +1

View details →

ISM-1448 🛡️ ASD Information Security Manual (ISM)

Use Ephemeral DH or ECDH for TLS Key Establishment

Use temporary DH or ECDH keys for secure TLS connections.

ASD Information Security ManualGovernance +1

View details →

ISM-1449 🛡️ ASD Information Security Manual (ISM)

Protect SSH Private Keys with Passwords or Encryption

Ensure SSH keys have a password or are encrypted to prevent unauthorised access.

ASD Information Security ManualGovernance +1

View details →

ISM-1450 🛡️ ASD Information Security Manual (ISM)

Restricting Devices in Top Secret Areas

Do not use microphones or webcams with non-Top Secret devices in Top Secret areas.

ASD Information Security ManualGovernance +1

View details →

ISM-1451 🛡️ ASD Information Security Manual (ISM)

Document Data Ownership in Service Contracts

Ensure contracts with service providers clearly state who owns the data.

ContractsASD Information Security Manual +1

View details →

ISM-1452 🛡️ ASD Information Security Manual (ISM)

Assess Supply Chain Risks for IT and OT Suppliers

Evaluate the risk suppliers pose to system security for IT and OT products and services.

ASD Information Security ManualGovernance +1

View details →

ISM-1453 🛡️ ASD Information Security Manual (ISM)

Ensure PFS is Enabled for TLS Connections

TLS connections must be set up to protect past data even if the server's private key is compromised.

ASD Information Security ManualGovernance +1

View details →

ISM-1454 🛡️ ASD Information Security Manual (ISM)

Enhancing Security with Encrypted RADIUS Communications

Ensure RADIUS server communications are encrypted for increased security.

ASD Information Security ManualGovernance +1

View details →

ISM-1457 🛡️ ASD Information Security Manual (ISM)

Evaluate Peripheral Switches for Security Domains

Ensure devices used to share equipment between classified systems meet high security standards.

ASD Information Security ManualGovernance +1

View details →

ISM-1460 🛡️ ASD Information Security Manual (ISM)

Ensure Secure Design in Virtual Server Isolation

Use isolation software from vendors that prioritize security in their design and development.

ASD Information Security ManualGovernance +1

View details →

ISM-1461 🛡️ ASD Information Security Manual (ISM)

Ensure Same Classification for Virtualised Environments

All shared server environments must be of the same classification to maintain security integrity.

ASD Information Security ManualGovernance +1

View details →

ISM-1467 🛡️ ASD Information Security Manual (ISM)

Ensure Use of Latest User Applications

Always use the latest versions of office software, browsers, and security tools to maintain safety.

ASD Information Security ManualGovernance +1

View details →

ISM-1470 🛡️ ASD Information Security Manual (ISM)

Disable Unneeded Software Functions and Services

Turn off or remove unnecessary parts and services of common software to improve security.

ASD Information Security ManualGovernance +1

View details →

ISM-1471 🛡️ ASD Information Security Manual (ISM)

Utilise Publisher and Product Names in App Control

Use known publisher and product names to control which applications can run on a system.

ASD Information Security ManualGovernance +1

View details →

ISM-1478 🛡️ ASD Information Security Manual (ISM)

CISO Management of Cyber Security Compliance

The CISO is responsible for managing the organisation's cyber security and ensuring compliance with relevant standards and laws.

ComplianceAudit +1

View details →

ISM-1479 🛡️ ASD Information Security Manual (ISM)

Minimise Server-to-Server Communication

Servers should reduce interaction with each other to enhance security.

ASD Information Security ManualGovernance +1

View details →

ISM-1480 🛡️ ASD Information Security Manual (ISM)

Ensure High Assurance for Peripheral Switches

Peripheral switches used between classified and unclassified systems must undergo a thorough security evaluation.

ASD Information Security ManualGovernance +1

View details →

ISM-1482 🛡️ ASD Information Security Manual (ISM)

Ensure Separation of Classified and Personal Data

Ensure that classified and personal data are kept separate on organisation-owned devices.

ASD Information Security ManualGuidelines for enterprise mobility +1

View details →

ISM-1483 🛡️ ASD Information Security Manual (ISM)

Ensure Use of Latest Server Application Releases

Keep server applications updated to their latest release for better security against internet threats.

ASD Information Security ManualGovernance +1

View details →

ISM-1485 🛡️ ASD Information Security Manual (ISM)

Prevent Web Browsers from Processing Ads

Block web browsers from displaying online ads to enhance security.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1486 🛡️ ASD Information Security Manual (ISM)

Restrict Java Processing in Web Browsers

Ensure web browsers are set to block Java from running online.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1487 🛡️ ASD Information Security Manual (ISM)

Restrict Macro Editing to Privileged Users

Only authorised users can edit trusted Microsoft Office macros to prevent malicious code.

ML3 ASD Information Security ManualGovernance +1

View details →

ISM-1488 🛡️ ASD Information Security Manual (ISM)

Blocking Internet-Originating Macros in Office Files

Microsoft Office blocks macros from files downloaded from the internet to enhance security.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1489 🛡️ ASD Information Security Manual (ISM)

Prevent Users from Changing Office Macro Security Settings

Users cannot alter the security settings for Microsoft Office macros, ensuring consistent protection.

ML1 GovernanceASD Information Security Manual +1

View details →

ISM-1490 🛡️ ASD Information Security Manual (ISM)

Implement Application Control on Internet-Facing Servers

Ensure application security by using controls on servers exposed to the internet.

ML2 ASD Information Security ManualGovernance +1

View details →

ISM-1491 🛡️ ASD Information Security Manual (ISM)

Prevent Script Execution by Unprivileged Users

Prevent users without admin rights from running scripts or commands that could pose security risks.

ASD Information Security ManualGovernance +1

View details →

ISM-1492 🛡️ ASD Information Security Manual (ISM)

Enable Exploit Protection in Operating Systems

Ensure operating system settings are adjusted to block potential attacks.

ASD Information Security ManualGovernance +1

View details →

ISM-1493 🛡️ ASD Information Security Manual (ISM)

Ensure Regular Updates of Software Registers

Regularly create and update software lists for all IT equipment to ensure proper maintenance.

Equipment maintenanceCompliance +1

View details →

ISM-1501 🛡️ ASD Information Security Manual (ISM)

Replace Unsupported Operating Systems

Replace operating systems that are no longer supported to maintain security.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1502 🛡️ ASD Information Security Manual (ISM)

Ensure Multi-factor Authentication for Online Services

Use two or more forms of identity verification to access sensitive data online.

ASD Information Security ManualGovernance +1

View details →

ISM-1504 🛡️ ASD Information Security Manual (ISM)

Implement Multi-factor Authentication

Users need multiple forms of ID to access sensitive online services, enhancing security.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1505 🛡️ ASD Information Security Manual (ISM)

Implement Multi-factor Authentication for Data Repositories

Require multi-factor authentication for accessing data storage to enhance security.

ML3 ASD Information Security ManualGovernance +1

View details →

ISM-1506 🛡️ ASD Information Security Manual (ISM)

Disable SSH Version 1 for Security

SSH version 1 is turned off to improve security for SSH connections.

ASD Information Security ManualGovernance +1

View details →

ISM-1507 🛡️ ASD Information Security Manual (ISM)

Ensure Requests for Privileged Access are Verified

Requests for special system access are checked before approval to prevent unauthorized use.

ML1 ASD Information Security ManualAccess control +1

View details →

ISM-1508 🛡️ ASD Information Security Manual (ISM)

Limit Privileged Access to Essential Duties Only

Only grant system privileges necessary for users to perform their job roles.

ML3 Access controlASD Information Security Manual +1

View details →

ISM-1509 🛡️ ASD Information Security Manual (ISM)

Log Privileged Access Events Centrally for Monitoring

Keep records of high-level system access in one place to monitor and respond to potential issues.

ML2 Logging and monitoringASD Information Security Manual +1

View details →

ISM-1510 🛡️ ASD Information Security Manual (ISM)

Develop and Maintain a Digital Preservation Policy

Organisations must create and keep up-to-date a policy for preserving digital information.

ASD Information Security ManualGovernance +1

View details →

ISM-1511 🛡️ ASD Information Security Manual (ISM)

Conduct and Maintain Regular Data Backups

Ensure data backups are done based on business importance and kept for future recovery needs.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1515 🛡️ ASD Information Security Manual (ISM)

Test Backup Restoration During Disaster Recovery

Backups should be restored regularly to ensure data can be retrieved in case of a disaster.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1517 🛡️ ASD Information Security Manual (ISM)

Microform Destruction Using Fine Powder Method

Machines destroy microfiche by turning them into fine powder so no more than five characters remain per fragment.

ASD Information Security ManualGovernance +1

View details →

ISM-1520 🛡️ ASD Information Security Manual (ISM)

Employment Screening for Gateway Administrators

Ensure appropriate screening and security clearance for gateway admins based on system sensitivity.

ASD Information Security ManualGuidelines for gateways +1

View details →

ISM-1521 🛡️ ASD Information Security Manual (ISM)

Use Protocol Breaks to Separate Network Layers

Ensure data flows are separated by breaking protocols at each network level for security.

ASD Information Security ManualGovernance +1

View details →

ISM-1522 🛡️ ASD Information Security Manual (ISM)

Ensure CDSs Separate Upward and Downward Data Paths

CDSs have independent security controls for data going both up and down between networks.

ASD Information Security ManualGovernance +1

View details →

ISM-1523 🛡️ ASD Information Security Manual (ISM)

Regular Assessment of Security Events in CDS

Every three months, security events are reviewed to ensure CDS are working correctly and follow data transfer policies.

ComplianceAudit +1

View details →

ISM-1524 🛡️ ASD Information Security Manual (ISM)

Ensure Rigorous Testing of Content Filters

Content filters need thorough testing to make sure they work properly and can't be bypassed.

AuditASD Information Security Manual +1

View details →

ISM-1525 🛡️ ASD Information Security Manual (ISM)

Register Systems with Authorising Officers

System owners must register their systems with the designated authorising officer for oversight.

ASD Information Security ManualGuidelines for cyber security roles +1

View details →

ISM-1526 🛡️ ASD Information Security Manual (ISM)

Monitor Systems and Assess Security Threats

System owners continuously track systems and consider security threats and risks.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-1528 🛡️ ASD Information Security Manual (ISM)

Utilising Evaluated Firewalls for Network Security

Firewalls are installed to separate the organisation's networks from the public internet, enhancing security.

ASD Information Security ManualGovernance +1

View details →

ISM-1529 🛡️ ASD Information Security Manual (ISM)

Limit Cloud Services to Community or Private for SECRETS

For SECRET or TOP SECRET services, only community or private clouds should be used to ensure security.

ASD Information Security ManualGovernance +1

View details →

ISM-1530 🛡️ ASD Information Security Manual (ISM)

Secure Classified Equipment in Suitable Security Containers

Keep classified IT equipment in secure containers based on their classification and location's security zone.

ASD Information Security ManualPhysical security +1

View details →

ISM-1532 🛡️ ASD Information Security Manual (ISM)

Avoid Using VLANs for Network Separation

Do not use VLANs to separate internal networks from the public internet.

ASD Information Security ManualGovernance +1

View details →

ISM-1533 🛡️ ASD Information Security Manual (ISM)

Establish Mobile Device Management Policies

Create and maintain policies to manage and control mobile devices within the organization.

ASD Information Security ManualGovernance +1

View details →

ISM-1534 🛡️ ASD Information Security Manual (ISM)

Prevent Inappropriate Export of Sensitive Data

Procedures are set to stop sensitive data from being sent to foreign systems that aren't suitable.

ComplianceASD Information Security Manual +1

View details →

ISM-1535 🛡️ ASD Information Security Manual (ISM)

Prevent Unsuitable Foreign Data Exports

Ensure processes are in place to block export of sensitive data to foreign systems.

ASD Information Security ManualGuidelines for data transfers +1

View details →

ISM-1536 🛡️ ASD Information Security Manual (ISM)

Prevent OLE Package Activation in Microsoft Office

Ensure Microsoft Office is set to block the use of OLE packages for added security.

ASD Information Security ManualGovernance +1

View details →

ISM-1537 🛡️ ASD Information Security Manual (ISM)

Log Security-Relevant Database Events Centrally

Keep track of important activities in databases, like access, changes, and issues, to ensure security.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-1540 🛡️ ASD Information Security Manual (ISM)

Configuring DMARC for Email Security

Ensure emails from your domains are legitimate by rejecting ones that fail DMARC checks.

ASD Information Security ManualGovernance +1

View details →

ISM-1542 🛡️ ASD Information Security Manual (ISM)

Disable OLE in Microsoft Office for Security

Microsoft Office is set to block OLE, a feature that could pose security risks.

ML2 ASD Information Security ManualGovernance +1

View details →

ISM-1543 🛡️ ASD Information Security Manual (ISM)

Maintaining an Authorised RF and IR Device Register

Keep a regularly updated list of approved RF and IR devices in secure areas.

ASD Information Security ManualPhysical security +1

View details →

ISM-1544 🛡️ ASD Information Security Manual (ISM)

Implement Microsoft's Application Blocklist

Organisations must use Microsoft's blocklist to stop unauthorised applications from running.

ML2 ASD Information Security ManualGovernance +1

View details →

ISM-1546 🛡️ ASD Information Security Manual (ISM)

Ensure User Authentication Before System Access

Verify user identities before they can access any system.

ASD Information Security ManualGovernance +1

View details →

ISM-1547 🛡️ ASD Information Security Manual (ISM)

Develop and Maintain Data Backup Procedures

Ensure data backup processes and procedures are created, used, and kept up to date.

AuditASD Information Security Manual +1

View details →

ISM-1548 🛡️ ASD Information Security Manual (ISM)

Develop and Maintain Data Restoration Processes

Organisations must create and keep updated processes for restoring data.

ASD Information Security ManualGovernance +1

View details →

ISM-1549 🛡️ ASD Information Security Manual (ISM)

Develop and Maintain Media Management Policy

Create and update a policy to manage media handling effectively.

ASD Information Security ManualGovernance +1

View details →

ISM-1550 🛡️ ASD Information Security Manual (ISM)

Develop and Maintain IT Equipment Disposal Procedures

Ensure IT equipment is disposed of properly by following established procedures.

ASD Information Security ManualGovernance +1

View details →

ISM-1551 🛡️ ASD Information Security Manual (ISM)

Develop and Maintain IT Equipment Management Policy

Organisations must create and sustain a policy for managing IT equipment.

ASD Information Security ManualGovernance +1

View details →

ISM-1552 🛡️ ASD Information Security Manual (ISM)

Secure Web Content with HTTPS Only

Ensure all web content is delivered over a secure HTTPS connection.

ASD Information Security ManualGovernance +1

View details →

ISM-1553 🛡️ ASD Information Security Manual (ISM)

Disable TLS Compression for Security

TLS connections should not use compression to prevent security risks.

ASD Information Security ManualGovernance +1

View details →

ISM-1554 🛡️ ASD Information Security Manual (ISM)

Guidelines for Using Mobile Devices Abroad

Use specific work devices and avoid personal phones when going to high-risk countries.

ASD Information Security ManualGuidelines for enterprise mobility +1

View details →

ISM-1555 🛡️ ASD Information Security Manual (ISM)

Prepare Mobile Devices Before Overseas Travel

Before travelling overseas, ensure mobile devices are recorded, updated, reduced to essentials, and backed up to safeguard data.

ASD Information Security ManualGuidelines for enterprise mobility +1

View details →

ISM-1556 🛡️ ASD Information Security Manual (ISM)

Security Measures After Overseas Travel with Mobile Devices

Reset credentials and watch for suspicious account activity after travel to high-risk areas.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-1557 🛡️ ASD Information Security Manual (ISM)

Ensure Strong Passwords for SECRET Systems

Passwords for SECRET systems must be at least 17 characters long to enhance security.

ASD Information Security ManualGovernance +1

View details →

ISM-1558 🛡️ ASD Information Security Manual (ISM)

Ensure Secure Construction of Passwords

Passwords must not use predictable sequences, like quotes or sentences, and must meet minimum word count rules for security levels.

ASD Information Security ManualGovernance +1

View details →

ISM-1559 🛡️ ASD Information Security Manual (ISM)

Minimum Password Length for Secure Systems

Passwords for secure systems should have at least 6 characters to enhance security.

