ASD Information Security Manual (ISM)

Australia

vJune 2025

33 domains

166 controls

The Australian Signals Directorate Information Security Manual is the Australian Government's primary cyber security framework. It provides a comprehensive set of cyber security principles and guidelines for protecting systems and data at all classification levels. The ISM contains over 870 controls organized across system hardening, management, monitoring, development, networking, cryptography, gateways, and data transfer guidelines.

Verified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (33)

Access

1 controls

Controls in the Access domain of ASD Information Security Manual (ISM) — 1 controls
Code	Title	Description
ISM-AC-1	Access Control	Provision, review, and revoke access on a least privilege and need-to-know basis.

Backup and Recovery

5 controls

Chapter 12: Data backup, restoration, and digital preservation

Controls in the Backup and Recovery domain of ASD Information Security Manual (ISM) — 5 controls
Code	Title	Description
ISM-1511	Backups performed	Backups of important data, software and configuration are performed and retained.
ISM-1515	Restoration Testing	Restoration of data, applications and settings from backups is tested as part of disaster recovery exercises.
ISM-1705	Backup Access Restriction	Unprivileged access to backups of other users' data, applications and settings is prevented.
ISM-1810	Backup immutability	Backups are protected from unauthorised modification or deletion, including by ransomware.
ISM-1811	Resilient Backup Storage	Backups are retained in a secure and resilient manner.

Cryptography

3 controls

Controls in the Cryptography domain of ASD Information Security Manual (ISM) — 12 controls
Code	Title	Description
ISM-0459	Data at Rest Encryption	Full disk or partial disk encryption is implemented for data at rest on all classified media.
ISM-0476	RSA Key Length	RSA is used with a modulus of at least 2048 bits (3072 bits preferred).
ISM-0484	SSH Hardening	SSH is hardened using vendor and ASD guidance.
ISM-1139	TLS minimum version	TLS 1.2 is the minimum used; TLS 1.3 is preferred. Older versions are disabled.
ISM-1369	TLS Encryption Algorithm	AES in Galois/Counter Mode is used for TLS encryption.
ISM-1453	Perfect Forward Secrecy	Perfect forward secrecy is used for all TLS connections.
ISM-1506	SSH v1 Disabled	SSH version 1 is disabled to prevent use of insecure protocol.
ISM-1553	TLS Compression Disabled	TLS compression is disabled to prevent information leakage.
ISM-1917	Post-Quantum Readiness	New development supports ML-DSA-87 and ML-KEM-1024 post-quantum cryptographic algorithms by 2030.
ISM-CR-1	Cryptographic Fundamentals	Use ASD-approved cryptographic algorithms and protocols (AACP/AACA) appropriate for the classification.
ISM-CR-2	Key Management	Manage cryptographic keys throughout their lifecycle including generation, distribution, storage, rotation, destruction.
ISM-CR-TLS	Transport Layer Security	Use TLS 1.2 or higher with approved cipher suites for protecting data in transit.

Cryptography

9 controls

Chapter 18: Cryptographic controls, TLS, SSH, and post-quantum readiness

Controls in the Cryptography domain of ASD Information Security Manual (ISM) — 12 controls
Code	Title	Description
ISM-0459	Data at Rest Encryption	Full disk or partial disk encryption is implemented for data at rest on all classified media.
ISM-0476	RSA Key Length	RSA is used with a modulus of at least 2048 bits (3072 bits preferred).
ISM-0484	SSH Hardening	SSH is hardened using vendor and ASD guidance.
ISM-1139	TLS minimum version	TLS 1.2 is the minimum used; TLS 1.3 is preferred. Older versions are disabled.
ISM-1369	TLS Encryption Algorithm	AES in Galois/Counter Mode is used for TLS encryption.
ISM-1453	Perfect Forward Secrecy	Perfect forward secrecy is used for all TLS connections.
ISM-1506	SSH v1 Disabled	SSH version 1 is disabled to prevent use of insecure protocol.
ISM-1553	TLS Compression Disabled	TLS compression is disabled to prevent information leakage.
ISM-1917	Post-Quantum Readiness	New development supports ML-DSA-87 and ML-KEM-1024 post-quantum cryptographic algorithms by 2030.
ISM-CR-1	Cryptographic Fundamentals	Use ASD-approved cryptographic algorithms and protocols (AACP/AACA) appropriate for the classification.
ISM-CR-2	Key Management	Manage cryptographic keys throughout their lifecycle including generation, distribution, storage, rotation, destruction.
ISM-CR-TLS	Transport Layer Security	Use TLS 1.2 or higher with approved cipher suites for protecting data in transit.

Cyber Security Principles and Governance

9 controls

Chapters 2-4: Cyber security principles, roles, responsibilities, and security documentation

Controls in the Cyber Security Principles and Governance domain of ASD Information Security Manual (ISM) — 9 controls
Code	Title	Description
ISM-0027	System security plan	A system security plan is developed and maintained for each system.
ISM-0047	System Security Plan	A system security plan is developed, implemented and maintained for each system.
ISM-0714	Chief Information Security Officer appointment	A Chief Information Security Officer is appointed to provide cybersecurity leadership for the organisation.
ISM-0888	Incident response plan documented	An incident response plan is documented covering detection, containment, eradication, recovery and reporting.
ISM-1211	Incident Response Plan	A cyber security incident response plan is developed, implemented and maintained.
ISM-1526	System owner responsibilities	System owners are responsible for the security of their systems through the system lifecycle.
ISM-1563	Security Assessment Report	A security assessment report is produced for each system assessing its security posture.
ISM-1567	Change management	Changes to systems are managed through a documented change management process including security review.
ISM-1568	Shared Responsibility Model	The shared responsibility model for each cloud service is identified and documented.

Data

1 controls

Controls in the Data domain of ASD Information Security Manual (ISM) — 1 controls
Code	Title	Description
ISM-DA-1	Database Security	Protect databases via least privilege, encryption at rest, activity monitoring, and patching.

