Australian Information Security Manual ISM-1163: Continuous monitoring plan

Systems have a continuous monitoring plan that includes: - conducting vulnerability scans for systems at least fortnightly - conducting vulnerability assessments and penetration tests for systems prior to deployment, including prior to deployment of significant changes, and at least annually thereafter - analysing identified vulnerabilities to determine their potential impact - implementing mitigations based on risk, effectiveness and cost.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

What else in your programme already covers this

This control maps to 8 controls across 4 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

CIS Controls v8 · 3 controls

CIS-18.1 Establish and Maintain a Penetration Testing Program
CIS-18.2 Perform Periodic External Penetration Tests
CIS-7.1 Establish and Maintain a Vulnerability Management Process

NIST Cybersecurity Framework 2.0 · 3 controls

NIST-CSF-ID.IM-01 Improvements are identified from evaluations
NIST-CSF-ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded
NIST-CSF-ID.RA-04 Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded

ISO 27002:2022 · 1 control

8.8 Management of technical vulnerabilities

New Zealand Information Security Manual (NZISM) · 1 control

6.2.5.C.01 6.2.5.C.01 Baseline vulnerability assessments and their triggers

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.