ASD Information Security ManualGovernance +1

View details →

ISM-1560 🛡️ ASD Information Security Manual (ISM)

Ensure Strong Passwords for SECRET System Authentication

Passwords for SECRET systems using multi-factor authentication must be at least 8 characters.

ASD Information Security ManualGovernance +1

View details →

ISM-1561 🛡️ ASD Information Security Manual (ISM)

Ensure Strong Passwords for TOP SECRET Systems

TOP SECRET systems must use passwords of at least 10 characters for added security.

ASD Information Security ManualGovernance +1

View details →

ISM-1562 🛡️ ASD Information Security Manual (ISM)

Secure Video Conferencing and Telephony Systems

Ensure video and IP telephony systems are secured against threats.

ASD Information Security ManualGovernance +1

View details →

ISM-1563 🛡️ ASD Information Security Manual (ISM)

Generate Comprehensive Security Assessment Reports

Create a report detailing the scope, weaknesses, risks, and controls of a system after assessment.

AuditASD Information Security Manual +1

View details →

ISM-1564 🛡️ ASD Information Security Manual (ISM)

Develop Plan of Action Post Security Assessment

After assessing security, system owners create a plan to address and resolve issues.

ComplianceASD Information Security Manual +1

View details →

ISM-1565 🛡️ ASD Information Security Manual (ISM)

Annual Training for Privileged Users

Privileged users receive yearly customised cyber security training.

ASD Information Security ManualGovernance +1

View details →

ISM-1566 🛡️ ASD Information Security Manual (ISM)

Central Logging of Unprivileged System Access

System logs keep track of unprivileged user actions to monitor access and security.

AuditLogging and monitoring +1

View details →

ISM-1567 🛡️ ASD Information Security Manual (ISM)

Avoid High-Risk Suppliers in Cyber Supply Chain

Suppliers considered high risk are not chosen to ensure the security of the supply chain.

ASD Information Security ManualGovernance +1

View details →

ISM-1568 🛡️ ASD Information Security Manual (ISM)

Ensure Security Commitment from Suppliers

Buy IT and OT products only from suppliers who show they care about product security.

ASD Information Security ManualGovernance +1

View details →

ISM-1569 🛡️ ASD Information Security Manual (ISM)

Establish Shared Responsibility Model for Supply Chain

Suppliers and customers must document and share security duties to understand who is responsible for what.

ContractsASD Information Security Manual +1

View details →

ISM-1570 🛡️ ASD Information Security Manual (ISM)

Regular IRAP Assessment of Cloud Service Providers

Cloud service providers must undergo an IRAP review at least every 24 months.

ComplianceSupplier management +1

View details →

ISM-1571 🛡️ ASD Information Security Manual (ISM)

Verify Security Compliance in Service Contracts

Contracts with service providers must include clauses that allow security compliance checks.

ComplianceASD Information Security Manual +1

View details →

ISM-1572 🛡️ ASD Information Security Manual (ISM)

Document Service Provider Data Handling and Change Notifications

Ensure service contracts specify data regions and notify configuration changes ahead of time.

Cloud securityContracts +1

View details →

ISM-1573 🛡️ ASD Information Security Manual (ISM)

Log Access Documentation with Service Providers

Ensure contracts specify how organisations can access logs about their data from service providers.

Logging and monitoringContracts +1

View details →

ISM-1574 🛡️ ASD Information Security Manual (ISM)

Ensure Data Portability in Service Agreements

Make sure contracts with providers include plans for data transfer, backup, and deletion without loss.

ContractsASD Information Security Manual +1

View details →

ISM-1575 🛡️ ASD Information Security Manual (ISM)

One-Month Notice for Service Termination

Service contracts require a one-month notice before a provider can stop services.

ContractsSupplier management +1

View details →

ISM-1576 🛡️ ASD Information Security Manual (ISM)

Notify Organisation of Unauthorised System Access

Service providers must alert organisations if they access systems without permission.

Incident managementASD Information Security Manual +1

View details →

ISM-1577 🛡️ ASD Information Security Manual (ISM)

Ensure Network Segregation from Service Providers

Ensure that an organisation's network is kept separate from its service providers' networks for better security.

ASD Information Security ManualGovernance +1

View details →

ISM-1579 🛡️ ASD Information Security Manual (ISM)

Ensure Cloud Resource Scalability for Demand Spikes

Cloud providers check if they can quickly increase resources to handle sudden increases in demand.

Cloud securityASD Information Security Manual +1

View details →

ISM-1580 🛡️ ASD Information Security Manual (ISM)

Ensure High Availability for Online Services

Online services should switch easily between zones to maintain availability.

Cloud securityBusiness continuity +1

View details →

ISM-1581 🛡️ ASD Information Security Manual (ISM)

Monitor Capacity and Availability of Online Services

Organisations monitor online services to ensure they can handle traffic and remain available at all times.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-1582 🛡️ ASD Information Security Manual (ISM)

Routine Validation of Application Control Rulesets

Check and update app control rules at least yearly to maintain security.

ML2 ASD Information Security ManualGovernance +1

View details →

ISM-1583 🛡️ ASD Information Security Manual (ISM)

Ensure Contractors are Identified as Users

Ensure contractors are labeled distinctively from other personnel in systems.

ASD Information Security ManualAccess control +1

View details →

ISM-1584 🛡️ ASD Information Security Manual (ISM)

Prevent Unauthorised Changes to Security Settings

Ensure non-admin users cannot change or disable security settings on operating systems.

ASD Information Security ManualGovernance +1

View details →

ISM-1585 🛡️ ASD Information Security Manual (ISM)

Prevent User Changes to Browser Security Settings

Users cannot modify web browser security settings to ensure consistent protection.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1586 🛡️ ASD Information Security Manual (ISM)

Record All Data Imports and Exports

Keep logs to track every time data is transferred into or out of the system.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-1587 🛡️ ASD Information Security Manual (ISM)

Annual Security Status Reporting for Systems

System owners must annually report each system's security status to an authorising officer.

ASD Information Security ManualGuidelines for cyber security roles +1

View details →

ISM-1588 🛡️ ASD Information Security Manual (ISM)

Annual Review of Standard Operating Environments

Standard Operating Environments must be reviewed and updated once every year.

ComplianceASD Information Security Manual +1

View details →

ISM-1589 🛡️ ASD Information Security Manual (ISM)

Enable MTA-STS for Secure Email Transport

Ensure email is encrypted during transfer between servers to enhance security.

ASD Information Security ManualGovernance +1

View details →

ISM-1590 🛡️ ASD Information Security Manual (ISM)

Mandate Credential Changes Upon Compromise

Change user account credentials if they're compromised or potentially insecure.

ASD Information Security ManualGovernance +1

View details →

ISM-1591 🛡️ ASD Information Security Manual (ISM)

Suspend User Access for Malicious Activity

Remove or pause access immediately if someone is found doing harmful activities on the system.

ASD Information Security ManualAccess control +1

View details →

ISM-1592 🛡️ ASD Information Security Manual (ISM)

Prevent Unauthorised Application Installations by Users

Regular users cannot install apps unless they are approved, keeping systems secure.

ASD Information Security ManualGovernance +1

View details →

ISM-1593 🛡️ ASD Information Security Manual (ISM)

Verifying User Identity for New Credentials

Users need to show proof of who they are before getting new login details.

Identity & access managementASD Information Security Manual +1

View details →

ISM-1594 🛡️ ASD Information Security Manual (ISM)

Secure Delivery of User Account Credentials

Credentials are securely delivered to users, or split between users and supervisors if secure delivery is not possible.

ASD Information Security ManualGovernance +1

View details →

ISM-1595 🛡️ ASD Information Security Manual (ISM)

Ensure Initial User Credentials Are Changed

Users must change their initial passwords the first time they log in to enhance security.

ASD Information Security ManualGovernance +1

View details →

ISM-1596 🛡️ ASD Information Security Manual (ISM)

Avoid Reusing Credentials Across Systems

Users should not use the same passwords on different systems for better security.

ASD Information Security ManualGovernance +1

View details →

ISM-1597 🛡️ ASD Information Security Manual (ISM)

Ensuring Credential Input Obscurity

Passwords and personal credentials are hidden when entered in systems to enhance security.

ASD Information Security ManualGovernance +1

View details →

ISM-1598 🛡️ ASD Information Security Manual (ISM)

Inspect IT Equipment Post-Maintenance for Unauthorised Changes

After maintenance, check that IT equipment is the same as it was and has no unauthorised changes.

AuditASD Information Security Manual +1

View details →

ISM-1599 🛡️ ASD Information Security Manual (ISM)

Proper Handling of Sensitive IT Equipment

Ensure IT equipment is handled based on how sensitive or classified it is.

ASD Information Security ManualGovernance +1

View details →

ISM-1600 🛡️ ASD Information Security Manual (ISM)

Ensure Media is Sanitised Before Initial Use

Before using any media, clean it to ensure no unwanted data is present.

ASD Information Security ManualGovernance +1

View details →

ISM-1601 🛡️ ASD Information Security Manual (ISM)

Implement Microsoft Attack Surface Reduction Rules

Apply Microsoft's rules to reduce potential weaknesses in user applications.

ASD Information Security ManualGovernance +1

View details →

ISM-1602 🛡️ ASD Information Security Manual (ISM)

Ensure Cyber Security Docs Are Communicated

Make sure all stakeholders are informed about cyber security documents and their updates.

ASD Information Security ManualGuidelines for cyber security documentation +1

View details →

ISM-1603 🛡️ ASD Information Security Manual (ISM)

Disabling Vulnerable Authentication Methods

Turn off login methods that can be tricked into accepting false entries.

ASD Information Security ManualGovernance +1

View details →

ISM-1604 🛡️ ASD Information Security Manual (ISM)

Hardening Virtual Server Isolation Configuration

Secure virtual servers by simplifying controls and restricting admin interface access.

ASD Information Security ManualGovernance +1

View details →

ISM-1605 🛡️ ASD Information Security Manual (ISM)

Harden Operating Systems for Secure Virtual Environments

Ensure systems sharing a server are protected by solidifying the operating system.

ASD Information Security ManualGovernance +1

View details →

ISM-1606 🛡️ ASD Information Security Manual (ISM)

Apply Timely Updates to Isolation Mechanisms

Keep server hardware isolation software and OS updated to fix vulnerabilities promptly.

ASD Information Security ManualGovernance +1

View details →

ISM-1607 🛡️ ASD Information Security Manual (ISM)

Integrity Monitoring for Shared Servers

Monitor and log system interactions when sharing a server's hardware using software isolation.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-1608 🛡️ ASD Information Security Manual (ISM)

Scan Third-Party SOEs for Malicious Code

Third-party standard operating environments must be checked for viruses and bad configurations.

ASD Information Security ManualGovernance +1

View details →

ISM-1609 🛡️ ASD Information Security Manual (ISM)

Consult System Owners Before Continuing Intrusions

System owners must be asked before allowing intrusions to persist for collecting evidence.

ASD Information Security ManualGuidelines for cyber security incidents +1

View details →

ISM-1610 🛡️ ASD Information Security Manual (ISM)

Document and Test Emergency System Access Procedures

Ensure emergency access to IT systems is documented and tested during major IT changes.

Business continuityASD Information Security Manual +1

View details →

ISM-1611 🛡️ ASD Information Security Manual (ISM)

Use Break Glass Accounts Only in Emergencies

Break glass accounts should be used only if normal login methods fail.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-1612 🛡️ ASD Information Security Manual (ISM)

Restricted Use of Break Glass Accounts for Emergencies

Use special accounts only for approved emergency activities to maintain system security.

ASD Information Security ManualAccess control +1

View details →

ISM-1613 🛡️ ASD Information Security Manual (ISM)

Central Logging of Break Glass Account Usage

Logging is used to track and monitor the use of emergency access accounts.

AuditLogging and monitoring +1

View details →

ISM-1614 🛡️ ASD Information Security Manual (ISM)

Manage Emergency Account Access Changes

Change break glass account passwords after emergency access.

ASD Information Security ManualAccess control +1

View details →

ISM-1615 🛡️ ASD Information Security Manual (ISM)

Testing Break Glass Accounts Post Credential Change

Ensure emergency accounts work properly after changing their passwords.

ASD Information Security ManualAccess control +1

View details →

ISM-1616 🛡️ ASD Information Security Manual (ISM)

Implementing a Vulnerability Disclosure Program

Create a program to find and fix software issues to keep products secure.

ASD Information Security ManualGovernance +1

View details →

ISM-1617 🛡️ ASD Information Security Manual (ISM)

Regular Review of Cyber Security Program

The CISO ensures the cyber security program stays relevant to combat threats and seize opportunities.

ASD Information Security ManualGuidelines for cyber security roles +1

View details →

ISM-1618 🛡️ ASD Information Security Manual (ISM)

CISO's Role in Cyber Security Incident Response

The CISO is responsible for managing the organisation's reactions to cyber security threats.

ASD Information Security ManualGuidelines for cyber security roles +1

View details →

ISM-1619 🛡️ ASD Information Security Manual (ISM)

Configure Service Accounts as Managed Service Accounts

Ensure service accounts are created as Managed Service Accounts for improved security.

Identity & access managementASD Information Security Manual +1

View details →

ISM-1620 🛡️ ASD Information Security Manual (ISM)

Ensure Privileged Accounts are Secured in AD

Privileged user accounts must belong to a special security group for extra protection.

ASD Information Security ManualGovernance +1

View details →

ISM-1621 🛡️ ASD Information Security Manual (ISM)

Disable or Remove Windows PowerShell 2.0

Ensure the outdated PowerShell 2.0 is disabled or uninstalled for security.

ML3 ASD Information Security ManualGovernance +1

View details →

ISM-1622 🛡️ ASD Information Security Manual (ISM)

Ensure PowerShell Uses Constrained Language Mode

PowerShell should be setup to limit script execution and mitigate potential risks.

ML3 Admin accountsASD Information Security Manual +1

View details →

ISM-1623 🛡️ ASD Information Security Manual (ISM)

Centralised Logging of PowerShell Activities

Ensure PowerShell actions and logs are collected in a central place for monitoring.

ML2 Logging and monitoringASD Information Security Manual +1

View details →

ISM-1624 🛡️ ASD Information Security Manual (ISM)

Protect PowerShell Script Block Logs

PowerShell logs are safeguarded by secure event logging that ensures their protection.

AuditLogging and monitoring +1

View details →

ISM-1625 🛡️ ASD Information Security Manual (ISM)

Develop Insider Threat Mitigation Programs

Create and manage a program to address threats from within the organisation.

Logging and monitoringIncident management +1

View details →

ISM-1626 🛡️ ASD Information Security Manual (ISM)

Seek Legal Advice for Insider Threat Plans

Get legal advice when making and applying plans to handle insider threats.

ComplianceASD Information Security Manual +1

View details →

ISM-1627 🛡️ ASD Information Security Manual (ISM)

Block Inbound Traffic from Anonymity Networks

Block connections from anonymous networks to keep the organisation's network secure.

ASD Information Security ManualGovernance +1

View details →

ISM-1628 🛡️ ASD Information Security Manual (ISM)

Prevent Anonymity Network Traffic in Outbound Connections

Ensure outbound connections to anonymous networks are blocked for security.

ASD Information Security ManualGovernance +1

View details →

ISM-1629 🛡️ ASD Information Security Manual (ISM)

Select Correct Modulus for Diffie-Hellman Encryption

Use NIST guidelines to choose secure parameters for Diffie-Hellman encryption to safely agree on session keys.

ASD Information Security ManualGovernance +1

View details →

ISM-1631 🛡️ ASD Information Security Manual (ISM)

Identify Suppliers in Cyber Supply Chain

Ensure all suppliers linked to IT and OT systems are identified for security management.

ASD Information Security ManualGovernance +1

View details →

ISM-1632 🛡️ ASD Information Security Manual (ISM)

Ensure Secure Procurement from Reliable Suppliers

Buy technology from suppliers known for keeping their systems secure.

ASD Information Security ManualGovernance +1

View details →

ISM-1633 🛡️ ASD Information Security Manual (ISM)

Determine System Boundary and Security Objectives

System owners work with officers to define system boundaries and security goals based on compromise risk.