Email

1 controls

Controls in the Email domain of ASD Information Security Manual (ISM) — 1 controls
Code	Title	Description
ISM-EM-1	Email Security	Apply SPF, DKIM, DMARC, content filtering, and TLS to email; block executable attachments.

Gateways and Content Filtering

8 controls

Chapter 19: Firewalls, cross-domain solutions, web proxies, and content inspection

Controls in the Gateways and Content Filtering domain of ASD Information Security Manual (ISM) — 8 controls
Code	Title	Description
ISM-0260	Web Proxy Requirement	All web access is routed through web proxy servers.
ISM-0263	Network segmentation	Networks are segmented based on classification, function and trust.
ISM-0631	Gateway between networks	Gateways are used to control traffic between networks of different trust or classification levels.
ISM-0637	DMZ Implementation	Gateways implement a demilitarised zone (DMZ) for external access to services.
ISM-0963	Content Filter Blocking	Web content filters are used to block potentially harmful web-based content.
ISM-1288	Multi-Engine Antivirus	Files transiting gateways are scanned with multiple different antivirus engines.
ISM-1389	Sandbox Analysis	Executables transiting gateways are run in sandbox environments to detect suspicious behaviour.
ISM-1528	Evaluated Firewalls	Evaluated firewalls are deployed between the organisation's network and public network infrastructure.

Governance

1 controls

Controls in the Governance domain of ASD Information Security Manual (ISM) — 1 controls
Code	Title	Description
ISM-G-CISO	Chief Information Security Officer	A CISO is appointed to provide cyber security leadership and oversight.

Identification

2 controls

Controls in the Identification domain of ASD Information Security Manual (ISM) — 2 controls
Code	Title	Description
ISM-ID-MFA	Multi-Factor Authentication	Use phishing-resistant MFA for privileged accounts, internet-facing services, and important data.
ISM-ID-PAM	Privileged Access Management	Manage privileged access via just-in-time access, separate accounts, and recorded sessions.

Incident Management

2 controls

Controls in the Incident Management domain of ASD Information Security Manual (ISM) — 2 controls
Code	Title	Description
ISM-IRP	Incident Response Plan	Develop and maintain an incident response plan exercised at least annually.
ISM-IRR	Cyber Security Incident Reporting	Report cyber incidents to ASD as soon as practicable; maintain internal incident register.

Information

2 controls

Controls in the Information domain of ASD Information Security Manual (ISM) — 2 controls
Code	Title	Description
ISM-IC-1	Information Classification and Handling	Classify information using the PSPF marking scheme and handle per classification.
ISM-IC-2	Information Aggregation and Caveats	Apply caveats and consider aggregation effect on classification level.

Media

1 controls

Controls in the Media domain of ASD Information Security Manual (ISM) — 1 controls
Code	Title	Description
ISM-MEDIA-1	Media Management and Sanitisation	Securely handle, label, sanitise, and destroy media containing official information.

Media and Facilities Security

6 controls

Chapters 7-10: Guidelines for media, equipment, and physical facility security

Controls in the Media and Facilities Security domain of ASD Information Security Manual (ISM) — 6 controls
Code	Title	Description
ISM-0159	Media Sanitisation	Media is sanitised before reuse, disposal, or return to vendor.
ISM-0164	Equipment Maintenance	ICT equipment is maintained by authorised personnel with appropriate security clearances.
ISM-0336	ICT Equipment Classification	ICT equipment is classified based on the highest classification of data it processes, stores or communicates.
ISM-0363	Media Destruction	Media that cannot be sanitised is destroyed using approved methods.
ISM-1053	Cabling infrastructure standards	Cabling infrastructure for classified systems meets ACSC cabling standards.
ISM-1076	ICT Equipment Disposal	ICT equipment disposal includes sanitisation or destruction of all storage media.

Mobility

2 controls

Controls in the Mobility domain of ASD Information Security Manual (ISM) — 2 controls
Code	Title	Description
ISM-MO-1	Mobile Device Management	Manage mobile devices via MDM enforcing encryption, passcode, remote wipe, and approved app catalogue.
ISM-MO-2	Working Outside the Office	Apply controls for working from non-office locations including VPN, screen privacy, and travel briefings.

Monitoring

1 controls

Controls in the Monitoring domain of ASD Information Security Manual (ISM) — 1 controls
Code	Title	Description
ISM-LOG-1	Event Logging and Monitoring	Collect, protect, and review event logs from systems, applications, and security devices.

Network Security

2 controls

Controls in the Network Security domain of ASD Information Security Manual (ISM) — 15 controls
Code	Title	Description
ISM-0520	Unauthorised Device Prevention	Network access controls prevent unauthorised network devices from connecting to the network.
ISM-1028	NIDS/NIPS Deployment	Network-based intrusion detection/prevention systems are deployed in gateways between networks.
ISM-1181	Network Segmentation	Networks are segregated into zones based on the criticality of servers, services and data handled.
ISM-1182	Wireless network security	Wireless networks use strong authentication and encryption (WPA3 or WPA2-Enterprise).
ISM-1311	SNMP v1/v2 Prohibition	SNMP versions 1 and 2 are not used on networks.
ISM-1627	Anonymity Network Inbound Blocking	Inbound network connections from anonymity networks are blocked at the gateway.
ISM-1628	Anonymity Network Outbound Blocking	Outbound network connections to anonymity networks are blocked at the gateway.
ISM-1781	Data Encryption in Transit	All data communicated over network infrastructure is encrypted.
ISM-1782	Protective DNS	A protective Domain Name System service is used that blocks access to known malicious domain names.
ISM-1800	Trusted Firmware	Network devices are flashed with trusted firmware before being used for the first time.
ISM-NET-GW	Gateways and Internet Connections	Implement secure gateways to control traffic between trust zones and to the Internet.
ISM-NET-SEG	Network Segmentation and Segregation	Segregate networks based on trust and classification; restrict traffic flows between segments.
UK-TSA-NET-01	Security Architecture	Implement secure network architecture with defined security zones, controlled access between zones, and protection of ma...
UK-TSA-NET-02	Access Control and Authentication	Implement strong authentication for network access. Privileged access management for network functions. Multi-factor aut...
UK-TSA-NET-03	Supply Chain Security	Assess and manage risks from equipment vendors and managed service providers. High-risk vendor restrictions apply. Must...

