Australian Information Security Manual

Australia

vISM March 2026 (OSCAL v2026.03.24)

22 domains

1081 controls

ACSC Information Security Manual. Australian Government cybersecurity controls baseline.

Verified

Australian Information Security Manual is a compliance framework from Australia with 22 domains and 1081 controls that map to 8 other frameworks. The largest domains are Guidelines for system hardening (215 controls), Guidelines for software development (104 controls), Guidelines for cryptography (73 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026Published standard

Get the official standard — this page is an AI-assisted companion tool, not a replacement for the authoritative text.

Visit cyber.gov.au

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (22)

Guidelines for communications infrastructure

53 controls

Controls in the Guidelines for communications infrastructure domain of Australian Information Security Manual — 53 controls
Code	Title	Description
ISM-0181	Cabling infrastructure standards	Cabling infrastructure is installed in accordance with relevant Australian Standards, as directed by the Australian Comm...
ISM-0187	SECRET cable bundles and conduits	SECRET cables, when bundled together or run in conduit, are run exclusively in their own individual cable bundle or cond...
ISM-0194	Sealing plastic and TOP SECRET conduit joints	In shared facilities, a visible smear of conduit glue is used to seal all plastic conduit joints and TOP SECRET conduits...
ISM-0195	Tamper-evident seals on TOP SECRET reticulation covers	In shared facilities, uniquely identifiable SCEC-approved tamper-evident seals are used to seal all removable covers on...
ISM-0198	Penetrating TOP SECRET audio secure rooms	When penetrating a TOP SECRET audio secure room, the Australian Security Intelligence Organisation is consulted and all...
ISM-0201	Labelling TOP SECRET conduits	Labels for TOP SECRET conduits are a minimum size of 2.5 cm x 1 cm, attached at five-metre intervals and marked as 'TS R...
ISM-0206	Cable labelling processes and procedures	Cable labelling processes, and supporting cable labelling procedures, are developed, implemented and maintained.
ISM-0208	Cable register contents	A cable register contains the following for each cable: - cable identifier - cable colour - sensitivity/classification -...
ISM-0211	Cable register maintenance and verification	A cable register is developed, implemented, maintained and verified on a regular basis.
ISM-0213	Terminating cables on patch panels	SECRET and TOP SECRET cables are terminated on their own individual patch panels.
ISM-0216	TOP SECRET patch panels in dedicated cabinets	TOP SECRET patch panels are installed in individual TOP SECRET cabinets.
ISM-0217	Shared cabinets under spatial constraints	Where spatial constraints demand non-TOP SECRET patch panels be installed in the same cabinet as a TOP SECRET patch pane...
ISM-0218	TOP SECRET fibre-optic fly leads over five metres	If TOP SECRET fibre-optic fly leads exceeding five metres in length are used to connect wall outlet boxes to IT equipmen...
ISM-0246	Timing of emanation security risk assessments	When an emanation security risk assessment is required, it is sought as early as possible in a system's life cycle.
ISM-0249	Emanation assessments for mobile and deployable systems	System owners deploying SECRET or TOP SECRET systems in mobile platforms, or as a deployable capability, contact ASD for...
ISM-0250	Electromagnetic interference and compatibility standards	IT equipment meets industry and government standards relating to electromagnetic interference/electromagnetic compatibil...
ISM-0926	Colours for lower-classified cables	Non-classified, OFFICIAL: Sensitive and PROTECTED cables are coloured neither salmon pink nor red.
ISM-1095	Labelling wall outlet boxes	Wall outlet boxes denote the systems, cable identifiers and wall outlet box identifier.
ISM-1096	Labelling cables at each end	Cables are labelled at each end with sufficient source and destination details to enable the physical identification and...
ISM-1098	Terminating SECRET cables in cabinets	SECRET cables are terminated in an individual cabinet; or for small systems, a cabinet with a division plate between any...
ISM-1100	Terminating TOP SECRET cables in cabinets	TOP SECRET cables are terminated in an individual TOP SECRET cabinet.