ASD Information Security ManualGuidelines for cyber security roles +1

View details →

ISM-1634 🛡️ ASD Information Security Manual (ISM)

Select and Tailor System Security Controls

System owners choose and adjust security controls with officer guidance to match security goals.

AuditASD Information Security Manual +1

View details →

ISM-1635 🛡️ ASD Information Security Manual (ISM)

Ensure Security Controls for System Environments

System owners must apply security measures to safeguard each system and its environment.

ASD Information Security ManualGuidelines for cyber security roles +1

View details →

ISM-1636 🛡️ ASD Information Security Manual (ISM)

Security Assessment for System Controls

System owners ensure security checks for specific systems to verify proper setup and operation.

AuditASD Information Security Manual +1

View details →

ISM-1637 🛡️ ASD Information Security Manual (ISM)

Maintain a Cloud Service Register for Outsourcing

Organisations must keep and regularly update a list of all outsourced cloud services they use.

Cloud securityASD Information Security Manual +1

View details →

ISM-1638 🛡️ ASD Information Security Manual (ISM)

Maintain a Comprehensive Outsourced Cloud Service Register

Keep a detailed list of cloud services used, including provider details, service purpose, and security review schedule.

ContractsCloud security +1

View details →

ISM-1639 🛡️ ASD Information Security Manual (ISM)

Label Building Management Cables Clearly

Label cables with purpose clearly at intervals to ensure easy identification.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-1640 🛡️ ASD Information Security Manual (ISM)

Label Cables for Foreign Systems in Australia

Ensure all cables from foreign systems in Australia are labelled at check points.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-1641 🛡️ ASD Information Security Manual (ISM)

Ensure Degaussed Media is Physically Damaged

After using a degausser, damage internal components of magnetic media to prevent data recovery.

ASD Information Security ManualGovernance +1

View details →

ISM-1642 🛡️ ASD Information Security Manual (ISM)

Ensure Media is Sanitised Before Reuse

Clean media thoroughly before using it in a new security area to prevent data leaks.

ASD Information Security ManualGovernance +1

View details →

ISM-1643 🛡️ ASD Information Security Manual (ISM)

Maintain Detailed Software Version and Patch Records

Keep a record of software versions and update histories for system security.

ASD Information Security ManualGovernance +1

View details →

ISM-1644 🛡️ ASD Information Security Manual (ISM)

Secure Communication Practices in Public Areas

Avoid discussing sensitive topics on mobile phones in public to prevent eavesdropping.

Physical securityASD Information Security Manual +1

View details →

ISM-1645 🛡️ ASD Information Security Manual (ISM)

Maintain and Verify Floor Plan Diagrams Regularly

Regularly update and check floor plans to ensure accuracy and functionality.

Secure facilitiesASD Information Security Manual +1

View details →

ISM-1646 🛡️ ASD Information Security Manual (ISM)

Detail Cabling Paths and Points on Floor Plans

Floor plans should show cable paths, conduit systems, and key network component locations.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-1647 🛡️ ASD Information Security Manual (ISM)

Disable Privileged Access After 12 Months

Privileged system access is disabled if not revalidated within a year.

ML2 ASD Information Security ManualAccess control +1

View details →

ISM-1648 🛡️ ASD Information Security Manual (ISM)

Disabling Inactive Privileged Access to Systems

Access with special privileges is disabled if not used for 45 days to enhance system security.

ML2 Access controlASD Information Security Manual +1

View details →

ISM-1649 🛡️ ASD Information Security Manual (ISM)

Implement Just-in-Time Administration for System Access

Use just-in-time methods to manage who can access system resources, ensuring enhanced security.

ML3 ASD Information Security ManualAccess control +1

View details →

ISM-1650 🛡️ ASD Information Security Manual (ISM)

Log Management of Privileged User Activities

Keep track of changes to privileged user accounts by logging them in one central place.

ML2 Logging and monitoringASD Information Security Manual +1

View details →

ISM-1654 🛡️ ASD Information Security Manual (ISM)

Disable or Remove Internet Explorer 11

Ensure Internet Explorer 11 is not used to enhance system security.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1655 🛡️ ASD Information Security Manual (ISM)

Ensure .NET Framework 3.5 is Disabled or Removed

.NET Framework 3.5 should be turned off or uninstalled for security reasons.

ML3 ASD Information Security ManualGovernance +1

View details →

ISM-1656 🛡️ ASD Information Security Manual (ISM)

Implement Application Control on Secure Servers

Ensure servers not connected to the internet have application control for security.

ML3 ASD Information Security ManualGovernance +1

View details →

ISM-1657 🛡️ ASD Information Security Manual (ISM)

Restrict Application Execution to Approved Set

Only approved software and scripts can run, enhancing system security.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1658 🛡️ ASD Information Security Manual (ISM)

Restrict Execution of Drivers via Application Control

Ensures only approved drivers are run on systems, enhancing security.

ML3 ASD Information Security ManualGovernance +1

View details →

ISM-1659 🛡️ ASD Information Security Manual (ISM)

Implement Microsoft's Vulnerable Driver Blocklist

Use Microsoft's list to stop harmful drivers from running on systems.

ML3 ASD Information Security ManualGovernance +1

View details →

ISM-1660 🛡️ ASD Information Security Manual (ISM)

Central Logging of Application Events

All application events, whether allowed or blocked, must be recorded centrally.

ML2 Logging and monitoringASD Information Security Manual +1

View details →

ISM-1667 🛡️ ASD Information Security Manual (ISM)

Prevent Child Processes in Microsoft Office

Microsoft Office is configured to prevent it from starting other programs or processes.

ML2 ASD Information Security ManualGovernance +1

View details →

ISM-1668 🛡️ ASD Information Security Manual (ISM)

Prevent Microsoft Office from Creating Executable Files

Microsoft Office is set to not produce executable files to enhance security.

ML2 ASD Information Security ManualGovernance +1

View details →

ISM-1669 🛡️ ASD Information Security Manual (ISM)

Prevent Microsoft Office from Injecting Code

Microsoft Office is configured to not insert code into other programs for security reasons.

ML2 ASD Information Security ManualGovernance +1

View details →

ISM-1670 🛡️ ASD Information Security Manual (ISM)

Prevent PDF Applications from Creating Child Processes

PDF software can't start other programs, stopping potential security threats.

ML2 ASD Information Security ManualGovernance +1

View details →

ISM-1671 🛡️ ASD Information Security Manual (ISM)

Disabling Microsoft Office Macros for Unauthorised Users

Microsoft Office macros are turned off unless users have a proven need for them.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1672 🛡️ ASD Information Security Manual (ISM)

Enable Antivirus Scanning for Office Macros

Ensure Microsoft Office is set to scan macros for viruses to protect against malware.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1673 🛡️ ASD Information Security Manual (ISM)

Prevent Win32 API Calls by Office Macros

Microsoft Office macros cannot make direct calls to Windows APIs.

ML2 ASD Information Security ManualGovernance +1

View details →

ISM-1674 🛡️ ASD Information Security Manual (ISM)

Ensuring Secure Execution of Microsoft Office Macros

Only safe Microsoft Office macros are allowed to run, using security measures like sandboxing or trusted signatures.

ML3 ASD Information Security ManualGovernance +1

View details →

ISM-1675 🛡️ ASD Information Security Manual (ISM)

Prevent Enabling Untrusted Microsoft Office Macros

Macros from untrusted sources in Microsoft Office can't be enabled through standard interfaces.

ML3 ASD Information Security ManualGovernance +1

View details →

ISM-1676 🛡️ ASD Information Security Manual (ISM)

Validate Trusted Publishers for Microsoft Office

Ensure the list of trusted Microsoft Office publishers is checked at least once a year.

ML3 AuditASD Information Security Manual +1

View details →

ISM-1679 🛡️ ASD Information Security Manual (ISM)

Use Multi-factor Authentication for Third-party Services

Use multiple verification steps for accessing external services with sensitive data.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1680 🛡️ ASD Information Security Manual (ISM)

Use Multi-Factor Authentication for Online Services

Users must use multi-factor authentication for online services handling non-sensitive data.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1681 🛡️ ASD Information Security Manual (ISM)

Mandating Multi-Factor Authentication for Customer Services

Customers must use multi-factor authentication when accessing sensitive online services.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1682 🛡️ ASD Information Security Manual (ISM)

Enhance User Security with Phishing-resistant MFA

Multi-factor authentication protects systems by not relying solely on passwords, reducing phishing risks.

ML2 ASD Information Security ManualGovernance +1

View details →

ISM-1683 🛡️ ASD Information Security Manual (ISM)

Central Logging of Multi-factor Authentication Events

Multi-factor authentication attempts, whether they succeed or not, are logged together in a central system.

ML2 Logging and monitoringASD Information Security Manual +1

View details →

ISM-1685 🛡️ ASD Information Security Manual (ISM)

Strengthening Passwords for Critical Accounts

Ensure passwords for high-risk accounts are strong, unique, and properly managed.

ML2 ASD Information Security ManualGovernance +1

View details →

ISM-1686 🛡️ ASD Information Security Manual (ISM)

Enable Credential Guard for Credential Protection

Credential Guard is activated to better protect user credentials from unauthorised access.

ML3 ASD Information Security ManualGovernance +1

View details →

ISM-1687 🛡️ ASD Information Security Manual (ISM)

Prevent Virtualisation of Privileged Environments

Privileged environments must not be virtualised within non-privileged ones to ensure security.

ML2 ASD Information Security ManualGovernance +1

View details →

ISM-1688 🛡️ ASD Information Security Manual (ISM)

Restrict Privileged Environment Access

Users without privileges cannot access systems meant for privileged users.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1689 🛡️ ASD Information Security Manual (ISM)

Restrict Privileged Accounts Access to Non-Privileged Environments

Privileged users aren't allowed to log into standard environments to ensure security.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1690 🛡️ ASD Information Security Manual (ISM)

Timely Application of Non-Critical Vulnerability Patches

Apply non-critical patches to online services within two weeks to prevent unexploited vulnerabilities.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1691 🛡️ ASD Information Security Manual (ISM)

Timely Vulnerability Patching in Software Tools

Apply patches to major software tools like browsers and email clients within two weeks to prevent vulnerabilities.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1692 🛡️ ASD Information Security Manual (ISM)

Quick Apply Critical Patches for Vulnerabilities

Apply crucial software patches within 48 hours to prevent security breaches from known vulnerabilities.

ML3 ASD Information Security ManualGovernance +1

View details →

ISM-1693 🛡️ ASD Information Security Manual (ISM)

Timely Application of Patches to Mitigate Vulnerabilities

Apply updates to non-generic software within a month to keep systems secure.

ML2 ASD Information Security ManualGovernance +1

View details →

ISM-1694 🛡️ ASD Information Security Manual (ISM)

Timely Application of Non-Critical Security Patches

Apply patches for non-critical vulnerabilities on internet-facing devices within two weeks if no known exploits are available.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1695 🛡️ ASD Information Security Manual (ISM)

Timely Application of System Security Patches

Ensure non-internet-facing systems are updated within a month to protect against known vulnerabilities.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1696 🛡️ ASD Information Security Manual (ISM)

Apply Critical Patches Within 48 Hours

Apply critical security patches to certain systems within 48 hours to prevent exploits.

ML3 ASD Information Security ManualGovernance +1

View details →

ISM-1697 🛡️ ASD Information Security Manual (ISM)

Apply Non-Critical Patches Within One Month

Apply updates for driver vulnerabilities within a month if they are non-critical and have no known exploits.

ML3 ASD Information Security ManualGovernance +1

View details →

ISM-1698 🛡️ ASD Information Security Manual (ISM)

Daily Vulnerability Scanning for Missing Updates

Online services are checked daily for missing updates to prevent vulnerabilities.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1699 🛡️ ASD Information Security Manual (ISM)

Weekly Vulnerability Scanning for Software Updates

Every week, a scanner checks for software updates to fix security issues in commonly used applications.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1700 🛡️ ASD Information Security Manual (ISM)

Regular Vulnerability Scanning for Applications

A scanner is used every two weeks to find missing updates in most applications.

ML2 ASD Information Security ManualGovernance +1

View details →

ISM-1701 🛡️ ASD Information Security Manual (ISM)

Daily Vulnerability Scanning for Internet-Facing Systems

Use a daily scanner to find missing security updates on internet-facing systems to keep them secure.

ML1 Logging and monitoringASD Information Security Manual +1

View details →

ISM-1702 🛡️ ASD Information Security Manual (ISM)

Regularly Scan for Missing Security Patches

Regular checks detect missing updates on devices to fix security gaps.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1703 🛡️ ASD Information Security Manual (ISM)

Regular Vulnerability Scanning for Missing Patches

A scanner checks every two weeks to find missing security patches for drivers.

ML3 ASD Information Security ManualGovernance +1

View details →

ISM-1704 🛡️ ASD Information Security Manual (ISM)

Remove Unsupported Software to Ensure Security

Unsupported software like browsers, productivity tools, and security apps should be removed to maintain security.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1705 🛡️ ASD Information Security Manual (ISM)

Restrict Access to User Account Backups

Only backup administrators can access backups; other privileged users cannot access backups of different accounts.

ML2 ASD Information Security ManualGovernance +1

View details →

ISM-1706 🛡️ ASD Information Security Manual (ISM)

Prevent Backup Access by Privileged Users

Privileged users cannot access their own data backups; only backup administrators can.

ML3 ASD Information Security ManualGovernance +1

View details →

ISM-1707 🛡️ ASD Information Security Manual (ISM)

Restrict Backup Modifications by Privileged Users

Only backup admins can modify or delete backups; others are restricted.

ML2 ASD Information Security ManualGovernance +1

View details →

ISM-1708 🛡️ ASD Information Security Manual (ISM)

Prevent Backup Modifications During Retention

Backup administrators cannot change or delete backups until the retention period ends.

ML3 Data governanceASD Information Security Manual +1

View details →

ISM-1710 🛡️ ASD Information Security Manual (ISM)

Secure Default Settings for Wireless Access Points

Ensure wireless access points are secured by updating default settings for enhanced protection.

ASD Information Security ManualGovernance +1

View details →

ISM-1711 🛡️ ASD Information Security Manual (ISM)

Ensure User Identity Confidentiality in EAP-TLS

Use available methods to keep user identities private when using EAP-TLS for wireless network authentication.

ASD Information Security ManualGovernance +1

View details →

ISM-1712 🛡️ ASD Information Security Manual (ISM)

Ensure Secure Authenticator Communication for Wireless FT

802.11r is disabled unless secured by approved cryptographic protocol.

ASD Information Security ManualGovernance +1

View details →

ISM-1713 🛡️ ASD Information Security Manual (ISM)

Maintain and Verify a Removable Media Register

Ensure a log of removable media is kept, updated and checked regularly.

ASD Information Security ManualGovernance +1

View details →

ISM-1717 🛡️ ASD Information Security Manual (ISM)

Implement Security.txt for Vulnerability Disclosure

Ensure a 'security.txt' file is available on each website to aid in reporting vulnerabilities.

ASD Information Security ManualGovernance +1

View details →

ISM-1718 🛡️ ASD Information Security Manual (ISM)

Colour Code for SECRET Cables

SECRET cables are identified by their salmon pink colour.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-1719 🛡️ ASD Information Security Manual (ISM)

Color Code for TOP SECRET Cables

TOP SECRET cables must be red to ensure easy identification and compliance.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-1720 🛡️ ASD Information Security Manual (ISM)

Colour Coding for Secret Wall Outlet Boxes

Secret wall outlets must be salmon pink to ensure correct security level identification.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-1721 🛡️ ASD Information Security Manual (ISM)

Red Colour Coding for TOP SECRET Outlet Boxes

TOP SECRET wall outlet boxes should be painted red for easy identification.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-1722 🛡️ ASD Information Security Manual (ISM)

Methods for Destroying Electrostatic Memory Devices

Use specialized machines or incineration to securely destroy memory storage devices.

ASD Information Security ManualGovernance +1

View details →

ISM-1723 🛡️ ASD Information Security Manual (ISM)

Methods for Destroying Magnetic Floppy Disks

Magnetic floppy disks should be destroyed by burning, grinding, degaussing, or cutting to prevent data recovery.