Network Security

13 controls

Security requirements for telecoms networks and services

Controls in the Network Security domain of ASD Information Security Manual (ISM) — 15 controls
Code	Title	Description
ISM-0520	Unauthorised Device Prevention	Network access controls prevent unauthorised network devices from connecting to the network.
ISM-1028	NIDS/NIPS Deployment	Network-based intrusion detection/prevention systems are deployed in gateways between networks.
ISM-1181	Network Segmentation	Networks are segregated into zones based on the criticality of servers, services and data handled.
ISM-1182	Wireless network security	Wireless networks use strong authentication and encryption (WPA3 or WPA2-Enterprise).
ISM-1311	SNMP v1/v2 Prohibition	SNMP versions 1 and 2 are not used on networks.
ISM-1627	Anonymity Network Inbound Blocking	Inbound network connections from anonymity networks are blocked at the gateway.
ISM-1628	Anonymity Network Outbound Blocking	Outbound network connections to anonymity networks are blocked at the gateway.
ISM-1781	Data Encryption in Transit	All data communicated over network infrastructure is encrypted.
ISM-1782	Protective DNS	A protective Domain Name System service is used that blocks access to known malicious domain names.
ISM-1800	Trusted Firmware	Network devices are flashed with trusted firmware before being used for the first time.
ISM-NET-GW	Gateways and Internet Connections	Implement secure gateways to control traffic between trust zones and to the Internet.
ISM-NET-SEG	Network Segmentation and Segregation	Segregate networks based on trust and classification; restrict traffic flows between segments.
UK-TSA-NET-01	Security Architecture	Implement secure network architecture with defined security zones, controlled access between zones, and protection of ma...
UK-TSA-NET-02	Access Control and Authentication	Implement strong authentication for network access. Privileged access management for network functions. Multi-factor aut...
UK-TSA-NET-03	Supply Chain Security	Assess and manage risks from equipment vendors and managed service providers. High-risk vendor restrictions apply. Must...

Outsourcing

1 controls

Controls in the Outsourcing domain of ASD Information Security Manual (ISM) — 1 controls
Code	Title	Description
ISM-OUT-1	Outsourcing and Service Providers	Manage cyber security risks from outsourced services and cloud providers via contract and assurance.

Patch Management

9 controls

Chapter 12: Patching operating systems, applications, and firmware

Controls in the Patch Management domain of ASD Information Security Manual (ISM) — 9 controls
Code	Title	Description
ISM-1143	Patch Management Processes	Patch management processes are developed, implemented and maintained.
ISM-1691	Application Patching - Regular	Patches, updates or vendor mitigations for productivity suites, browsers, email, PDF, and security products are applied...
ISM-1692	Application Patching - Critical	Patches, updates or vendor mitigations for critical vulnerabilities in productivity suites, browsers, email, PDF, and se...
ISM-1694	Server OS Patching - Regular	Non-critical patches for internet-facing server operating systems are applied within two weeks.
ISM-1696	Workstation OS Patching - Critical	Critical patches for workstation operating systems are applied within 48 hours.
ISM-1698	Vulnerability Scanning - Online Services	A vulnerability scanner is used at least daily to identify missing patches or updates for online service vulnerabilities...
ISM-1699	Vulnerability Scanning - Applications	A vulnerability scanner is used at least weekly to identify missing patches or updates for office productivity suites, w...
ISM-1876	API security	APIs implement authentication, authorisation, input validation and rate limiting.
ISM-1877	Container security	Containers are scanned for vulnerabilities, signed and run with least privilege.

Personnel

1 controls

Controls in the Personnel domain of ASD Information Security Manual (ISM) — 1 controls
Code	Title	Description
ISM-PER-1	Personnel Security	Personnel are appropriately cleared, briefed, and managed for ongoing suitability.

Personnel Security

23 controls

Requirements for ensuring personnel suitability and managing insider threats

Controls in the Personnel Security domain of ASD Information Security Manual (ISM) — 23 controls
Code	Title	Description
AEO-PS-1	Employee Vetting	Pre-employment verification and periodic background checks must be conducted for personnel in sensitive positions.
AEO-PS-2	Security Awareness Training	Staff must receive training on supply chain security threats, procedures, and their role in maintaining security.
AEO-PS-3	Access Management	Access to sensitive areas and information must be restricted based on job function and need-to-know basis.
CTPAT-PE-1	Pre-Employment Verification	Conduct thorough pre-employment background checks and verification for personnel in supply chain security roles.
CTPAT-PE-2	Employee Screening	Screen employees with access to cargo, shipping, and receiving areas to ensure reliability and trustworthiness.
CTPAT-PE-3	Education and Training	Provide security awareness education and training programs for all employees and supply chain partners.
DSPF-PERS-1	Personnel Suitability	Each entity ensures its employees and contractors are suitable to access Australian Government resources and Defence inf...
DSPF-PERS-2	Security Clearances	Personnel accessing classified Defence information must hold appropriate security clearances issued by AGSVA.
DSPF-PERS-3	Ongoing Personnel Assessment	Personnel suitability is continuously monitored and reassessed throughout the period of engagement.
DSPF-PERS-4	Insider Threat Management	Each entity implements measures to identify and manage insider threat risks to Defence people, information and assets.
DSPF-PERS-5	Security Awareness and Training	Personnel receive security awareness training commensurate with their access level and responsibilities.
ISM-0252	Cyber Security Awareness Training	Cyber security awareness training is provided to personnel on employment and annually thereafter.
ISM-0414	Database hardening	Databases are configured against a hardened baseline including disabling unused features.
ISM-0434	Need to know enforced	Access to classified information is granted on a need-to-know basis.
ISM-1146	Targeted Cyber Security Training	Targeted cyber security awareness training is provided to personnel based on their role and responsibilities.
ISM-1175	Privileged workstations	Privileged administrative tasks are performed from dedicated, hardened workstations.
ISM-1503	Separate Privileged Operating Environments	Privileged users use separate privileged and unprivileged operating environments.
ISM-1507	Privileged Access Limitation	Privileged access to systems, applications and data repositories is limited to that required for personnel to undertake...
ISM-1508	Privileged Access Review	Privileged access to systems, applications and data repositories is reviewed at least annually.
PSPF-PERS-1	Eligibility and Suitability	Each entity must ensure that employees and contractors are suitable to access Australian Government resources, based on...
PSPF-PERS-2	Security Clearances	Each entity must ensure appropriate security clearances are obtained for personnel accessing security classified informa...
PSPF-PERS-3	Ongoing Suitability	Each entity must monitor the ongoing suitability of personnel with access to government resources and manage identified...
PSPF-PERS-4	Separation and Transfer	Each entity must manage security risks associated with personnel separating from or transferring within the entity, incl...