ISM-1101	TOP SECRET reticulation into server room cabinets	In TOP SECRET areas, cable reticulation systems leading into cabinets in server rooms or communications rooms are termin...
ISM-1102	Terminating reticulation close to cabinets	Cable reticulation systems leading into cabinets are terminated as close as possible to the cabinet.
ISM-1103	TOP SECRET reticulation to cabinets outside server rooms	In TOP SECRET areas, cable reticulation systems leading into cabinets not in server rooms or communications rooms are te...
ISM-1105	Contents of SECRET and TOP SECRET wall outlet boxes	SECRET and TOP SECRET wall outlet boxes contain exclusively SECRET or TOP SECRET cables.
ISM-1107	Colours for lower-classified wall outlet boxes	Non-classified, OFFICIAL: Sensitive and PROTECTED wall outlet boxes are coloured neither salmon pink nor red.
ISM-1109	Clear plastic wall outlet box covers	Wall outlet box covers are clear plastic.
ISM-1111	Use of fibre-optic cables	Fibre-optic cables are used for cabling infrastructure instead of copper cables.
ISM-1112	Inspectability of non-TOP SECRET cables	Cables in non-TOP SECRET areas are inspectable every five metres or less.
ISM-1114	Separation within shared reticulation systems	Cable bundles or conduits sharing a common cable reticulation system have a dividing partition or visible gap between ea...
ISM-1115	Conduit for cables in walls	Cables from cable trays to wall outlet boxes are run in flexible or plastic conduit.
ISM-1116	Visible gap between TOP SECRET cabinets	A visible gap exists between TOP SECRET cabinets and non-TOP SECRET cabinets.
ISM-1119	Full-length inspectability of TOP SECRET cables	Cables in TOP SECRET areas are fully inspectable for their entire length.
ISM-1122	TOP SECRET cables in wall penetrations	Where wall penetrations exit a TOP SECRET area into a lower classified area, TOP SECRET cables are encased in conduit wi...
ISM-1123	UPS-fed power for TOP SECRET equipment	A power distribution board with a feed from an Uninterruptible Power Supply is used to power all TOP SECRET IT equipment...
ISM-1130	Enclosed reticulation in shared facilities	In shared facilities, cables are run in an enclosed cable reticulation system.
ISM-1133	TOP SECRET cables and party walls	In shared facilities, TOP SECRET cables are not run in party walls.
ISM-1137	Emanation assessments for fixed facilities	System owners deploying SECRET or TOP SECRET systems within fixed facilities contact ASD for an emanation security risk...
ISM-1164	Clear covers for reticulation in shared facilities	In shared facilities, conduits or the front covers of ducts, cable trays in floors and ceilings, and associated fittings...
ISM-1216	Banding cables with non-conformant colours	SECRET and TOP SECRET cables with non-conformant cable colouring are banded with the appropriate colour and labelled at...
ISM-1639	Labelling building management cables	Building management cables are labelled with their purpose in black writing on a yellow background, with a minimum size...
ISM-1640	Labelling cables for foreign systems	Cables for foreign systems installed in Australian facilities are labelled at inspection points.
ISM-1645	Floor plan diagram maintenance	Floor plan diagrams are developed, implemented, maintained and verified on a regular basis.
ISM-1646	Floor plan diagram contents	Floor plan diagrams contain the following: - cable paths (including ingress and egress points between floors) - cable re...
ISM-1718	SECRET cable colour	SECRET cables are coloured salmon pink.
ISM-1719	TOP SECRET cable colour	TOP SECRET cables are coloured red.
ISM-1720	SECRET wall outlet box colour	SECRET wall outlet boxes are coloured salmon pink.
ISM-1721	TOP SECRET wall outlet box colour	TOP SECRET wall outlet boxes are coloured red.
ISM-1820	Consistent cable colour per system	Cables for individual systems use a consistent colour.
ISM-1821	TOP SECRET cable bundles and conduits	TOP SECRET cables, when bundled together or run in conduit, are run exclusively in their own individual cable bundle or...
ISM-1822	Consistent wall outlet colour per system	Wall outlet boxes for individual systems use a consistent colour.
ISM-1884	Emanation security doctrine	Emanation security doctrine produced by ASD for the management of emanation security matters is complied with.
ISM-1885	Implementing emanation security mitigation advice	Recommended actions contained within emanation security mitigation advice issued for systems are implemented by system o...