ASD Information Security ManualGovernance +1

View details →

ISM-1724 🛡️ ASD Information Security Manual (ISM)

Methods for Destroying Magnetic Hard Disks

Magnetic hard drives must be destroyed using specific approved methods, like incinerating or degaussing.

ASD Information Security ManualGovernance +1

View details →

ISM-1725 🛡️ ASD Information Security Manual (ISM)

Methods for Destroying Magnetic Tapes

Magnetic tapes should be destroyed using specific methods like incineration or degaussing to ensure security.

ASD Information Security ManualGovernance +1

View details →

ISM-1726 🛡️ ASD Information Security Manual (ISM)

Methods for Destructing Optical Disks

Optical disks should be destroyed using various methods like incineration or grinding to ensure data is unreadable.

ASD Information Security ManualGovernance +1

View details →

ISM-1727 🛡️ ASD Information Security Manual (ISM)

Methods for Destroying Semiconductor Memory

Specialised equipment like a furnace or hammer mill is used to destroy semiconductor memory to ensure security.

ASD Information Security ManualGovernance +1

View details →

ISM-1728 🛡️ ASD Information Security Manual (ISM)

Handling Media Waste Based on Particle Size

Store shredded media differently based on particle size: OFFICIAL up to 3 mm, PROTECTED up to 6 mm, SECRET up to 9 mm.

ASD Information Security ManualGovernance +1

View details →

ISM-1729 🛡️ ASD Information Security Manual (ISM)

Storage Classification of Media Waste Particles

Store destroyed TOP SECRET media waste as OFFICIAL if under 3 mm, or as SECRET if 3-9 mm.

ASD Information Security ManualGovernance +1

View details →

ISM-1730 🛡️ ASD Information Security Manual (ISM)

Provide a Software Bill of Materials to Consumers

Ensure software users receive a detailed list of included software components.

ComplianceASD Information Security Manual +1

View details →

ISM-1731 🛡️ ASD Information Security Manual (ISM)

Coordinate Intrusion Remediation on Separate Systems

Intrusion response activities should be managed from a different system than the one that has been breached.

Incident managementASD Information Security Manual +1

View details →

ISM-1732 🛡️ ASD Information Security Manual (ISM)

Coordinated Intrusion Remediation During Planned Outages

Ensure all activities to fix intrusions happen together during scheduled downtime.

Incident managementBusiness continuity +1

View details →

ISM-1735 🛡️ ASD Information Security Manual (ISM)

Destroy Unsanitised Media Before Disposal

Media that can't be safely sanitised should be destroyed before being thrown away.

ASD Information Security ManualGovernance +1

View details →

ISM-1736 🛡️ ASD Information Security Manual (ISM)

Maintain a Register for Managed Services

Organisations must regularly keep and update a list of managed services.

ComplianceASD Information Security Manual +1

View details →

ISM-1737 🛡️ ASD Information Security Manual (ISM)

Maintain a Comprehensive Managed Service Register

Keep a detailed register of all managed services, including providers, purpose, data sensitivity, assessment schedules, and contacts.

ContractsASD Information Security Manual +1

View details →

ISM-1738 🛡️ ASD Information Security Manual (ISM)

Ensure Regular Verification of Service Provider Security

Organisations must regularly check that service providers meet agreed security standards.

AuditContracts +1

View details →

ISM-1739 🛡️ ASD Information Security Manual (ISM)

Approve Security Architecture Before System Development

Ensure system security plans are approved before starting system development.

ASD Information Security ManualGuidelines for cyber security documentation +1

View details →

ISM-1740 🛡️ ASD Information Security Manual (ISM)

Training on Business Email Compromise for Payment Handling

Staff learn about email scams that change payment details and how to report them.

Incident managementASD Information Security Manual +1

View details →

ISM-1741 🛡️ ASD Information Security Manual (ISM)

Implement IT Equipment Destruction Procedures

Create and maintain processes for safely destroying IT equipment.

ASD Information Security ManualGovernance +1

View details →

ISM-1742 🛡️ ASD Information Security Manual (ISM)

Destroy Un-sanitizable IT Equipment Safely

If IT equipment can't be cleaned properly, it must be destroyed to ensure security.

AuditASD Information Security Manual +1

View details →

ISM-1743 🛡️ ASD Information Security Manual (ISM)

Choose Secure Operating System Vendors

Choose OS vendors who prioritize secure design and memory-safe languages or practices.

ASD Information Security ManualGovernance +1

View details →

ISM-1745 🛡️ ASD Information Security Manual (ISM)

Enable Security Features for System Protection

Ensure essential security features are active to protect the system during startup.

ASD Information Security ManualGovernance +1

View details →

ISM-1746 🛡️ ASD Information Security Manual (ISM)

Restrict File System Permission Changes

Only authorised users can change file permissions for approved applications to maintain system security.

Access controlASD Information Security Manual +1

View details →

ISM-1748 🛡️ ASD Information Security Manual (ISM)

Prevent Changes to Email Client Security Settings

Users are not allowed to change the security settings on their email clients.

ASD Information Security ManualGovernance +1

View details →

ISM-1749 🛡️ ASD Information Security Manual (ISM)

Limit Cached Credentials to Single Logon

Users' credentials are stored only for their last login to enhance security.

ASD Information Security ManualGovernance +1

View details →

ISM-1750 🛡️ ASD Information Security Manual (ISM)

Segregation of Administrative Infrastructure for Server Security

Keep management systems for different types of servers separate to ensure better security.

ASD Information Security ManualGovernance +1

View details →

ISM-1751 🛡️ ASD Information Security Manual (ISM)

Timely Application of Vendor Patches for Non-Critical OS Vulnerabilities

Apply OS patches for non-critical issues within a month if no exploits exist.

ASD Information Security ManualGovernance +1

View details →

ISM-1752 🛡️ ASD Information Security Manual (ISM)

Fortnightly Vulnerability Scanning for Non-Workstations

Check non-work devices every two weeks for missing security updates.

ASD Information Security ManualGovernance +1

View details →

ISM-1753 🛡️ ASD Information Security Manual (ISM)

Replace Unsupported Internet-Facing Devices

Replace network devices that are no longer supported by manufacturers.

ASD Information Security ManualGovernance +1

View details →

ISM-1754 🛡️ ASD Information Security Manual (ISM)

Timely Resolution of Identified Software Vulnerabilities

Software vulnerabilities should be fixed quickly to prevent potential security risks.

ASD Information Security ManualGovernance +1

View details →

ISM-1755 🛡️ ASD Information Security Manual (ISM)

Develop and Maintain a Vulnerability Disclosure Policy

Organisations create and sustain a policy for reporting software vulnerabilities securely.

ASD Information Security ManualGovernance +1

View details →

ISM-1756 🛡️ ASD Information Security Manual (ISM)

Develop and Maintain Vulnerability Disclosure Processes

Organisations must create and maintain procedures for reporting software vulnerabilities.

ASD Information Security ManualGovernance +1

View details →

ISM-1759 🛡️ ASD Information Security Manual (ISM)

Ensure Strong Encryption with Diffie-Hellman

Use a minimum 3072-bit modulus for secure Diffie-Hellman key exchanges.

ASD Information Security ManualGovernance +1

View details →

ISM-1761 🛡️ ASD Information Security Manual (ISM)

Use NIST Curves for ECDH Encryption

Use specific NIST curves for secure encryption key exchanges, with P-384 preferred.

ASD Information Security ManualGovernance +1

View details →

ISM-1762 🛡️ ASD Information Security Manual (ISM)

Use NIST P-384 Curve for ECDH Keys

When using ECDH, utilise the NIST P-384 curve for better encryption security.

ASD Information Security ManualGovernance +1

View details →

ISM-1763 🛡️ ASD Information Security Manual (ISM)

Use NIST P-384 Curve for ECDSA Signatures

When signing digitally, prefer using the NIST P-384 curve for better security.

ASD Information Security ManualGovernance +1

View details →

ISM-1764 🛡️ ASD Information Security Manual (ISM)

Use NIST P-384 Curve for ECDSA Signatures

Use the NIST P-384 or P-521 curves, preferably P-384, for secure digital signatures.

ASD Information Security ManualGovernance +1

View details →

ISM-1765 🛡️ ASD Information Security Manual (ISM)

Use RSA with 3072-bit Modulus for Security

Ensure RSA uses at least a 3072-bit size for secure digital signatures and key transport.

ASD Information Security ManualGovernance +1

View details →

ISM-1766 🛡️ ASD Information Security Manual (ISM)

Ensure Secure Hashing with SHA-2 Algorithm

Use at least 224-bit SHA-2 hash, with SHA-384 or SHA-512 being preferred, to ensure strong security.

ASD Information Security ManualGovernance +1

View details →

ISM-1767 🛡️ ASD Information Security Manual (ISM)

Use SHA-2 with Minimum 256-bit Output

When using SHA-2, ensure the hash is at least 256 bits for better security.

ASD Information Security ManualGovernance +1

View details →

ISM-1768 🛡️ ASD Information Security Manual (ISM)

Use Appropriate SHA-2 Output Size for Hashing

Use SHA-2 with at least 384-bit output for secure data hashing.

ASD Information Security ManualGovernance +1

View details →

ISM-1769 🛡️ ASD Information Security Manual (ISM)

Using AES Encryption with Strong Key Lengths

Use AES encryption with a strong key length, preferably AES-256, for enhanced security.

ASD Information Security ManualGovernance +1

View details →

ISM-1770 🛡️ ASD Information Security Manual (ISM)

Utilise Strong AES Encryption Algorithms

When encrypting with AES, use stronger versions like AES-192 or preferably AES-256 for better security.

ASD Information Security ManualGovernance +1

View details →

ISM-1771 🛡️ ASD Information Security Manual (ISM)

Use AES Encryption for IPsec Connections

AES encryption, especially ENCR_AES_GCM_16, is recommended for securing internet protocol connections.

ASD Information Security ManualGovernance +1

View details →

ISM-1772 🛡️ ASD Information Security Manual (ISM)

Use Secure Pseudorandom Functions for IPsec Connections

Use secure methods for IPsec connections to ensure data integrity and security.

ASD Information Security ManualGovernance +1

View details →

ISM-1773 🛡️ ASD Information Security Manual (ISM)

Eligibility Criteria for Gateway System Administrators

Only Australian or seconded foreign nationals can manage government-only network gateways in Australia.

ASD Information Security ManualGuidelines for gateways +1

View details →

ISM-1774 🛡️ ASD Information Security Manual (ISM)

Secure Management Paths for Network Gateways

Gateways are managed separately from any networks they are connected to ensure security.

ASD Information Security ManualGuidelines for gateways +1

View details →

ISM-1778 🛡️ ASD Information Security Manual (ISM)

Quarantine Security-Noncompliant Data for Review

Noncompliant data is quarantined for review before system entry when imported manually.

ComplianceASD Information Security Manual +1

View details →

ISM-1779 🛡️ ASD Information Security Manual (ISM)

Quarantine Data Failing Security Checks During Manual Export

Data failing security checks during manual export is quarantined until reviewed for approval.

ComplianceASD Information Security Manual +1

View details →

ISM-1780 🛡️ ASD Information Security Manual (ISM)

Apply SecDevOps for Secure Software Development

Use DevOps practices focused on security to develop software safely and securely.

ASD Information Security ManualGovernance +1

View details →

ISM-1781 🛡️ ASD Information Security Manual (ISM)

Ensure All Network Data is Encrypted

Make sure all data sent over any network is protected by encryption.

ASD Information Security ManualGovernance +1

View details →

ISM-1782 🛡️ ASD Information Security Manual (ISM)

Use Protective DNS to Block Malicious Domains

A service that prevents access to harmful website addresses.

ASD Information Security ManualGovernance +1

View details →

ISM-1783 🛡️ ASD Information Security Manual (ISM)

Secure BGP with Valid ROA for IP Addresses

Ensure public IP addresses are protected by valid Route Origin Authorisation records to enhance security.

ASD Information Security ManualGuidelines for gateways +1

View details →

ISM-1784 🛡️ ASD Information Security Manual (ISM)

Annual Testing of Cyber Incident Response Plan

The organisation tests its cyber incident response plan every year to ensure it's effective.

ASD Information Security ManualGuidelines for cyber security incidents +1

View details →

ISM-1785 🛡️ ASD Information Security Manual (ISM)

Develop and Maintain Supplier Management Policy

Ensure a policy is in place for managing relationships with suppliers in a consistent manner.

ASD Information Security ManualGovernance +1

View details →

ISM-1786 🛡️ ASD Information Security Manual (ISM)

Maintain an Approved Supplier List

Ensure a list of approved suppliers is created, used, and kept updated.

ASD Information Security ManualGovernance +1

View details →

ISM-1787 🛡️ ASD Information Security Manual (ISM)

Ensure Suppliers are Approved for IT and OT Sourcing

Ensure systems and equipment are bought from pre-approved suppliers to mitigate risks.

ASD Information Security ManualGovernance +1

View details →

ISM-1788 🛡️ ASD Information Security Manual (ISM)

Identify Multiple Suppliers for Critical IT Sourcing

Ensure multiple suppliers are considered for sourcing essential IT systems and services to reduce supply chain risks.

ASD Information Security ManualGovernance +1

View details →

ISM-1789 🛡️ ASD Information Security Manual (ISM)

Verify Authenticity for Delivery Acceptance in Supply Chain

Ensure all software, hardware, and services are genuine before accepting them for use.

Supplier managementASD Information Security Manual +1

View details →

ISM-1790 🛡️ ASD Information Security Manual (ISM)

Ensure Integrity in IT and OT Deliveries

Deliveries of IT and OT systems should be made securely to prevent tampering or integrity loss.

ASD Information Security ManualGovernance +1

View details →

ISM-1791 🛡️ ASD Information Security Manual (ISM)

Assess Integrity of Delivered IT and OT Products

Check the integrity of IT and OT products before accepting them to ensure they're safe and reliable.

ContractsSupplier management +1

View details →

ISM-1792 🛡️ ASD Information Security Manual (ISM)

Assess Authenticity of IT and OT Deliveries

Ensure that software and equipment are genuine before accepting them.

Supplier managementASD Information Security Manual +1

View details →

ISM-1793 🛡️ ASD Information Security Manual (ISM)

Regular Assessment of Managed Service Providers

Managed service providers must be assessed for security compliance every 24 months.

ComplianceASD Information Security Manual +1

View details →

ISM-1794 🛡️ ASD Information Security Manual (ISM)

Notify Significant Changes to Service Provider Agreements

Service providers must inform clients at least one month in advance of major changes to their contracts.

ContractsSupplier management +1

View details →

ISM-1795 🛡️ ASD Information Security Manual (ISM)

Set 30-Character Minimum for Key Administrator Passwords

Ensure key system accounts use passwords that are at least 30 characters long to enhance security.

ASD Information Security ManualGovernance +1

View details →

ISM-1796 🛡️ ASD Information Security Manual (ISM)

Digitally Sign Executable Software for Security

Executable files must have a digital signature verified by a trusted certificate to ensure security.

ASD Information Security ManualGovernance +1

View details →

ISM-1797 🛡️ ASD Information Security Manual (ISM)

Ensure Software Updates are Securely Signed

Make sure software updates and patches are securely signed to verify they are authentic and untampered.

ASD Information Security ManualGovernance +1

View details →

ISM-1798 🛡️ ASD Information Security Manual (ISM)

Develop Secure Configuration Guidelines for Software

Provide users with guides to securely set up software configurations.

ASD Information Security ManualGovernance +1

View details →

ISM-1799 🛡️ ASD Information Security Manual (ISM)

Enforce Email Rejection for Failed DMARC Checks

Emails not verified by DMARC are blocked to enhance email security.

ASD Information Security ManualGovernance +1

View details →

ISM-1800 🛡️ ASD Information Security Manual (ISM)

Ensure Network Devices Have Trusted Firmware

Network devices must be installed with trusted firmware before their first use to prevent security risks.

ASD Information Security ManualGovernance +1

View details →

ISM-1801 🛡️ ASD Information Security Manual (ISM)

Perform Monthly Restarts of Network Devices

Restart network devices every month to maintain reliability and performance.

ASD Information Security ManualGovernance +1

View details →

ISM-1802 🛡️ ASD Information Security Manual (ISM)

Operate Approved High Assurance Cryptographic Equipment

Use approved high-security cryptographic tools according to Australian guidelines.