Physical

1 controls

Controls in the Physical domain of ASD Information Security Manual (ISM) — 1 controls
Code	Title	Description
ISM-PHY-1	Facilities and Systems Physical Security	Apply physical security to facilities, ICT equipment, and media commensurate with information classification.

Principles

4 controls

Controls in the Principles domain of ASD Information Security Manual (ISM) — 4 controls
Code	Title	Description
ISM-CSP-1	Cyber Security Principles - Govern	Identify, manage, and reduce security risks through governance structures and accountability.
ISM-CSP-2	Cyber Security Principles - Protect	Implement security controls to protect systems and data from cyber threats.
ISM-CSP-3	Cyber Security Principles - Detect	Detect and understand cyber security events to identify incidents.
ISM-CSP-4	Cyber Security Principles - Respond	Respond to and recover from cyber security incidents in a timely manner.

Software

1 controls

Controls in the Software domain of ASD Information Security Manual (ISM) — 1 controls
Code	Title	Description
ISM-SD-1	Software Development	Apply secure software development practices including threat modelling, code review, and testing.

Software Development Security

12 controls

Chapter 14: Secure development practices, web application security, and vulnerability management

Controls in the Software Development Security domain of ASD Information Security Manual (ISM) — 12 controls
Code	Title	Description
ISM-0400	Secure development standards	Software is developed in accordance with secure development standards.
ISM-0401	Secure Design Principles	Secure design principles and memory-safe programming languages are applied in software development.
ISM-0402	Security Testing	Software undergoes static application security testing (SAST) and dynamic application security testing (DAST) before rel...
ISM-0971	Web Application Security Standard	The OWASP Application Security Verification Standard is used for web application development.
ISM-1240	Input Validation	Validation or sanitisation is performed on all input from the internet.
ISM-1241	Output Encoding	Output encoding is performed on all web application output.
ISM-1275	Database Query Filtering	Database queries from software are filtered for legitimate content.
ISM-1424	Security Headers	Security headers are configured including Content-Security-Policy, HSTS, and X-Frame-Options.
ISM-1616	Vulnerability Disclosure Program	A vulnerability disclosure program is implemented for all internet-facing services.
ISM-1730	Software Bill of Materials	A software bill of materials is produced for all software developed.
ISM-1780	SecDevOps	Secure development operations (SecDevOps) practices are used in software development.
ISM-1850	OWASP Top 10 Mitigation	The OWASP Top 10 is mitigated for all web applications.

System Hardening

2 controls

Controls in the System Hardening domain of ASD Information Security Manual (ISM) — 2 controls
Code	Title	Description
ISM-SYS-APP	System Hardening - Application Selection	Select applications that come from trusted sources, are vendor supported, and receive timely security updates.
ISM-SYS-HARD	System Hardening - Operating Systems	Harden operating systems by removing unneeded components, applying ASD/vendor baselines, and disabling unused services.

System Hardening - Application Control

9 controls

Chapter 11: Application control (Essential Eight mitigation strategy)

Controls in the System Hardening - Application Control domain of ASD Information Security Manual (ISM) — 9 controls
Code	Title	Description
ISM-0843	Patch operating systems	Operating systems are patched within timeframes specified by the ISM based on risk.
ISM-0955	Application Control Rules	Application control uses cryptographic hash rules, publisher certificate rules, or path rules.
ISM-1490	Multi-factor authentication	Multi-factor authentication is used for users accessing important systems and for privileged actions.
ISM-1544	Microsoft Blocklist	Microsoft's recommended application blocklist is implemented.
ISM-1582	Application Control Validation	Application control rulesets are validated on an annual or more frequent basis.
ISM-1656	Application Control on Non-Internet Servers	Application control is implemented on non-internet-facing servers.
ISM-1657	Hardened user application config	User applications are configured to harden against common attacks (macros, scripting, content rendering).
ISM-1658	Driver Execution Control	Application control restricts driver execution to an approved set.
ISM-1870	Application Control - User Folders	Application control is applied to user and temporary folders used by operating systems, web browsers, and email clients.

