Australian Information Security Manual

Guidelines for software development

Australian Information Security Manual ISM-2057: All input validation rules are documented, matched in code and tested with both positive a

All input validation rules are documented, matched in code and tested with both positive and negative unit testing or integration testing.

Other controls in Guidelines for software development

ISM-0400 Development, testing, staging and production environments are segregated.
ISM-0401 Secure by Design principles and practices are followed throughout the software development
ISM-0402 Software is comprehensively tested for vulnerabilities, using SAST, DAST and SCA prior to
ISM-0971 The OWASP Application Security Verification Standard is used in the development of web app
ISM-1238 Threat modelling is used in support of the software development life cycle.
ISM-1239 Robust web application frameworks are used in the development of web applications.
ISM-1240 Validation and sanitisation are performed on all input received over the internet by softw
ISM-1241 Output encoding is performed on all output produced by web applications.

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Australian Information Security Manual controls