ComplianceASD Information Security Manual +1

View details →

ISM-1803 🛡️ ASD Information Security Manual (ISM)

Document and Report Cyber Security Incidents

Keep a record of cyber incidents including dates, actions, and reporting details.

ASD Information Security ManualGuidelines for cyber security incidents +1

View details →

ISM-1804 🛡️ ASD Information Security Manual (ISM)

Include Break Clauses in Cloud Service Contracts

Contracts must have clauses that allow termination if security requirements aren't met by service providers.

ComplianceContracts +1

View details →

ISM-1805 🛡️ ASD Information Security Manual (ISM)

Develop a Denial of Service Response Plan

Create a plan to detect, maintain, and respond to service disruptions in video and telephony systems.

ASD Information Security ManualGovernance +1

View details →

ISM-1806 🛡️ ASD Information Security Manual (ISM)

Change Default User Credentials During Setup

Change or remove default user accounts when setting up applications to enhance security.

ASD Information Security ManualGovernance +1

View details →

ISM-1807 🛡️ ASD Information Security Manual (ISM)

Automated Asset Discovery for Vulnerability Scanning

Automatically find devices every two weeks to check for security problems.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1808 🛡️ ASD Information Security Manual (ISM)

Vulnerability Scanning with Updated Tools

Ensure vulnerability scanners are updated regularly to identify system weaknesses.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1809 🛡️ ASD Information Security Manual (ISM)

Implement Compensating Controls for Unsupported Systems

When systems can't be updated or replaced, use temporary security measures.

ASD Information Security ManualGovernance +1

View details →

ISM-1810 🛡️ ASD Information Security Manual (ISM)

Ensuring Data Backup Synchronisation

Backups should be in sync to restore everything to the same time point when needed.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1811 🛡️ ASD Information Security Manual (ISM)

Secure and Resilient Data Backup Retention

Ensure backups of data and applications are stored safely and can withstand issues.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1812 🛡️ ASD Information Security Manual (ISM)

Restrict Backup Access to Unprivileged Users

Ensure that users without special permissions cannot see other people's backups.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1813 🛡️ ASD Information Security Manual (ISM)

Prevent Unauthorised User Access to Backup Data

Ensure that regular user accounts cannot view or restore their own backup files for security reasons.

ML3 ASD Information Security ManualGovernance +1

View details →

ISM-1814 🛡️ ASD Information Security Manual (ISM)

Prevent Backup Modifications by Unprivileged Users

Only authorised users can change or delete backups, keeping data safe from unauthorised access.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1815 🛡️ ASD Information Security Manual (ISM)

Protect Event Logs from Unauthorised Access

Ensure logs are safe from changes or deletion by unauthorised users.

ML2 Logging and monitoringAccess control +1

View details →

ISM-1816 🛡️ ASD Information Security Manual (ISM)

Prevent Unauthorised Changes to Software Sources

Ensure software source is protected against unauthorised changes to maintain integrity.

ASD Information Security ManualGovernance +1

View details →

ISM-1817 🛡️ ASD Information Security Manual (ISM)

Secure API Access with Authentication and Authorisation

Ensure only authorised clients can access sensitive data via network APIs over the internet.

ASD Information Security ManualGovernance +1

View details →

ISM-1818 🛡️ ASD Information Security Manual (ISM)

Client Authentication for Network API Access

Ensure clients are verified before they change data through network APIs on the internet.

ASD Information Security ManualGovernance +1

View details →

ISM-1819 🛡️ ASD Information Security Manual (ISM)

Enact Cyber Security Incident Response Plans

When a cyber incident is identified, the organisation activates its response plan.

ML2 ASD Information Security ManualGuidelines for cyber security incidents +1

View details →

ISM-1820 🛡️ ASD Information Security Manual (ISM)

Ensure Consistent Cable Colours for Systems

Use the same colour cables for each separate system to avoid confusion.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-1821 🛡️ ASD Information Security Manual (ISM)

Ensuring Exclusive Bundling for TOP SECRET Cables

TOP SECRET cables must be in separate bundles or conduits to ensure security.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-1822 🛡️ ASD Information Security Manual (ISM)

Standardised Colour for Wall Outlet Boxes

Ensure wall outlet boxes have the same colour for each system for consistency.

ASD Information Security ManualGuidelines for communications infrastructure +1

View details →

ISM-1823 🛡️ ASD Information Security Manual (ISM)

Prevent Users from Changing Security Settings in Apps

Users can't change security settings in office software, keeping configurations secure.

ML2 Logging and monitoringASD Information Security Manual +1

View details →

ISM-1824 🛡️ ASD Information Security Manual (ISM)

Prevent Changes to PDF Application Security Settings

Users are restricted from changing security settings in PDF applications.

ML2 ASD Information Security ManualGovernance +1

View details →

ISM-1825 🛡️ ASD Information Security Manual (ISM)

Ensure Security Configuration Is Immutable by Users

Users cannot modify the security settings of security products.

ASD Information Security ManualGovernance +1

View details →

ISM-1826 🛡️ ASD Information Security Manual (ISM)

Select Vendors Committed to Secure Design for Servers

Choose server vendors who ensure secure designs and use safe programming practices.

ASD Information Security ManualGovernance +1

View details →

ISM-1827 🛡️ ASD Information Security Manual (ISM)

Use Dedicated Admin Accounts for Domain Controllers

Ensure domain controllers have unique admin accounts not used elsewhere for better security.

ASD Information Security ManualGovernance +1

View details →

ISM-1828 🛡️ ASD Information Security Manual (ISM)

Disable Print Spooler on AD DS Domain Controllers

Ensure the Print Spooler is turned off on AD DS domain controllers for security.

ASD Information Security ManualGovernance +1

View details →

ISM-1829 🛡️ ASD Information Security Manual (ISM)

Prevent Password Storage in Group Policy Preferences

Make sure passwords aren't saved in Group Policy Preferences for added security.

ASD Information Security ManualGovernance +1

View details →

ISM-1830 🛡️ ASD Information Security Manual (ISM)

Central Logging for Microsoft AD Server Activities

Log important actions on Microsoft AD servers in a central location for better monitoring.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-1832 🛡️ ASD Information Security Manual (ISM)

SPN Configuration for Active Directory Accounts

Only specialised accounts should have SPNs to increase security in Active Directory setups.

ASD Information Security ManualGovernance +1

View details →

ISM-1833 🛡️ ASD Information Security Manual (ISM)

Limit Privileges for User Accounts in Active Directory

User accounts are set up with just the access they need, nothing extra.

ASD Information Security ManualGovernance +1

View details →

ISM-1834 🛡️ ASD Information Security Manual (ISM)

Ensure No Duplicate SPNs in Active Directory

Make sure there are no duplicate identifiers for network services in the organisation's Active Directory system.

ASD Information Security ManualGovernance +1

View details →

ISM-1835 🛡️ ASD Information Security Manual (ISM)

Restrict Delegation of Privileged Active Directory Accounts

Ensure privileged accounts are marked as sensitive and cannot be delegated to maintain security.

ASD Information Security ManualGovernance +1

View details →

ISM-1836 🛡️ ASD Information Security Manual (ISM)

Require Kerberos Pre-Authentication for User Accounts

All user accounts need extra verification when logging in for better security.

ASD Information Security ManualGovernance +1

View details →

ISM-1837 🛡️ ASD Information Security Manual (ISM)

Ensure User Account Passwords Are Configured Properly

Make sure user accounts always require passwords that expire regularly.

ASD Information Security ManualGovernance +1

View details →

ISM-1838 🛡️ ASD Information Security Manual (ISM)

Restrict UserPassword Attribute in AD Accounts

The UserPassword field should not be used to ensure account security.

ASD Information Security ManualGovernance +1

View details →

ISM-1839 🛡️ ASD Information Security Manual (ISM)

Secure Account Properties in Active Directory

Do not use account fields that everyone can see to store passwords.

ASD Information Security ManualGovernance +1

View details →

ISM-1840 🛡️ ASD Information Security Manual (ISM)

Prevent Reversible Encryption of User Passwords

User account passwords must not be stored in a way that allows them to be easily decrypted.

ASD Information Security ManualGovernance +1

View details →

ISM-1841 🛡️ ASD Information Security Manual (ISM)

Restrict Domain Joining to Admin Users Only

Only authorised users can add computers to the network to maintain security.

ASD Information Security ManualGovernance +1

View details →

ISM-1842 🛡️ ASD Information Security Manual (ISM)

Use Privileged Accounts for Domain Machine Addition

Special accounts are used for adding computers to the network for security purposes.

ASD Information Security ManualGovernance +1

View details →

ISM-1843 🛡️ ASD Information Security Manual (ISM)

Annual Review of Unconstrained Delegation in AD Accounts

Annually review AD accounts for unnecessary delegation and remove if no business need.

Access controlASD Information Security Manual +1

View details →

ISM-1844 🛡️ ASD Information Security Manual (ISM)

Prevent Non-Controller Accounts from Delegating Services

Ensure non-domain controller accounts can't be used to delegate services in Active Directory.

ASD Information Security ManualGovernance +1

View details →

ISM-1845 🛡️ ASD Information Security Manual (ISM)

Disable User Security Group Access in Active Directory

When a user is disabled, they lose access to all security groups.

ASD Information Security ManualGovernance +1

View details →

ISM-1846 🛡️ ASD Information Security Manual (ISM)

Restrict Pre-Windows 2000 Access Group Membership

Ensure no user accounts are added to the obsolete security group for better system security.

ASD Information Security ManualGovernance +1

View details →

ISM-1847 🛡️ ASD Information Security Manual (ISM)

Regularly Change KRBTGT Credentials for Security

Change KRBTGT credentials twice annually or after a suspected domain compromise.

ASD Information Security ManualGovernance +1

View details →

ISM-1848 🛡️ ASD Information Security Manual (ISM)

Replace Unsupported Software in Server Isolation

Replace software when it's no longer supported to maintain server isolation.

ASD Information Security ManualGovernance +1

View details →

ISM-1849 🛡️ ASD Information Security Manual (ISM)

Implement OWASP Top 10 in Web Development

Use OWASP Top 10 controls to secure web applications during development.

ASD Information Security ManualGovernance +1

View details →

ISM-1850 🛡️ ASD Information Security Manual (ISM)

Mitigate OWASP Top 10 in Web Applications

Developers need to address the OWASP Top 10 security risks in web applications to enhance security.

Security testingASD Information Security Manual +1

View details →

ISM-1851 🛡️ ASD Information Security Manual (ISM)

Secure Development Using OWASP API Security Top 10

Web API developers must address the top 10 security risks identified by OWASP to ensure safety.

Vulnerability managementASD Information Security Manual +1

View details →

ISM-1852 🛡️ ASD Information Security Manual (ISM)

Limit Unprivileged Access to Essential Functions

Users can only access what they need to do their work, nothing extra.

ASD Information Security ManualAccess control +1

View details →

ISM-1854 🛡️ ASD Information Security Manual (ISM)

Require User Authentication for Multifunction Devices

Users must log in to use MFDs for printing, scanning, or copying.

ASD Information Security ManualGuidelines for information technology equipment +1

View details →

ISM-1855 🛡️ ASD Information Security Manual (ISM)

Central Logging of Multifunction Device Use

Uses of multifunction devices are logged centrally for tracking purposes.

Logging and monitoringAudit +1

View details →

ISM-1858 🛡️ ASD Information Security Manual (ISM)

Implement Strict IT Equipment Hardening Guidelines

Use the most restrictive security guidelines to secure IT equipment from unauthorised access.

ASD Information Security ManualGovernance +1

View details →

ISM-1859 🛡️ ASD Information Security Manual (ISM)

Hardening Office Productivity Suites

Secure your office apps using the strictest guidance from ASD and vendors to keep your data safe.

ML2 ASD Information Security ManualGovernance +1

View details →

ISM-1860 🛡️ ASD Information Security Manual (ISM)

Harden PDF Applications Using ASD Guidance

Ensure PDF applications are securely configured following official security guidelines.

ML2 ASD Information Security ManualGovernance +1

View details →

ISM-1861 🛡️ ASD Information Security Manual (ISM)

Enable Local Security Authority Protection

Ensure the system has measures to secure login details against unauthorized access.

ML3 ASD Information Security ManualGovernance +1

View details →

ISM-1862 🛡️ ASD Information Security Manual (ISM)

Restrict Access and Conceal Web Server IP Addresses

Avoid revealing server IPs and limit access exclusively to WAFs and authorised networks.

ASD Information Security ManualGovernance +1

View details →

ISM-1863 🛡️ ASD Information Security Manual (ISM)

Restrict Exposure of Network Management Interfaces

IT equipment management interfaces should not be accessible from the internet to enhance security.

ASD Information Security ManualGovernance +1

View details →

ISM-1864 🛡️ ASD Information Security Manual (ISM)

Develop and Enforce a System Usage Policy

Create and regularly update a policy that dictates how systems should be used within the organisation.

ASD Information Security ManualAccess control +1

View details →

ISM-1865 🛡️ ASD Information Security Manual (ISM)

Compliance with System Usage Policies for Access

Employees must agree to follow system rules before they can access it.

ASD Information Security ManualAccess control +1

View details →

ISM-1866 🛡️ ASD Information Security Manual (ISM)

Prevent Storing Classified Data on Personal Devices

Personnel cannot keep classified data on their own mobile devices or computers.

ASD Information Security ManualGuidelines for enterprise mobility +1

View details →

ISM-1867 🛡️ ASD Information Security Manual (ISM)

Use Approved Mobile Platforms for Sensitive Access

Mobile devices must use evaluated platforms for secure access to sensitive systems or data.

ASD Information Security ManualGovernance +1

View details →

ISM-1868 🛡️ ASD Information Security Manual (ISM)

Restrictions on Mobile Device Removable Media

SECRET and TOP SECRET devices need ASD approval to use removable media.

ASD Information Security ManualGovernance +1

View details →

ISM-1869 🛡️ ASD Information Security Manual (ISM)

Maintain Non-Networked IT Equipment Register

Regularly keep a list of IT equipment that is not connected to networks.

ASD Information Security ManualGovernance +1

View details →

ISM-1870 🛡️ ASD Information Security Manual (ISM)

Implement Application Control for User Profiles and Folders

Ensure user and temporary folders for systems, browsers, and emails are secured via application control.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1871 🛡️ ASD Information Security Manual (ISM)

Implement Application Control Exclusions for System Areas

Application control is set up to avoid certain system areas like user profiles and temporary folders.

ML2 ASD Information Security ManualGovernance +1

View details →

ISM-1872 🛡️ ASD Information Security Manual (ISM)

Ensuring Phishing-Resistant Multi-Factor Authentication

Users must use multi-factor authentication that resists phishing when accessing online services.

ML2 ASD Information Security ManualGovernance +1

View details →

ISM-1873 🛡️ ASD Information Security Manual (ISM)

Enhance Security with Phishing-Resistant MFA

Online services should use multi-factor authentication that cannot be easily tricked by phishing.

ML2 ASD Information Security ManualGovernance +1

View details →

ISM-1874 🛡️ ASD Information Security Manual (ISM)

Phishing-Resistant Multi-Factor Authentication for Customers

Online services use multi-step security to prevent phishing attacks during customer login.

ML3 ASD Information Security ManualGovernance +1

View details →

ISM-1875 🛡️ ASD Information Security Manual (ISM)

Monthly Network Scans for Clear-Text Credentials

Monthly scans check for passwords or credentials that are not encrypted.

ASD Information Security ManualGovernance +1

View details →

ISM-1876 🛡️ ASD Information Security Manual (ISM)

Apply Critical Patches Within 48 Hours

Install critical patches for online services within 48 hours when notified by the vendor or if exploits are present.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1877 🛡️ ASD Information Security Manual (ISM)

Timely Application of Critical Security Patches

Apply critical patches to online systems within 48 hours to prevent vulnerability exploits.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1878 🛡️ ASD Information Security Manual (ISM)

Apply Critical Patches Within 48 Hours

Critical system updates must be installed within 48 hours to prevent security risks.