System Hardening - Application and Browser Hardening

9 controls

Chapter 11: Hardening of office suites, web browsers, email clients, and PDF applications

Controls in the System Hardening - Application and Browser Hardening domain of ASD Information Security Manual (ISM) — 9 controls
Code	Title	Description
ISM-1412	Web Browser Hardening	Web browsers are hardened using ASD and vendor guidance.
ISM-1467	Latest Application Versions	The latest release of office productivity suites, web browsers, browser extensions, email clients, PDF software, and sec...
ISM-1485	Block Web Advertisements	Web browsers do not process web advertisements from the internet.
ISM-1486	Block Java in Browsers	Web browsers do not process Java from the internet.
ISM-1667	PDF reader hardening	PDF readers and similar content viewers are configured to limit scripting and external resource loading.
ISM-1668	Office Executable Content Blocking	Microsoft Office is blocked from creating executable content.
ISM-1671	Macros restriction	Microsoft Office macros are blocked unless from trusted locations or signed by a trusted publisher.
ISM-1674	Trusted Macro Sources	Only macros running from within a sandboxed environment, a Trusted Location, or that are digitally signed by a trusted p...
ISM-1859	Cloud identity federation	Cloud services use federated identity with the enterprise IdP and enforce MFA.

System Hardening - Authentication

9 controls

Chapter 11: Multi-factor authentication and credential management

Controls in the System Hardening - Authentication domain of ASD Information Security Manual (ISM) — 9 controls
Code	Title	Description
ISM-0421	Password storage	Passwords are stored using approved hashing algorithms.
ISM-0974	Privileged access just-in-time	Privileged access is granted just-in-time and just-enough where supported.
ISM-1173	MFA for Privileged Users	Multi-factor authentication is used for privileged user access to systems.
ISM-1401	MFA Factor Types	Multi-factor authentication uses at least two of: something the user possesses, something the user knows, or something t...
ISM-1403	Account Lockout	User accounts are locked after a maximum of 5 failed logon attempts.
ISM-1504	MFA for Sensitive Services	Multi-factor authentication is used for organisation online services that handle sensitive data.
ISM-1590	Credential Rotation	Credentials are changed if compromised, suspected of compromise, or older than 12 months without MFA.
ISM-1682	Phishing-Resistant MFA	Multi-factor authentication used for system user authentication is phishing-resistant.
ISM-1686	Credential Guard	Windows Credential Guard functionality is enabled.

System Hardening - Operating Systems

7 controls

Chapter 11: Operating system hardening and configuration management

Controls in the System Hardening - Operating Systems domain of ASD Information Security Manual (ISM) — 7 controls
Code	Title	Description
ISM-1407	Server hardening baseline	Servers are configured against a hardened baseline aligned with vendor and ISM guidance.
ISM-1408	64-bit Operating Systems	64-bit versions of operating systems are used where supported.
ISM-1409	OS Hardening	Operating systems are hardened using ASD and vendor guidance.
ISM-1410	Default credentials changed	Default credentials on devices and software are changed before deployment.
ISM-1584	Security Function Protection	Unprivileged users cannot bypass, disable or modify security functionality of operating systems.
ISM-1588	SOE Annual Review	Standard operating environments are reviewed and updated at least annually.
ISM-1745	Secure Boot	Early Launch Antimalware, Secure Boot, Trusted Boot, and Measured Boot are enabled.

System Monitoring and Event Logging

8 controls

Chapter 13: Event logging, analysis, and centralised monitoring

Controls in the System Monitoring and Event Logging domain of ASD Information Security Manual (ISM) — 8 controls
Code	Title	Description
ISM-0580	Event Logging Policy	An event logging policy is developed, implemented and maintained.
ISM-0584	Authentication Event Logging	Logon, failed logon and logoff events are logged for systems handling authenticated user access.
ISM-0585	Event Log Content	Each event log entry includes date and time, user or process, filename or event, and equipment involved.
ISM-0586	Event log content	Event logs contain the data required to support investigation and detection.
ISM-0859	Centralised logging	Logs are stored on a centralised logging facility separate from the systems generating them.
ISM-0988	Accurate Time Source	An accurate and consistent time source is established and used for event logging purposes.
ISM-1228	Log retention	Event logs are retained for a period that supports investigation and compliance.
ISM-1405	Configuration management	Configuration baselines are documented and maintained for systems.

Web

1 controls

Controls in the Web domain of ASD Information Security Manual (ISM) — 1 controls
Code	Title	Description
ISM-WEB-1	Web Content Filtering	Filter web content to block malicious and inappropriate sites; inspect encrypted traffic where lawful.

Your Compliance Coverage

If you comply with ASD Information Security Manual (ISM), you already cover:

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1

30%

50 controls mapped

Compare →

South Korea ISMS-P

28%

46 controls mapped

Compare →

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)

25%

42 controls mapped

Compare →

+ 643 more: NIS2 Directive Implementing Acts (25%), TISAX - Trusted Information Security Assessment Exchange (25%)

See all 646 mapped frameworks ↓

Maps to 646 other frameworks

166 total controls

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1

50 source controls mapped|40 target controls covered

30%

South Korea ISMS-P

46 source controls mapped|13 target controls covered

28%

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)

42 source controls mapped|18 target controls covered

25%

NIS2 Directive Implementing Acts

42 source controls mapped|25 target controls covered

25%

TISAX - Trusted Information Security Assessment Exchange

42 source controls mapped|19 target controls covered

25%

PAS 1192-5:2015 - Security-Minded Approach to BIM and Digital Built Environments

42 source controls mapped|14 target controls covered

25%

Canada ITSG-33 - IT Security Risk Management

42 source controls mapped|16 target controls covered

25%

New Zealand Information Security Manual (NZISM)

42 source controls mapped|14 target controls covered

25%

MARS-E - Minimum Acceptable Risk Standards for Exchanges

42 source controls mapped|14 target controls covered

25%

South Korea Cloud Security Assurance Program (CSAP)

42 source controls mapped|15 target controls covered

25%

NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity

42 source controls mapped|16 target controls covered

25%

CSA STAR (Security, Trust, Assurance, and Risk)