Guidelines for communications systems

33 controls

Controls in the Guidelines for communications systems domain of Australian Information Security Manual — 33 controls
Code	Title	Description
ISM-0229	Permitted classification for telephone conversations	Personnel are advised of the permitted sensitivity or classification of information that can be discussed over internal...
ISM-0230	Awareness of non-secure telephone risks	Personnel are advised of security risks posed by non-secure telephone systems in areas where sensitive or classified con...
ISM-0231	Visual indication of connection type	When using cryptographic equipment to permit different levels of conversation for different kinds of connections, teleph...
ISM-0232	Encrypting telephone traffic over external systems	Telephone systems used for sensitive or classified conversations encrypt all traffic that passes over external systems.
ISM-0233	Cordless telephone handsets and headsets	Cordless telephone handsets and headsets are not used for sensitive or classified conversations unless all communication...
ISM-0235	Speakerphones in TOP SECRET areas	Speakerphones are not used on telephone systems in TOP SECRET areas unless the telephone system is located in an audio s...
ISM-0236	Off-hook audio protection features	Off-hook audio protection features are used on telephone systems in areas where background conversations may exceed the...
ISM-0245	Connecting MFDs to digital telephone systems	MFDs are not connected to digital telephone systems.
ISM-0546	Video-aware and voice-aware firewalls and proxies	When video conferencing or IP telephony traffic passes through a gateway containing a firewall or proxy, a video-aware o...
ISM-0547	Secure real-time transport protocol for calls	Video conferencing and IP telephony calls are conducted using a secure real-time transport protocol.
ISM-0548	Secure session initiation protocol for calls	Video conferencing and IP telephony calls are established using a secure session initiation protocol.
ISM-0549	Separating voice and video from data traffic	Video conferencing and IP telephony traffic is separated physically or logically from other data traffic.
ISM-0551	IP phone registration and device hardening	IP telephony is configured such that: - IP phones authenticate themselves to the call controller upon registration - aut...
ISM-0553	Authentication on video conferencing networks	Authentication and authorisation is used for all actions on a video conferencing network, including call setup and chang...
ISM-0554	Two-way call authentication scheme	An encrypted and non-replayable two-way authentication scheme is used for call authentication and authorisation.
ISM-0555	Authentication on IP telephony networks	Authentication and authorisation is used for all actions on an IP telephony network, including registering a new IP phon...
ISM-0556	Workstations connected to phones and video units	Workstations are not connected to video conferencing units or IP phones unless the workstation or the device uses Virtua...
ISM-0558	IP phones in public areas	IP phones used in public areas do not have the ability to access data networks, voicemail and directory services.
ISM-0559	Microphones and webcams in SECRET areas	Microphones (including headsets and USB handsets) and webcams are not used with non-SECRET workstations in SECRET areas.
ISM-0588	Multifunction device usage policy	An MFD usage policy is developed, implemented and maintained.
ISM-0589	Scanning and copying documents on MFDs	MFDs are not used to scan or copy documents above the sensitivity or classification of networks they are connected to.
ISM-0590	Authentication strength for MFDs	Authentication measures for MFDs are the same strength as those used for workstations on networks they are connected to.
ISM-0931	Push-to-talk handsets and headsets	In SECRET and TOP SECRET areas, push-to-talk handsets or push-to-talk headsets are used to meet any off-hook audio prote...
ISM-1014	Individual logins for classified IP phones	Individual logins are implemented for IP phones used for SECRET or TOP SECRET conversations.
ISM-1019	Denial of service response plan for communications	A denial of service response plan for video conferencing and IP telephony services is developed, implemented and maintai...
ISM-1036	Observing multifunction device use	MFDs are located in areas where their use can be observed.
ISM-1078	Telephone system usage policy	A telephone system usage policy is developed, implemented and maintained.
ISM-1450	Microphones and webcams in TOP SECRET areas	Microphones (including headsets and USB handsets) and webcams are not used with non-TOP SECRET workstations in TOP SECRE...
ISM-1562	Video conferencing and IP telephony hardening	Video conferencing and IP telephony infrastructure is hardened.
ISM-1805	Content of the denial of service response plan	A denial of service response plan for video conferencing and IP telephony services contains the following: - how to iden...
ISM-1854	Authenticating to multifunction devices	Users authenticate to MFDs before they can print, scan or copy documents.
ISM-1855	Logging multifunction device use	Use of MFDs for printing, scanning and copying purposes, including the capture of shadow copies of documents, are centra...
ISM-2075	Sending and receiving fax messages	Fax machines, and online fax services, are not used for sending or receiving fax messages.