ASD Information Security ManualGovernance +1

View details →

ISM-1879 🛡️ ASD Information Security Manual (ISM)

Timely Patching of Critical Driver Vulnerabilities

Critical driver vulnerabilities must be fixed within 48 hours to prevent exploits.

ML3 ASD Information Security ManualGovernance +1

View details →

ISM-1880 🛡️ ASD Information Security Manual (ISM)

Timely Reporting of Cyber Incidents Involving Customer Data

Notify customers and the public promptly about cybersecurity incidents involving their data.

Incident managementASD Information Security Manual +1

View details →

ISM-1881 🛡️ ASD Information Security Manual (ISM)

Timely Reporting of Cyber Incidents Without Data Breach

Inform customers about cyber incidents quickly if no customer data is involved.

Incident managementASD Information Security Manual +1

View details →

ISM-1882 🛡️ ASD Information Security Manual (ISM)

Procurement from Transparent Suppliers

Ensure vendors are transparent about their products and services before purchasing.

ContractsASD Information Security Manual +1

View details →

ISM-1883 🛡️ ASD Information Security Manual (ISM)

Restrict Privileged Access to Necessary Service Duties

Only necessary access is allowed for users to perform their duties online.

ML1 Access controlASD Information Security Manual +1

View details →

ISM-1884 🛡️ ASD Information Security Manual (ISM)

Ensure Compliance with Emanation Security Doctrine

Organisations must follow guidelines for managing information leaks through electromagnetic emissions.

ASD Information Security ManualGuidelines for information technology equipment +1

View details →

ISM-1885 🛡️ ASD Information Security Manual (ISM)

Implement TEMPEST Measures for System Security

System owners must follow TEMPEST guidelines to protect against information leaks.

ASD Information Security ManualGuidelines for information technology equipment +1

View details →

ISM-1886 🛡️ ASD Information Security Manual (ISM)

Ensure Mobile Devices Operate in Supervised Mode

Mobile devices must be set to a supervised mode to maintain security controls.

GovernanceASD Information Security Manual +1

View details →

ISM-1887 🛡️ ASD Information Security Manual (ISM)

Implement Remote Locate and Wipe for Mobile Security

Mobile devices should be set up to be located and wiped remotely to ensure security.

ASD Information Security ManualGovernance +1

View details →

ISM-1888 🛡️ ASD Information Security Manual (ISM)

Ensure Secure Lock Screens on Mobile Devices

Make sure that mobile devices have secure lock screens to prevent unauthorized access.

ASD Information Security ManualGovernance +1

View details →

ISM-1889 🛡️ ASD Information Security Manual (ISM)

Central Logging of Command Line Events

Track all command line actions by keeping a central log of every new process initiated via the command shell.

ML2 Logging and monitoringASD Information Security Manual +1

View details →

ISM-1890 🛡️ ASD Information Security Manual (ISM)

Ensure Macros Are Free of Malicious Code

Verify that Microsoft Office macros are safe before signing or storing them in trusted locations.

ML3 ASD Information Security ManualGovernance +1

View details →

ISM-1891 🛡️ ASD Information Security Manual (ISM)

Restrict Non-V3 Signed Macros in Microsoft Office

Microsoft Office can't enable macros signed with old methods via common interfaces.

ML3 ASD Information Security ManualGovernance +1

View details →

ISM-1892 🛡️ ASD Information Security Manual (ISM)

Implement Multi-factor Authentication for Customer Services

Use multi-factor authentication to protect access to sensitive customer data online.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1893 🛡️ ASD Information Security Manual (ISM)

Enforcing Multi-Factor Authentication for User Security

Users must use multi-factor authentication to access third-party services handling sensitive data.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1894 🛡️ ASD Information Security Manual (ISM)

Ensuring Phishing-Resistant Multi-factor Authentication

Ensure multi-factor authentication resists phishing attempts for secure data access.

ML3 ASD Information Security ManualGovernance +1

View details →

ISM-1895 🛡️ ASD Information Security Manual (ISM)

Log Single-factor Authentication Events

Keep track of successful and unsuccessful single-factor login attempts.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-1896 🛡️ ASD Information Security Manual (ISM)

Enable Memory Integrity for Credential Protection

Ensure memory integrity is activated to safeguard credential data.

ML3 ASD Information Security ManualGovernance +1

View details →

ISM-1897 🛡️ ASD Information Security Manual (ISM)

Enable Remote Credential Guard for Credential Protection

Activating Remote Credential Guard helps prevent unauthorised access to security credentials.

ML3 ASD Information Security ManualGovernance +1

View details →

ISM-1898 🛡️ ASD Information Security Manual (ISM)

Use Secure Admin Workstations for Administration

Use special secure computers for admin tasks to protect sensitive data.

ML3 ASD Information Security ManualGovernance +1

View details →

ISM-1899 🛡️ ASD Information Security Manual (ISM)

Restrict Unauthorised Network Connections

Devices outside the network can't establish connections with administration systems.

ASD Information Security ManualGovernance +1

View details →

ISM-1900 🛡️ ASD Information Security Manual (ISM)

Fortnightly System Vulnerability Scanning

Scan systems every two weeks to find and fix unpatched security flaws.

ML3 ASD Information Security ManualGovernance +1

View details →

ISM-1901 🛡️ ASD Information Security Manual (ISM)

Timely Application of Non-Critical Security Patches

Apply non-critical software patches within two weeks to maintain system security.

ML3 ASD Information Security ManualGovernance +1

View details →

ISM-1902 🛡️ ASD Information Security Manual (ISM)

Apply Non-Critical Patches to Non-Internet Systems Promptly

Ensure non-critical security patches are applied within a month if no active threats are identified.

ML3 ASD Information Security ManualGovernance +1

View details →

ISM-1903 🛡️ ASD Information Security Manual (ISM)

Rapid Application of Critical Firmware Patches

Install critical firmware updates within 48 hours to protect systems from known vulnerabilities.

ML3 ASD Information Security ManualGovernance +1

View details →

ISM-1904 🛡️ ASD Information Security Manual (ISM)

Apply Firmware Patches for Non-Critical Vulnerabilities

Install patches for minor firmware issues within a month if there're no immediate threats.

ML3 ASD Information Security ManualGovernance +1

View details →

ISM-1905 🛡️ ASD Information Security Manual (ISM)

Disclosure of Software Vulnerabilities Responsibly

Share software flaws publicly in a careful and quick manner to ensure security.

ML1 ASD Information Security ManualGovernance +1

View details →

ISM-1906 🛡️ ASD Information Security Manual (ISM)

Timely Analysis of Internet-Facing Server Logs

Organisations must quickly review logs from online servers to spot potential security threats.

ML2 Logging and monitoringASD Information Security Manual +1

View details →

ISM-1907 🛡️ ASD Information Security Manual (ISM)

Timely Analysis of Non-Internet-Server Logs

Examine logs from servers not facing the internet promptly to find security issues.

ML3 Logging and monitoringASD Information Security Manual +1

View details →

ISM-1908 🛡️ ASD Information Security Manual (ISM)

Responsible Disclosure of Software Vulnerabilities

Software weaknesses must be reported openly and quickly, using standard classification systems.

ASD Information Security ManualGovernance +1

View details →

ISM-1909 🛡️ ASD Information Security Manual (ISM)

Perform Root Cause Analysis for Vulnerabilities

Analyse the cause of issues and fix related vulnerabilities completely.

Incident managementASD Information Security Manual +1

View details →

ISM-1910 🛡️ ASD Information Security Manual (ISM)

Log Network API Calls for Data Protection

Ensure API calls over the internet that change or access sensitive data are logged centrally.

AuditLogging and monitoring +1

View details →

ISM-1911 🛡️ ASD Information Security Manual (ISM)

Centralised Logging of Software Errors and Usage

Important software activities and errors are logged to a central system for security tracking.

Logging and monitoringIncident management +1

View details →

ISM-1912 🛡️ ASD Information Security Manual (ISM)

Document Device Settings for Critical and High-Value Servers

Keep records of settings for important servers and network devices to ensure strong network security.

ASD Information Security ManualGovernance +1

View details →

ISM-1913 🛡️ ASD Information Security Manual (ISM)

Develop and Maintain Approved IT Configurations

Ensure IT equipment is set up with approved configurations to enhance security.

ASD Information Security ManualGovernance +1

View details →

ISM-1914 🛡️ ASD Information Security Manual (ISM)

Ensure Operating Systems Have Approved Configurations

Organisations must create and maintain approved configurations for all operating systems.

ASD Information Security ManualGovernance +1

View details →

ISM-1915 🛡️ ASD Information Security Manual (ISM)

Ensure User Application Configurations are Approved

Make sure that all user applications follow approved setup guidelines to keep systems secure.

ASD Information Security ManualGovernance +1

View details →

ISM-1916 🛡️ ASD Information Security Manual (ISM)

Ensure Server Application Configurations Are Approved

Organisations should create and maintain approved settings for server software to ensure security.

ASD Information Security ManualGovernance +1

View details →

ISM-1917 🛡️ ASD Information Security Manual (ISM)

Support Post-Quantum Cryptographic Algorithms by 2030

New cryptographic tools must support specific secure algorithms by 2030 to be ready for future quantum computing.

ComplianceASD Information Security Manual +1

View details →

ISM-1918 🛡️ ASD Information Security Manual (ISM)

Regular Cyber Security Reporting to Audit Committee

The CISO reports cyber security updates directly to the organisation's risk committee.

AuditIncident management +1

View details →

ISM-1919 🛡️ ASD Information Security Manual (ISM)

Disable Non-MFA Authentication Protocols

Ensures systems only use multi-factor authentication by disabling less secure protocols.

ASD Information Security ManualGovernance +1

View details →

ISM-1920 🛡️ ASD Information Security Manual (ISM)

Prevent Self-enrollment on Untrusted Devices

Users cannot set up multi-factor authentication on devices that aren't trusted to ensure data security.

ASD Information Security ManualGovernance +1

View details →

ISM-1921 🛡️ ASD Information Security Manual (ISM)

Assess System Compromise Risks Often

Regularly check how likely systems can be hacked due to known vulnerabilities.

ASD Information Security ManualGovernance +1

View details →

ISM-1922 🛡️ ASD Information Security Manual (ISM)

Use OWASP Standards in Mobile App Development

Developers use OWASP standards to enhance security in mobile app creation.

ASD Information Security ManualGovernance +1

View details →

ISM-1924 🛡️ ASD Information Security Manual (ISM)

Preventing Prompt Injection in AI Applications

AI apps must check user inputs to stop harmful or unintended content creation.

ASD Information Security ManualGovernance +1

View details →

ISM-1926 🛡️ ASD Information Security Manual (ISM)

Ensure Exclusive Usage of Microsoft AD Servers

Ensure Microsoft AD servers only run their intended roles, no additional apps unless security-related.

ASD Information Security ManualGovernance +1

View details →

ISM-1927 🛡️ ASD Information Security Manual (ISM)

Restrict Access to Microsoft Active Directory Servers

Only privileged users should access key Microsoft servers for security.

ASD Information Security ManualGovernance +1

View details →

ISM-1928 🛡️ ASD Information Security Manual (ISM)

Secure and Encrypt Backups of AD Servers

Microsoft AD server backups must be secure, encrypted, and only accessible to backup admins.

ASD Information Security ManualGovernance +1

View details →

ISM-1929 🛡️ ASD Information Security Manual (ISM)

Ensure LDAP Signing on AD DS Domain Controllers

Make sure AD servers use secure communication to prevent unauthorised access.

ASD Information Security ManualGovernance +1

View details →

ISM-1930 🛡️ ASD Information Security Manual (ISM)

Prevent Storing Passwords in Group Policy Preferences

Ensure passwords are not saved in Group Policy to enhance security.

ASD Information Security ManualGovernance +1

View details →

ISM-1931 🛡️ ASD Information Security Manual (ISM)

Ensure SID Filtering for Domain and Forest Trusts

Enable SID filtering for enhanced security between domain and forest trusts.

ASD Information Security ManualGovernance +1

View details →

ISM-1932 🛡️ ASD Information Security Manual (ISM)

Limit Service Accounts with SPNs in Active Directory

Reduce the number of special accounts to improve security in Active Directory.

ASD Information Security ManualGovernance +1

View details →

ISM-1933 🛡️ ASD Information Security Manual (ISM)

Restrict DCSync Permissions on Service Accounts

Ensure service accounts with SPNs can't simulate domain controller operations.

ASD Information Security ManualGovernance +1

View details →

ISM-1934 🛡️ ASD Information Security Manual (ISM)

Annual Review of DCSync Permissions

Review DCSync user permissions yearly and remove them if no longer needed.

ASD Information Security ManualGovernance +1

View details →

ISM-1935 🛡️ ASD Information Security Manual (ISM)

Prevent Unconstrained Delegation in Domain Services

Ensure computer accounts do not allow unrestricted delegation to protect security.

ASD Information Security ManualGovernance +1

View details →

ISM-1936 🛡️ ASD Information Security Manual (ISM)

Prevent Usage of sIDHistory in User Accounts

Ensure user accounts do not use the sIDHistory attribute for security purposes.

ASD Information Security ManualGovernance +1

View details →

ISM-1937 🛡️ ASD Information Security Manual (ISM)

Weekly Audit of sIDHistory in User Accounts

Check user accounts weekly to ensure they don't have the sIDHistory attribute.

AuditASD Information Security Manual +1

View details →

ISM-1938 🛡️ ASD Information Security Manual (ISM)

Restrict Domain Computers Group in Active Directory

Prevent Domain Computers from changing anything in Active Directory for security.

Access controlASD Information Security Manual +1

View details →

ISM-1939 🛡️ ASD Information Security Manual (ISM)

Limit Domain and Enterprise Admin Group Memberships

Reduce the number of users in highly privileged groups for better security.

ASD Information Security ManualGovernance +1

View details →

ISM-1940 🛡️ ASD Information Security Manual (ISM)

Restrict Service Accounts from Privileged AD Groups

Ensure service accounts are not part of high-level admin groups in Active Directory.

ASD Information Security ManualGovernance +1

View details →

ISM-1941 🛡️ ASD Information Security Manual (ISM)

Restrict Computer Accounts from Privileged Groups

Ensure computer accounts don't have high-level admin privileges within Active Directory.

ASD Information Security ManualGovernance +1

View details →

ISM-1942 🛡️ ASD Information Security Manual (ISM)

Restrict Domain Computers from Privileged Groups

Ensure that Domain Computers aren't part of privileged security groups for better security.

ASD Information Security ManualGovernance +1

View details →

ISM-1943 🛡️ ASD Information Security Manual (ISM)

Enforce Certificate and User Mapping in AD Services

Ensure certificates are accurately matched to users within Active Directory.

ASD Information Security ManualGovernance +1

View details →

ISM-1944 🛡️ ASD Information Security Manual (ISM)

Configuration Changes in Active Directory Certificate Services

Ensure a specific security flag is not configured in Microsoft AD CS to maintain system integrity.

ASD Information Security ManualGovernance +1

View details →

ISM-1945 🛡️ ASD Information Security Manual (ISM)

Remove Enrollee Supplies Subject Flag from Templates

Ensure certificate templates do not allow users to supply their own subject information.

ASD Information Security ManualGovernance +1

View details →

ISM-1946 🛡️ ASD Information Security Manual (ISM)

Restrict Write Access to Certificate Templates

Ensure regular users can't change certificate templates to maintain security.

ASD Information Security ManualGovernance +1

View details →

ISM-1947 🛡️ ASD Information Security Manual (ISM)

Remove User Authentication from Extended Key Usages

Ensure that Extended Key Usages do not allow user authentication.

ASD Information Security ManualGovernance +1

View details →

ISM-1948 🛡️ ASD Information Security Manual (ISM)

Approval for Certificate Template SANs in AD Services

Approval is needed before using certificate templates that let you specify extra names.

ASD Information Security ManualGovernance +1

View details →

ISM-1949 🛡️ ASD Information Security Manual (ISM)

Use Dedicated Accounts for AD FS Administration

AD FS servers should be managed using special accounts not shared with other systems.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-1950 🛡️ ASD Information Security Manual (ISM)

Disable Soft Matching After Synchronisation

Ensure soft matching is turned off after syncing Microsoft AD DS with Microsoft Entra ID to enhance security.