41 source controls mapped|12 target controls covered

25%

NIST SP 800-171A - Assessing CUI Security Requirements

41 source controls mapped|22 target controls covered

25%

FAA Cybersecurity Framework for Aviation

41 source controls mapped|16 target controls covered

25%

UK Gambling Commission - Cyber Resilience Requirements

41 source controls mapped|17 target controls covered

25%

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0

40 source controls mapped|18 target controls covered

24%

NIST SP 800-82 Rev 3 - Guide to OT Security

40 source controls mapped|17 target controls covered

24%

Oman National Cybersecurity Framework

39 source controls mapped|10 target controls covered

23%

ISO 27001:2022

39 source controls mapped|24 target controls covered

23%

NIST SP 800-53 Rev 5

39 source controls mapped|32 target controls covered

23%

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements

38 source controls mapped|20 target controls covered

23%

FedRAMP Rev 5

38 source controls mapped|34 target controls covered

23%

NIST Privacy Framework 1.0

38 source controls mapped|16 target controls covered

23%

DISA Security Technical Implementation Guides (STIGs)

37 source controls mapped|22 target controls covered

22%

Singapore Government Instruction Manual on ICT&SS Management (IM8)

36 source controls mapped|13 target controls covered

22%

CISA Industrial Control Systems (ICS) Security Guidance

36 source controls mapped|21 target controls covered

22%

PCI DSS v4.0

36 source controls mapped|28 target controls covered

22%

Defence Security Principles Framework (DSPF)

35 source controls mapped|33 target controls covered

21%

Protective Security Policy Framework (PSPF) Release 2024

35 source controls mapped|33 target controls covered

21%

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers

34 source controls mapped|14 target controls covered

20%

TSA Pipeline Security

34 source controls mapped|17 target controls covered

20%

Australian Energy Sector Cyber Security Framework (AESCSF)

34 source controls mapped|19 target controls covered

20%

AWS Well-Architected Security Pillar

33 source controls mapped|12 target controls covered

20%

CFTC System Safeguards (17 CFR 37, 38, 39, 49)

33 source controls mapped|16 target controls covered

20%

Azure Security Benchmark

33 source controls mapped|12 target controls covered

20%

CAIQ (CSA)

33 source controls mapped|12 target controls covered

20%

C5 (Germany)

33 source controls mapped|12 target controls covered

20%

NYDFS Cybersecurity Regulation (23 NYCRR Part 500)

33 source controls mapped|19 target controls covered

20%

FTC Safeguards Rule (16 CFR Part 314)

33 source controls mapped|13 target controls covered

20%

ISO 27017

33 source controls mapped|12 target controls covered

20%

NIST SP 800-190

33 source controls mapped|12 target controls covered

20%

ISMAP (Japan)

33 source controls mapped|12 target controls covered

20%

ISO 27018

33 source controls mapped|12 target controls covered

20%

NIST SP 800-145

33 source controls mapped|12 target controls covered

20%

NIST SP 800-144

33 source controls mapped|12 target controls covered

20%

NIST SP 800-146

33 source controls mapped|12 target controls covered

20%

MTCS (Singapore)

33 source controls mapped|12 target controls covered

20%

ASD Strategies to Mitigate Cyber Security Incidents

32 source controls mapped|20 target controls covered

19%

FTC GLBA Safeguards Rule (16 CFR Part 314)

32 source controls mapped|15 target controls covered

19%

CISA Zero Trust Maturity Model

32 source controls mapped|17 target controls covered

19%

DoD Zero Trust Reference Architecture

32 source controls mapped|17 target controls covered

19%

CNCF Security Technical Advisory Group (TAG)

32 source controls mapped|11 target controls covered

19%

EIOPA Guidelines on ICT Security and Governance (EIOPA‑BoS‑23/146, 2023)

31 source controls mapped|16 target controls covered

19%

Proposal for a Regulation on Cyber Resilience Act (CRA)

31 source controls mapped|14 target controls covered

19%

3GPP Security

31 source controls mapped|14 target controls covered

19%

California IoT Security Law

31 source controls mapped|14 target controls covered

19%

ETSI EN 303 645

31 source controls mapped|15 target controls covered

19%

MITRE D3FEND

31 source controls mapped|15 target controls covered

19%

BSIMM

31 source controls mapped|14 target controls covered

19%

OWASP ASVS

31 source controls mapped|14 target controls covered

19%

SSAE 18 SOC 1 - Report on Controls at a Service Organisation (ICFR)

31 source controls mapped|15 target controls covered

19%

NIST SP 800-150

31 source controls mapped|13 target controls covered

19%

MITRE ATT&CK

31 source controls mapped|14 target controls covered

19%

ISO 27002:2022

31 source controls mapped|16 target controls covered

19%

NIST SP 800-128

31 source controls mapped|14 target controls covered

19%

OWASP SAMM

31 source controls mapped|13 target controls covered

19%

NIST SP 800-218

31 source controls mapped|14 target controls covered

19%

SSDF (NIST)

31 source controls mapped|14 target controls covered

19%

NIST SP 800-183

31 source controls mapped|14 target controls covered

19%

NIST SP 800-115

31 source controls mapped|14 target controls covered

19%

NIST SP 800-123

31 source controls mapped|14 target controls covered

19%

ISO/SAE 21434

31 source controls mapped|14 target controls covered

19%

NIST SP 800-181

31 source controls mapped|15 target controls covered

19%

NIST SP 800-61

31 source controls mapped|13 target controls covered

19%

NIST SP 800-161

31 source controls mapped|13 target controls covered

19%

NIST SP 800-63

31 source controls mapped|13 target controls covered

19%

SLSA

31 source controls mapped|14 target controls covered

19%

ISO 27043

31 source controls mapped|15 target controls covered

19%

UNECE WP.29 R156

31 source controls mapped|14 target controls covered

19%

NIST SP 800-160

31 source controls mapped|14 target controls covered

19%

NIST SP 800-92

31 source controls mapped|14 target controls covered

19%

OpenSSF Scorecard

31 source controls mapped|16 target controls covered

19%

SIG (Shared Assessments)

