Australian Information Security Manual

Guidelines for software development

Australian Information Security Manual ISM-2016: Validation and sanitisation are performed on all input received over a local network by so

Validation and sanitisation are performed on all input received over a local network by software.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Guidelines for software development

ISM-0400 Development, testing, staging and production environments are segregated.
ISM-0401 Secure by Design principles and practices are followed throughout the software development
ISM-0402 Software is comprehensively tested for vulnerabilities, using SAST, DAST and SCA prior to
ISM-0971 The OWASP Application Security Verification Standard is used in the development of web app
ISM-1238 Threat modelling is used in support of the software development life cycle.
ISM-1239 Robust web application frameworks are used in the development of web applications.
ISM-1240 Validation and sanitisation are performed on all input received over the internet by softw
ISM-1241 Output encoding is performed on all output produced by web applications.

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Australian Information Security Manual controls