Identity & access managementASD Information Security Manual +1

View details →

ISM-1951 🛡️ ASD Information Security Manual (ISM)

Disable Hard Match Takeover in Microsoft Entra Connect

Ensure that the hard match feature is turned off to prevent unauthorised access in Microsoft Entra Connect servers.

ASD Information Security ManualGovernance +1

View details →

ISM-1952 🛡️ ASD Information Security Manual (ISM)

Prevent Synchronisation of Privileged Accounts

Ensure privileged accounts aren't synced between Microsoft AD DS and Entra ID for security reasons.

ASD Information Security ManualGovernance +1

View details →

ISM-1953 🛡️ ASD Information Security Manual (ISM)

Ensure Strong Management of Admin Account Credentials

Make sure admin account passwords in each domain are long, unique, and securely managed.

ASD Information Security ManualGovernance +1

View details →

ISM-1954 🛡️ ASD Information Security Manual (ISM)

Enforce Random Credentials for Administrator Accounts

Ensure admin and service account passwords are randomly generated to improve security.

ASD Information Security ManualGovernance +1

View details →

ISM-1955 🛡️ ASD Information Security Manual (ISM)

Regularly Change Compromised Credentials

Change computer account passwords every 30 days or if they're compromised or suspected to be.

ASD Information Security ManualGovernance +1

View details →

ISM-1956 🛡️ ASD Information Security Manual (ISM)

Regularly Update AD FS Certificates to Prevent Risks

AD FS certificates must be updated twice quickly if compromised or not updated within a year to enhance security.

ASD Information Security ManualGovernance +1

View details →

ISM-1957 🛡️ ASD Information Security Manual (ISM)

Ensure CA Servers Use Hardware Security Modules

Microsoft AD CS private keys need a hardware module for secure storage.

ASD Information Security ManualGovernance +1

View details →

ISM-1958 🛡️ ASD Information Security Manual (ISM)

Prevent Unauthorised Access for DCSync Accounts

Users with certain permissions can't access less secure systems to maintain security.

ASD Information Security ManualGovernance +1

View details →

ISM-1959 🛡️ ASD Information Security Manual (ISM)

Ensure Consistent Formatting for Event Logs

Event logs should be stored in a consistent format to ensure reliable data tracking.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-1960 🛡️ ASD Information Security Manual (ISM)

Timely Analysis of Event Logs for Cybersecurity

Internet-facing device logs are quickly reviewed to find security issues.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-1961 🛡️ ASD Information Security Manual (ISM)

Timely Analysis of Network Device Event Logs

Analyse logs from internal network devices quickly to detect security events.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-1962 🛡️ ASD Information Security Manual (ISM)

Disable SMBv1 Protocol on Networks

Ensure SMB version 1 is not active on network systems to enhance security.

ASD Information Security ManualGovernance +1

View details →

ISM-1963 🛡️ ASD Information Security Manual (ISM)

Central Logging of Events on Internet-Facing Devices

Important events on internet-connected network devices are logged in a central location for security.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-1964 🛡️ ASD Information Security Manual (ISM)

Central Logging for Network Device Events

Logs activities from internal network devices to keep track of security-related events.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-1965 🛡️ ASD Information Security Manual (ISM)

Content Checking for Imported or Exported Files

Files passing through gateways or data systems are checked to ensure they meet security requirements.

ASD Information Security ManualGovernance +1

View details →

ISM-1966 🛡️ ASD Information Security Manual (ISM)

Register Management of Organisational Systems

The CISO keeps an updated list of all systems used by the organisation.

AuditASD Information Security Manual +1

View details →

ISM-1967 🛡️ ASD Information Security Manual (ISM)

Ensure Security Assessment of TOP SECRET Systems

System owners and officers ensure TOP SECRET systems are correctly assessed for security measures.

ASD Information Security ManualGuidelines for cyber security roles +1

View details →

ISM-1968 🛡️ ASD Information Security Manual (ISM)

Authorization for Operating High-Security Systems

System owners need authorization to operate highly secure systems after assessing related security risks.

Risk managementASD Information Security Manual +1

View details →

ISM-1969 🛡️ ASD Information Security Manual (ISM)

Preventing Accidental Execution of Malicious Code

Ensure malicious code cannot accidentally run by treating it before storage or communication.

ASD Information Security ManualGuidelines for cyber security incidents +1

View details →

ISM-1970 🛡️ ASD Information Security Manual (ISM)

Use Dedicated Environments for Malicious Code Analysis

Malicious software is studied in separate, secure systems to prevent it from harming other networks or devices.

Incident managementASD Information Security Manual +1

View details →

ISM-1971 🛡️ ASD Information Security Manual (ISM)

Security Assessments for TOP SECRET Managed Services

TOP SECRET managed services must undergo security checks by ASD assessors every two years.

ComplianceASD Information Security Manual +1

View details →

ISM-1972 🛡️ ASD Information Security Manual (ISM)

Security Assessments for Top Secret Cloud Services

Cloud providers' secret services need security checks every two years by authorised assessors.

ComplianceASD Information Security Manual +1

View details →

ISM-1973 🛡️ ASD Information Security Manual (ISM)

Secure Facilities for Non-Classified Systems

Ensure non-classified systems are located in secure buildings to prevent unauthorised access.

Physical securityASD Information Security Manual +1

View details →

ISM-1974 🛡️ ASD Information Security Manual (ISM)

Securing Non-Classified IT Equipment in Secure Rooms

Non-classified IT equipment should be placed in secure rooms to prevent unauthorized physical access.

Physical securityASD Information Security Manual +1

View details →

ISM-1975 🛡️ ASD Information Security Manual (ISM)

Secure Non-Classified Equipment in Safe Containers

Secure non-classified equipment in secure containers to protect against unauthorized physical access.

Physical securityASD Information Security Manual +1

View details →

ISM-1976 🛡️ ASD Information Security Manual (ISM)

Central Logging of Security Events on macOS

Ensure security events on macOS systems are logged centrally for monitoring.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-1977 🛡️ ASD Information Security Manual (ISM)

Central Logging of Linux System Events

Important Linux system events should be logged in a central location for security purposes.

AuditLogging and monitoring +1

View details →

ISM-1978 🛡️ ASD Information Security Manual (ISM)

Centralised Logging for Server Application Events

Log important events centrally for applications on internet-facing servers for security monitoring.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-1979 🛡️ ASD Information Security Manual (ISM)

Central Logging for Security Events on Servers

Record important server activities in a central system to monitor non-internet-connected servers.

AuditLogging and monitoring +1

View details →

ISM-1980 🛡️ ASD Information Security Manual (ISM)

Avoid Using Credential Hints in Systems

Systems should not use hints to reveal or guess passwords.

ASD Information Security ManualGovernance +1

View details →

ISM-1981 🛡️ ASD Information Security Manual (ISM)

Replace Unsupportable Non-Internet Network Devices

Replace network devices not supported by vendors to maintain security.

ASD Information Security ManualGovernance +1

View details →

ISM-1982 🛡️ ASD Information Security Manual (ISM)

Replace Unsupported Networked IT Equipment

Replace networked IT equipment when vendors no longer provide support.

ASD Information Security ManualGovernance +1

View details →

ISM-1983 🛡️ ASD Information Security Manual (ISM)

Timely Centralisation of Event Logs

Ensure event logs are quickly sent to a central logging facility to keep track of important activities.

AuditLogging and monitoring +1

View details →

ISM-1984 🛡️ ASD Information Security Manual (ISM)

Ensure Encryption of Event Logs in Transit

Event logs must be encrypted when being sent to a central system to protect sensitive information.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-1985 🛡️ ASD Information Security Manual (ISM)

Protect Event Logs from Unauthorised Access

Ensure that only authorised individuals can view or access event logs.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-1986 🛡️ ASD Information Security Manual (ISM)

Timely Analysis of Critical Server Event Logs

Event logs from important servers are quickly reviewed to find security issues.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-1987 🛡️ ASD Information Security Manual (ISM)

Timely Analysis of Security Event Logs

Security event logs are reviewed promptly to identify cyber threats.

Logging and monitoringIncident management +1

View details →

ISM-1988 🛡️ ASD Information Security Manual (ISM)

Ensure Event Logs Are Retained for 12 Months

Keep event logs searchable and accessible for at least 12 months to help in audits or investigations.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-1989 🛡️ ASD Information Security Manual (ISM)

Ensure Event Logs Meet Retention Requirements

Event logs must be kept according to the retention rules set by the National Archives of Australia.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-1990 🛡️ ASD Information Security Manual (ISM)

Adhering to Recommended FIPS Publications for ML-DSA and ML-KEM

Follow recommended guidelines when using new cryptographic methods to enhance security against future threats.

ComplianceASD Information Security Manual +1

View details →

ISM-1991 🛡️ ASD Information Security Manual (ISM)

Implement ML-DSA for Enhanced Digital Signature Security

Use ML-DSA algorithms, preferring ML-DSA-87, for secure digital signatures.

ASD Information Security ManualGovernance +1

View details →

ISM-1992 🛡️ ASD Information Security Manual (ISM)

Using Hedged Variant of ML-DSA for Digital Signatures

Use the more secure version of ML-DSA for digital signatures to minimise risks.

ASD Information Security ManualGovernance +1

View details →

ISM-1993 🛡️ ASD Information Security Manual (ISM)

Use Pre-Hashed ML-DSA Variants Only When Necessary

Only use alternate ML-DSA signatures if the standard version is too slow.

ASD Information Security ManualGovernance +1

View details →

ISM-1994 🛡️ ASD Information Security Manual (ISM)

Use Correct Hashing for ML-DSA Pre-hashed Variants

Ensure stronger hashes like SHA-384 or SHA-512 are used with ML-DSA digital signatures for added security.

ASD Information Security ManualGovernance +1

View details →

ISM-1995 🛡️ ASD Information Security Manual (ISM)

Use ML-KEM for Secure Key Encapsulation

Ensure encryption keys are protected using recommended ML-KEM-768 or ML-KEM-1024 methods.

ASD Information Security ManualGovernance +1

View details →

ISM-1996 🛡️ ASD Information Security Manual (ISM)

Using Hybrid Schemes for Secure Encryption

Ensure at least one encryption method is approved for strong protection against future quantum threats.

ASD Information Security ManualGovernance +1

View details →

ISM-1997 🛡️ ASD Information Security Manual (ISM)

Define Cyber Security Roles for Leadership

The board sets specific cyber security roles and duties for themselves and the whole organisation.

Policy, rules and standards complianceASD Information Security Manual +1

View details →

ISM-1998 🛡️ ASD Information Security Manual (ISM)

Integrate Cyber Security Across Business Functions

Leaders ensure cyber security is a part of every business area.

ASD Information Security ManualGovernance +1

View details →

ISM-1999 🛡️ ASD Information Security Manual (ISM)

Align Cyber Security with Business Strategy

Leadership ensures cyber security strategy aligns with the company's overall business direction.

ASD Information Security ManualGovernance +1

View details →

ISM-2000 🛡️ ASD Information Security Manual (ISM)

Regular Cyber Security Briefings for Executives

Executives receive regular updates on cyber security and threats from experts.

ASD Information Security ManualGuidelines for cyber security roles +1

View details →

ISM-2001 🛡️ ASD Information Security Manual (ISM)

Championing Cyber Security at an Executive Level

Executives set a good example to promote a healthy cyber security culture in the organisation.

ASD Information Security ManualGuidelines for cyber security roles +1

View details →

ISM-2002 🛡️ ASD Information Security Manual (ISM)

Ensure Board Cyber Security Literacy for Compliance

Executive leaders must understand cyber security to meet legal and regulatory responsibilities.

ComplianceASD Information Security Manual +1

View details →

ISM-2003 🛡️ ASD Information Security Manual (ISM)

Monitor Cyber Security Workforce and Skill Gaps

Executives should stay informed on hiring and skills gaps in their cyber security team.

ASD Information Security ManualGuidelines for cyber security roles +1

View details →

ISM-2004 🛡️ ASD Information Security Manual (ISM)

Enhancing Cyber Security Skills and Experience

The board supports cyber security training for all staff using internal and external opportunities.

ASD Information Security ManualGuidelines for cyber security roles +1

View details →

ISM-2005 🛡️ ASD Information Security Manual (ISM)

Understand Critical Systems and Their Security

Board members must know their systems' importance, what they protect, and how well they're secured.

AuditASD Information Security Manual +1

View details →

ISM-2006 🛡️ ASD Information Security Manual (ISM)

Executive Planning for Cyber Incident Preparedness

Executives must plan and practice handling major cyber incidents to know their responsibilities.

Incident managementBusiness continuity +1

View details →

ISM-2007 🛡️ ASD Information Security Manual (ISM)

Maintain a Register for Medical Devices in Secure Areas

Keep an updated list of approved medical devices for secure areas like SECRET and TOP SECRET zones.

ASD Information Security ManualPhysical security +1

View details →

ISM-2008 🛡️ ASD Information Security Manual (ISM)

Regulations for Bringing Medical Devices into Secure Areas

Medical devices in high-security areas must be approved and safe, with limited connectivity.

ASD Information Security ManualPhysical security +1

View details →

ISM-2009 🛡️ ASD Information Security Manual (ISM)

Secure Network API Client Authentication and Authorisation

Ensure clients using network APIs for data changes are authenticated and authorised, especially if not internet-accessible.

ASD Information Security ManualPhysical security +1

View details →

ISM-2010 🛡️ ASD Information Security Manual (ISM)

Ensure SPNs Use Strong Encryption in AD Services

Service accounts in Active Directory must use strong encryption to secure their SPNs.

ASD Information Security ManualGovernance +1

View details →

ISM-2011 🛡️ ASD Information Security Manual (ISM)

Restrict MFA Options to Phishing-resistant Only

Ensure accounts using strong, phishing-proof MFA can't use less secure authentication methods.

ASD Information Security ManualGovernance +1

View details →

ISM-2012 🛡️ ASD Information Security Manual (ISM)

Ensure Secure Screen Locking on Systems

Systems must lock screens after 15 minutes of inactivity, requiring full re-authentication to unlock without allowing the lock to be disabled.

Clear desk and screenASD Information Security Manual +1

View details →

ISM-2013 🛡️ ASD Information Security Manual (ISM)

Ensure Client Authentication for Internal Network APIs

Make sure apps inside your network check who accesses them and what they can do, before allowing data changes.

ASD Information Security ManualGovernance +1

View details →

ISM-2014 🛡️ ASD Information Security Manual (ISM)

Ensure API Client Authentication and Authorization

Check and confirm who can use certain non-internet APIs to access restricted data.

ASD Information Security ManualGovernance +1

View details →

ISM-2015 🛡️ ASD Information Security Manual (ISM)

Central Logging of Non-Internet Network API Data Access

All network API data changes not shared online must be logged centrally.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-2016 🛡️ ASD Information Security Manual (ISM)

Ensure Input Validation and Sanitisation for Security

Software must check and clean all local network inputs to prevent security issues.

ASD Information Security ManualGovernance +1

View details →

ISM-2017 🛡️ ASD Information Security Manual (ISM)

Ensure DNS Traffic is Encrypted When Supported

DNS data is encrypted whenever possible for added security.

ASD Information Security ManualGovernance +1

View details →

ISM-2018 🛡️ ASD Information Security Manual (ISM)

Secure BGP Routing with RPKI-Registered IP Addresses

Routers reject or down-rank invalid IP address routes to enhance BGP security.

ASD Information Security ManualGuidelines for gateways +1

View details →

ISM-2019 🛡️ ASD Information Security Manual (ISM)

Routine Security Assessments for TOP SECRET Gateways

TOP SECRET gateways are reviewed for security by authorised assessors every two years.

ASD Information Security ManualGuidelines for gateways +1

View details →

ISM-2020 🛡️ ASD Information Security Manual (ISM)

Ensure Adequate Cyber Security Personnel Are Acquired

The CISO must recruit qualified cyber security staff to support the organisation's activities.

ASD Information Security ManualGuidelines for cyber security roles +1

View details →

ISM-2021 🛡️ ASD Information Security Manual (ISM)

Implement and Maintain Data Minimisation Practices

System owners should limit data collection and storage to what's necessary.

ASD Information Security ManualGuidelines for cyber security roles +1

View details →

ISM-2022 🛡️ ASD Information Security Manual (ISM)

Develop and Maintain Cyber Security Training Register

Maintain a record of all cyber security awareness training activities within an organisation.