31 source controls mapped|14 target controls covered

19%

NIST SP 800-207

31 source controls mapped|13 target controls covered

19%

OWASP MASVS

31 source controls mapped|12 target controls covered

19%

NIST SP 800-187

31 source controls mapped|15 target controls covered

19%

UK PSTI Act

31 source controls mapped|14 target controls covered

19%

PTES

31 source controls mapped|14 target controls covered

19%

NIST SP 800-137

31 source controls mapped|15 target controls covered

19%

NIST SP 800-88

31 source controls mapped|14 target controls covered

19%

UNECE WP.29 R155

31 source controls mapped|13 target controls covered

19%

OWASP DevSecOps Maturity Model (DSOMM)

31 source controls mapped|16 target controls covered

19%

OWASP Top 10:2025

31 source controls mapped|11 target controls covered

19%

ISO/IEC 27011:2024

30 source controls mapped|12 target controls covered

18%

HKMA Cyber Resilience Assessment Framework (C-RAF)

30 source controls mapped|14 target controls covered

18%

SWIFT CSCF

30 source controls mapped|17 target controls covered

18%

FFIEC Cybersecurity Assessment Tool (CAT)

30 source controls mapped|9 target controls covered

18%

FBI CJIS Security Policy

30 source controls mapped|17 target controls covered

18%

UK Telecommunications (Security) Act 2021

30 source controls mapped|19 target controls covered

18%

Belgium CyberFundamentals

29 source controls mapped|16 target controls covered

17%

Spain ENS

29 source controls mapped|16 target controls covered

17%

ANSSI Cybersecurity Framework

29 source controls mapped|18 target controls covered

17%

FISMA

29 source controls mapped|16 target controls covered

17%

BSI IT-Grundschutz

29 source controls mapped|17 target controls covered

17%

Ghana Cybersecurity Act

29 source controls mapped|17 target controls covered

17%

Cyber Essentials Plus

29 source controls mapped|15 target controls covered

17%

NIST SP 800-172

29 source controls mapped|18 target controls covered

17%

NIST SP 800-171

29 source controls mapped|18 target controls covered

17%

NIST SP 800-53A

29 source controls mapped|15 target controls covered

17%

Saudi NCA ECC

29 source controls mapped|17 target controls covered

17%

GLI-33 - Gaming Laboratories International Event Wagering Systems

29 source controls mapped|13 target controls covered

17%

O-RAN Alliance Security Specifications (O-RAN.WG11)

29 source controls mapped|9 target controls covered

17%

RBI Cybersecurity Framework for Banks

28 source controls mapped|10 target controls covered

17%

US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule

28 source controls mapped|17 target controls covered

17%

Telecommunications Sector Security Reforms (TSSR)

28 source controls mapped|12 target controls covered

17%

C2M2

27 source controls mapped|15 target controls covered

16%

ASIC Cyber Resilience Good Practices

27 source controls mapped|12 target controls covered

16%

CIS Controls v8

27 source controls mapped|16 target controls covered

16%

NIS2 Directive

27 source controls mapped|17 target controls covered

16%

ISO/IEC 27400:2022

27 source controls mapped|8 target controls covered

16%

Secure by Design: A Guide for Manufacturers (CISA)

27 source controls mapped|9 target controls covered

16%

US Executive Order 14028 - Improving the Nation's Cybersecurity

27 source controls mapped|9 target controls covered

16%

DO-326A / ED-202A

26 source controls mapped|13 target controls covered

16%

IEC 62443

26 source controls mapped|13 target controls covered

16%

IEEE 1686

26 source controls mapped|14 target controls covered

16%

API 1164

26 source controls mapped|13 target controls covered

16%

HKMA SPM

26 source controls mapped|14 target controls covered

16%

DORA

26 source controls mapped|18 target controls covered

16%

EBA Guidelines on ICT and Security Risk Management (EBA/GL/2024/07)

26 source controls mapped|14 target controls covered

16%

BIMCO Cyber Security

26 source controls mapped|13 target controls covered

16%

FFIEC IT Examination Handbook

26 source controls mapped|14 target controls covered

16%

GLBA

26 source controls mapped|14 target controls covered

16%

BCBS 239

26 source controls mapped|16 target controls covered

16%

APRA CPS 234

26 source controls mapped|14 target controls covered

16%

PCI SSF

26 source controls mapped|14 target controls covered

16%

NAIC Insurance Data Security Model Law (MDL-668)

26 source controls mapped|15 target controls covered

16%

NIST SP 1800-32

26 source controls mapped|14 target controls covered

16%

AICPA SOC 1

26 source controls mapped|14 target controls covered

16%

PCI P2PE

26 source controls mapped|14 target controls covered

16%

ISO 27019

26 source controls mapped|14 target controls covered

16%

MAS TRM

26 source controls mapped|14 target controls covered

16%

NIST Cybersecurity Framework 2.0

26 source controls mapped|17 target controls covered

16%

TIBER-EU (Threat Intelligence-Based Ethical Red Teaming - European Union)

26 source controls mapped|14 target controls covered

16%

Open Banking Security

26 source controls mapped|14 target controls covered

16%

PCI PIN Security

26 source controls mapped|14 target controls covered

16%

PSD2 SCA

26 source controls mapped|14 target controls covered

16%

AICPA SOC 3

26 source controls mapped|14 target controls covered

16%

SWIFT CSP

26 source controls mapped|14 target controls covered

16%

OSFI B-13

26 source controls mapped|14 target controls covered

16%

ISO 13485

26 source controls mapped|11 target controls covered

16%

IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems

25 source controls mapped|10 target controls covered

15%

TSA Pipeline Cybersecurity Directives

25 source controls mapped|9 target controls covered

15%

SWIFT Customer Security Programme (CSP)