ASD Information Security ManualGovernance +1

View details →

ISM-2023 🛡️ ASD Information Security Manual (ISM)

Maintain a Reliable Source for Software

Ensure a trustworthy source for software is available and maintained consistently.

ASD Information Security ManualGovernance +1

View details →

ISM-2024 🛡️ ASD Information Security Manual (ISM)

Utilise Authoritative Sources in Software Development

Use only official sources for all software development tasks to ensure accuracy and reliability.

ASD Information Security ManualGovernance +1

View details →

ISM-2025 🛡️ ASD Information Security Manual (ISM)

Using Issue Tracking for Software Development Tasks

Connect software tasks with security and change issues using an issue tracking tool.

ASD Information Security ManualGovernance +1

View details →

ISM-2026 🛡️ ASD Information Security Manual (ISM)

Scan Software Artefacts for Malicious Code

All software is checked for harmful code before it enters the main software repository.

ASD Information Security ManualGovernance +1

View details →

ISM-2027 🛡️ ASD Information Security Manual (ISM)

Verify Software Artefacts with Digital Signatures

Ensure all software is authenticated with a digital signature or secure hash before use.

ASD Information Security ManualGovernance +1

View details →

ISM-2028 🛡️ ASD Information Security Manual (ISM)

Test Third-Party Software for Security Flaws

Ensure third-party software is security tested before use and during development.

ASD Information Security ManualGovernance +1

View details →

ISM-2029 🛡️ ASD Information Security Manual (ISM)

Restrict Third-Party Libraries to Trustworthy Sources

Only use third-party libraries from reliable sources to ensure software security.

ASD Information Security ManualGovernance +1

View details →

ISM-2030 🛡️ ASD Information Security Manual (ISM)

Prevent Storing Secrets in Software Repositories

Code commits are scanned for secrets to ensure they aren't saved in the main software repository.

ASD Information Security ManualGovernance +1

View details →

ISM-2031 🛡️ ASD Information Security Manual (ISM)

Secure System Build Tools Implementation

Use security features in compilers and build tools to secure your software's executable files.

ASD Information Security ManualGovernance +1

View details →

ISM-2032 🛡️ ASD Information Security Manual (ISM)

Ensure Automated Tests Are Completed Before Building

Before creating software, complete all automated tests without errors or warnings.

Security testingASD Information Security Manual +1

View details →

ISM-2033 🛡️ ASD Information Security Manual (ISM)

Document and Maintain Software Security Requirements

Ensure software security needs are documented and securely kept throughout all development stages.

ASD Information Security ManualGovernance +1

View details →

ISM-2034 🛡️ ASD Information Security Manual (ISM)

Document and Review Security Design in Development

Keep track of and check security choices throughout software development to ensure safety.

ASD Information Security ManualGovernance +1

View details →

ISM-2035 🛡️ ASD Information Security Manual (ISM)

Document Security Roles and Knowledge for Development

Define and document roles and skills needed for secure software development.

ASD Information Security ManualGovernance +1

View details →

ISM-2036 🛡️ ASD Information Security Manual (ISM)

Document Security Duties for Software Developers

Clearly define and document what software developers must do to ensure security.

ASD Information Security ManualGovernance +1

View details →

ISM-2037 🛡️ ASD Information Security Manual (ISM)

Training for Secure Software Development Skills

Developers lacking cyber security skills must be trained in secure programming practices.

ASD Information Security ManualGovernance +1

View details →

ISM-2038 🛡️ ASD Information Security Manual (ISM)

Maintain Developer Cyber Security Skills Register

Keep a record of software developers' cybersecurity skills and knowledge.

ASD Information Security ManualGovernance +1

View details →

ISM-2039 🛡️ ASD Information Security Manual (ISM)

Review Threat Model During Software Development

Regularly update the software threat model to match current and changing threats.

ASD Information Security ManualGovernance +1

View details →

ISM-2040 🛡️ ASD Information Security Manual (ISM)

Ensure Secure Programming Practices in Software Development

Develop software using secure programming methods tailored to the chosen language to prevent vulnerabilities.

ASD Information Security ManualGovernance +1

View details →

ISM-2041 🛡️ ASD Information Security Manual (ISM)

Ensure Use of Memory-Safe Programming Practices

Use programming languages that prevent memory errors to enhance security in software development.

ASD Information Security ManualGovernance +1

View details →

ISM-2042 🛡️ ASD Information Security Manual (ISM)

Ensuring Security in Software Development Lifecycle

Security features must be included and enabled in software from the start, at no extra cost to users.

ASD Information Security ManualGovernance +1

View details →

ISM-2043 🛡️ ASD Information Security Manual (ISM)

Ensuring Readable and Maintainable Software Architecture

Ensure that software design is clear and easy to update.

ASD Information Security ManualGovernance +1

View details →

ISM-2044 🛡️ ASD Information Security Manual (ISM)

Prevent Default Credentials in Software Installations

Ensure software does not come with default passwords; new credentials are set during installation.

ASD Information Security ManualGovernance +1

View details →

ISM-2045 🛡️ ASD Information Security Manual (ISM)

Ensure Backwards Compatibility Doesn't Weaken Security

Make sure older software versions retain security when new updates are made.

ASD Information Security ManualGovernance +1

View details →

ISM-2046 🛡️ ASD Information Security Manual (ISM)

Ensure Secure Impersonation Logging Practices

Ensure no sensitive information is recorded in logs and permissions are correctly set when users can impersonate others.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-2047 🛡️ ASD Information Security Manual (ISM)

Notify Users of Authentication Resets via Secondary Channel

When a software authentication factor is reset, users are informed through an additional communication method.

ASD Information Security ManualGovernance +1

View details →

ISM-2048 🛡️ ASD Information Security Manual (ISM)

Restrict Non-Admins from Changing Permissions

Non-admin users can't change their own permissions or privileges in software with multiple user roles.

Access controlASD Information Security Manual +1

View details →

ISM-2049 🛡️ ASD Information Security Manual (ISM)

Enforcing Re-authentication After Permission Changes

Users must log in again if their account permissions change.

ASD Information Security ManualGovernance +1

View details →

ISM-2050 🛡️ ASD Information Security Manual (ISM)

Validate Digital Signature Certificates Securely

Software checks digital signatures against trusted certificates and ensures they haven't been revoked.

ASD Information Security ManualGovernance +1

View details →

ISM-2051 🛡️ ASD Information Security Manual (ISM)

Ensure Event Logs for Cybersecurity Event Detection

Software should create logs to help detect security incidents.

Logging and monitoringIncident management +1

View details →

ISM-2052 🛡️ ASD Information Security Manual (ISM)

Ensure Event Logs Protect Sensitive Data

Event logs must keep sensitive information safe and secured.

Logging and monitoringData governance +1

View details →

ISM-2053 🛡️ ASD Information Security Manual (ISM)

Establish Software End of Life Procedures

Create and share guidelines for safely removing and managing old software and user data.

ASD Information Security ManualGovernance +1

View details →

ISM-2054 🛡️ ASD Information Security Manual (ISM)

Ensure No Vulnerabilities in Third-Party Software Components

Use available software bill of materials to check third-party components for vulnerabilities during development.

ASD Information Security ManualGovernance +1

View details →

ISM-2055 🛡️ ASD Information Security Manual (ISM)

Ensure Software Components Meet Build Standards

Use available build history for third-party software to verify it meets standards during development.

ASD Information Security ManualGovernance +1

View details →

ISM-2056 🛡️ ASD Information Security Manual (ISM)

Provide Provenance for Software Builds

Ensure that details about how software is created are available to its users.

ASD Information Security ManualGovernance +1

View details →

ISM-2057 🛡️ ASD Information Security Manual (ISM)

Ensure Comprehensive Input Validation in Software

All software inputs must be validated and tested to prevent issues or errors.

Security testingASD Information Security Manual +1

View details →

ISM-2058 🛡️ ASD Information Security Manual (ISM)

Ensure Data Validation Before Deserialisation

Check data is correct before converting it from storage format to usable format to prevent issues.

Logging and monitoringASD Information Security Manual +1

View details →

ISM-2059 🛡️ ASD Information Security Manual (ISM)

Restrict and Scan File Uploads for Security

Ensure only certain file types are accepted and scanned for viruses before being accessed, executed, or stored.

ASD Information Security ManualGovernance +1

View details →

ISM-2060 🛡️ ASD Information Security Manual (ISM)

Ensure Code Reviews Support Secure Design

Code reviews check if software follows secure design and programming practices.

Security testingASD Information Security Manual +1

View details →

ISM-2061 🛡️ ASD Information Security Manual (ISM)

Conduct Security-Focused Peer Reviews on Software

Developers review important software to ensure it is secure.

ASD Information Security ManualGovernance +1

View details →

ISM-2062 🛡️ ASD Information Security Manual (ISM)

Effective Software Security through Testing

Use tests to ensure software is secure and works well, considering both good and bad scenarios.

Security testingASD Information Security Manual +1

View details →

ISM-2063 🛡️ ASD Information Security Manual (ISM)

Ensure Web App Cookies Have Security Flags

Web apps should use secure cookie settings to protect user sessions.

ASD Information Security ManualGovernance +1

View details →

ISM-2064 🛡️ ASD Information Security Manual (ISM)

Ensure Secure Cookies with Signed Bearer Tokens

Web cookies should use signed tokens to prevent tampering and ensure security.

ASD Information Security ManualGovernance +1

View details →

ISM-2065 🛡️ ASD Information Security Manual (ISM)

Ensure Secure Session Cookies with High Entropy Tokens

Web apps should use random session cookie identifiers with high entropy to ensure security.

ASD Information Security ManualGovernance +1

View details →

ISM-2066 🛡️ ASD Information Security Manual (ISM)

Centralised Management of Web Application Sessions

Web apps use a server to handle and secure user sessions instead of relying on the user's device.

ASD Information Security ManualGovernance +1

View details →

ISM-2067 🛡️ ASD Information Security Manual (ISM)

Ensure Single Logout for Single Sign-On Web Applications

Web apps with Single Sign-On should also log users out from all connected services.

ASD Information Security ManualGovernance +1

View details →

ISM-2068 🛡️ ASD Information Security Manual (ISM)

Restrict Internet Access for Networked Devices

Limit internet connection only to devices that need it to ensure security.

ASD Information Security ManualGovernance +1

View details →

ISM-2069 🛡️ ASD Information Security Manual (ISM)

Register Photographic Devices in Secure Areas

Keep a regularly updated list of authorised photo and video devices in high-security areas.

ASD Information Security ManualPhysical security +1

View details →

ISM-2070 🛡️ ASD Information Security Manual (ISM)

Control Access to Recording Devices in Secure Areas

Prevent unauthorised devices from entering areas where sensitive information is kept.

ASD Information Security ManualPhysical security +1

View details →

ISM-2071 🛡️ ASD Information Security Manual (ISM)

Training on Managing Social Engineering Threats

Staff handling user accounts learn to identify and handle social engineering threats.

Incident managementASD Information Security Manual +1

View details →

ISM-2072 🛡️ ASD Information Security Manual (ISM)

Ensure AI Models are Stored Securely

AI models must be kept in a format that prevents them from running unwanted code.

ASD Information Security ManualGovernance +1

View details →

ISM-2073 🛡️ ASD Information Security Manual (ISM)

Develop a Post-Quantum Cryptography Transition Plan

Create and maintain a plan to move to cryptographic methods that are secure against quantum computing threats.

ASD Information Security ManualGovernance +1

View details →

ISM-2074 🛡️ ASD Information Security Manual (ISM)

Establish AI Usage Policy for Systems Access

Organisations must create and maintain a policy for using AI in general-purpose settings.

ASD Information Security ManualAccess control +1

View details →

ISM-2075 🛡️ ASD Information Security Manual (ISM)

Prohibit the Use of Fax Machines for Messages

Fax machines and online fax services should not be used to send or receive messages.

ASD Information Security ManualGovernance +1

View details →

ISM-2076 🛡️ ASD Information Security Manual (ISM)

Eliminating Security Questions for Authentication

Authentication should not use security questions as they can be easily compromised.

ASD Information Security ManualGovernance +1

View details →

ISM-2077 🛡️ ASD Information Security Manual (ISM)

Avoid Email for Out-of-Band Authentication

Do not use email for secondary authentication steps to increase security.

ASD Information Security ManualGovernance +1

View details →

ISM-2078 🛡️ ASD Information Security Manual (ISM)

Ensure Passwords Are Not Common or Compromised

Make sure passwords aren't from known compromised or common password lists to enhance security.

ASD Information Security ManualGovernance +1

View details →

ISM-2079 🛡️ ASD Information Security Manual (ISM)

Ensure Password Length is at Least 64 Characters

Passwords must allow a maximum length of at least 64 characters for increased security.

ASD Information Security ManualGovernance +1

View details →

ISM-2080 🛡️ ASD Information Security Manual (ISM)

No Password Complexity Requirements Enforced

Passwords do not need to follow strict complexity rules.

ASD Information Security ManualGovernance +1

View details →

ISM-2081 🛡️ ASD Information Security Manual (ISM)

Enforce Use of All ASCII Characters in Passwords

Allow any printable character to be used in passwords for increased complexity.

ASD Information Security ManualGovernance +1

View details →

ISM-2082 🛡️ ASD Information Security Manual (ISM)

Using Cryptographic BOM in Software Development

Ensure imported software uses standard encryption by checking its cryptographic details.

ASD Information Security ManualGovernance +1

View details →

ISM-2083 🛡️ ASD Information Security Manual (ISM)

Provide a Cryptographic Bill of Materials to Software Users

Software producers must give users a list of all cryptographic components used in the software.

Supplier managementSecure SDLC +1

View details →

ISM-2084 🛡️ ASD Information Security Manual (ISM)

Document AI Model Characteristics and Risks

Use specific documentation to detail AI models, their architecture, usage, and potential security risks.

ComplianceASD Information Security Manual +1

View details →

ISM-2085 🛡️ ASD Information Security Manual (ISM)

Prevent Exposure of AI Model Confidence Scores

Ensure AI model confidence scores are not shown to users or in API outputs.

ASD Information Security ManualGovernance +1

View details →

ISM-2086 🛡️ ASD Information Security Manual (ISM)

Verify AI Model Source and Integrity

Ensure AI models and their details are authentic and unchanged.

Supplier managementASD Information Security Manual +1

View details →

ISM-2087 🛡️ ASD Information Security Manual (ISM)

Ensuring Integrity of AI Model Training Data

Verify the source and integrity of data used to train AI models to prevent poisoning.

ASD Information Security ManualGovernance +1

View details →

ISM-2088 🛡️ ASD Information Security Manual (ISM)

Ensuring AI Training Data Integrity

Ensure AI models are trained with accurate and reliable data through validation techniques.

ASD Information Security ManualGovernance +1

View details →

ISM-2089 🛡️ ASD Information Security Manual (ISM)

Monitor and Investigate AI Model Anomalies

Keep track of AI model performance and check any unusual results.

Logging and monitoringIncident management +1

View details →

ISM-2090 🛡️ ASD Information Security Manual (ISM)

Rate Limiting for AI Model Inference Queries

Limit how often AI queries are run to prevent system overuse and improve efficiency.

ContractsASD Information Security Manual +1

View details →

ISM-2091 🛡️ ASD Information Security Manual (ISM)

Enforce Resource Limits on AI Models

AI models must have limits to prevent excessive resource use.

ASD Information Security ManualGovernance +1

View details →

ISM-2092 🛡️ ASD Information Security Manual (ISM)

Implement Fine-Grained AI Application Permissions

Organisations set detailed access rules to control who can use artificial intelligence applications.

ASD Information Security ManualGovernance +1

View details →

ISM-2093 🛡️ ASD Information Security Manual (ISM)

Restrict Access to AI Data with Role-Based Controls

Access to sensitive AI data is restricted using roles to ensure only authorised personnel can view it.

ASD Information Security ManualGovernance +1

View details →

ISM-2094 🛡️ ASD Information Security Manual (ISM)

AI Content Filtering to Protect Sensitive Data

AI systems filter data to prevent leaks or improper sharing of sensitive information.

ASD Information Security ManualGovernance +1

View details →