25 source controls mapped|10 target controls covered

15%

US ITAR and EAR - Export Control and Data Security

25 source controls mapped|10 target controls covered

15%

FDA 21 CFR Part 11

25 source controls mapped|9 target controls covered

15%

NIST SP 800-66

25 source controls mapped|9 target controls covered

15%

MARS-E

25 source controls mapped|9 target controls covered

15%

MDS2 (Medical Device)

25 source controls mapped|9 target controls covered

15%

ISO 27799

25 source controls mapped|9 target controls covered

15%

ISO/IEC 27010:2015

24 source controls mapped|9 target controls covered

14%

Customs-Trade Partnership Against Terrorism (C-TPAT)

24 source controls mapped|9 target controls covered

14%

HIPAA Security Rule

24 source controls mapped|15 target controls covered

14%

Sigstore - Software Artifact Signing and Verification

24 source controls mapped|9 target controls covered

14%

ISO 28001:2007 Supply Chain Security Management

23 source controls mapped|14 target controls covered

14%

NIST SP 800-124 Rev 2 - Mobile Device Security

23 source controls mapped|10 target controls covered

14%

WCO Authorised Economic Operator (AEO) Framework

22 source controls mapped|23 target controls covered

13%

EU Digital Markets Act

22 source controls mapped|8 target controls covered

13%

EAR - Export Administration Regulations

22 source controls mapped|11 target controls covered

13%

C-TPAT - Customs-Trade Partnership Against Terrorism

21 source controls mapped|16 target controls covered

13%

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence

21 source controls mapped|13 target controls covered

13%

HL7 FHIR Security Framework

21 source controls mapped|11 target controls covered

13%

PropTech Security Standards - Smart Building Cybersecurity

21 source controls mapped|8 target controls covered

13%

Annex 11 to EU GMP - Computerised Systems

20 source controls mapped|8 target controls covered

12%

ASD Essential Eight Maturity Model

19 source controls mapped|12 target controls covered

11%

NERC CIP

19 source controls mapped|10 target controls covered

11%

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1)

19 source controls mapped|7 target controls covered

11%

BS 65000:2014 - Guidance on Organizational Resilience

19 source controls mapped|7 target controls covered

11%

NRF Cybersecurity and Data Privacy Framework (National Retail Federation)

19 source controls mapped|13 target controls covered

11%

Critical Raw Materials Act (Proposed Regulation COM(2023) 192)

18 source controls mapped|9 target controls covered

11%

SOC for Cybersecurity - Cybersecurity Risk Management Examination

18 source controls mapped|7 target controls covered

11%

US NRC 10 CFR 73.54 - Cyber Security for Nuclear Power Plants

18 source controls mapped|5 target controls covered

11%

NIS2 Directive (Directive (EU) 2022/2555)

18 source controls mapped|10 target controls covered

11%

HITECH Act

18 source controls mapped|3 target controls covered

11%

Japan FSA Cybersecurity Guidelines for Financial Institutions

17 source controls mapped|10 target controls covered

10%

OWASP API Security Top 10:2023

17 source controls mapped|5 target controls covered

10%

Turkey Personal Data Protection Law (KVKK - Law No. 6698)

17 source controls mapped|10 target controls covered

10%

IEC 62351 - Power Systems Communication Security

17 source controls mapped|4 target controls covered

10%

BSI C5 - Cloud Computing Compliance Criteria Catalogue

16 source controls mapped|4 target controls covered

10%

SSAE 18 - Attestation Standards (SOC Reporting)

16 source controls mapped|8 target controls covered

10%

Notifiable Data Breaches Scheme (Australia)

16 source controls mapped|8 target controls covered

10%

FTC Health Breach Notification Rule

16 source controls mapped|9 target controls covered

10%

UK Product Security and Telecommunications Infrastructure Act (PSTI)

16 source controls mapped|7 target controls covered

10%

European Accessibility Act (Directive (EU) 2019/882)

16 source controls mapped|8 target controls covered

10%

Regulation (EU) 2023/1115 on deforestation-free supply chains

16 source controls mapped|7 target controls covered

10%

Ontario Accessibility for Ontarians with Disabilities Act (AODA) - IASR Web Standard

16 source controls mapped|8 target controls covered

10%

US SEC Digital Assets and Crypto Regulatory Framework

16 source controls mapped|10 target controls covered

10%

Australia Consumer Data Right - Banking (CDR)

16 source controls mapped|10 target controls covered

10%

Australia eSafety Commissioner - Online Safety Expectations for Industry

16 source controls mapped|7 target controls covered

10%

Law 1581 of 2012 - Statutory Framework for the Protection of Personal Data

16 source controls mapped|8 target controls covered

10%

Digital Economy Partnership Agreement (DEPA)

16 source controls mapped|8 target controls covered

10%

LGPD

16 source controls mapped|7 target controls covered

10%

PCI DSS 4.0

16 source controls mapped|5 target controls covered

10%

CCSDS 350.0-G-3 - Space Communications Security (Consultative Committee for Space Data Systems)

16 source controls mapped|9 target controls covered

10%

IRS Publication 1075 - Tax Information Security Guidelines

16 source controls mapped|4 target controls covered

10%

3GPP Security Architecture (TS 33.501 - 5G Security)

16 source controls mapped|12 target controls covered

10%

ILO Nursing Personnel Convention C149 (1977)

16 source controls mapped|7 target controls covered

10%

6th Anti-Money Laundering Directive (AMLD6, Directive (EU) 2018/1673) - superseded by AMLD7

16 source controls mapped|9 target controls covered

10%

ISO 8000 - Data Quality

16 source controls mapped|7 target controls covered

10%

FATF Recommendation 16 - Virtual Asset Travel Rule

16 source controls mapped|6 target controls covered

10%

Privacy by Design (PbD) - Seven Foundational Principles

16 source controls mapped|5 target controls covered

10%

US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements

15 source controls mapped|7 target controls covered

Security of Critical Infrastructure Act 2018 (SOCI)

15 source controls mapped|9 target controls covered

Privacy Act 1988 (Australia)