Guidelines for cryptography

73 controls

Controls in the Guidelines for cryptography domain of Australian Information Security Manual — 73 controls
Code	Title	Description
ISM-0142	Reporting cryptographic equipment compromise	The compromise or suspected compromise of cryptographic equipment or associated keying material is reported to the chief...
ISM-0455	Data recovery for encrypted data	Where practical, cryptographic equipment, applications and libraries provide a means of data recovery to allow for circu...
ISM-0457	Evaluated encryption for sensitive media	Cryptographic equipment, applications or libraries that have completed a Common Criteria evaluation against an ASD-endor...
ISM-0459	Full disk or partial encryption at rest	Full disk encryption, or partial encryption where access controls will only allow writing to the encrypted partition, is...
ISM-0460	HACE for SECRET and TOP SECRET media	HACE is used when encrypting media that contains SECRET or TOP SECRET data.
ISM-0462	Handling authenticated encrypted equipment and media	When a user authenticates to the encryption functionality of IT equipment or media, it is treated in accordance with its...
ISM-0465	Evaluated encryption for sensitive data in transit	Cryptographic equipment, applications or libraries that have completed a Common Criteria evaluation against an ASD-endor...
ISM-0467	HACE for SECRET and TOP SECRET data in transit	HACE is used to protect SECRET and TOP SECRET data when communicated over insufficiently secure networks, outside of app...
ISM-0469	Encrypting data in transit	An ASD-Approved Cryptographic Protocol (AACP) or high assurance cryptographic protocol is used to protect data when comm...
ISM-0471	Using ASD-Approved Cryptographic Algorithms	Only AACAs or high assurance cryptographic algorithms are used by cryptographic equipment, applications and libraries.
ISM-0472	Diffie-Hellman modulus of at least 2048 bits	When using DH for agreeing on encryption session keys, a modulus of at least 2048 bits is used, preferably 3072 bits.
ISM-0474	ECDH key size and curve selection	When using ECDH for agreeing on encryption session keys, a base point order and key size of at least 224 bits is used, p...
ISM-0475	ECDSA key size and curve selection	When using ECDSA for digital signatures, a base point order and key size of at least 224 bits is used, preferably the P-...
ISM-0476	RSA modulus of at least 2048 bits	When using RSA for digital signatures, and transporting encryption session keys (and similar keys), a modulus of at leas...
ISM-0477	Separate RSA key pairs for signing and key transport	When using RSA for digital signatures, and for transporting encryption session keys (and similar keys), a different key...
ISM-0479	Avoiding Electronic Codebook Mode	Symmetric cryptographic algorithms are not used in Electronic Codebook Mode.
ISM-0481	Using ASD-Approved Cryptographic Protocols	Only AACPs or high assurance cryptographic protocols are used by cryptographic equipment, applications and libraries.
ISM-0484	Configuring the SSH daemon	The SSH daemon is configured to: - only listen on the required interfaces (ListenAddress xxx.xxx.xxx.xxx) - have a suita...
ISM-0485	Public key authentication for SSH	Public key-based authentication is used for SSH connections.
ISM-0487	Restrictions on passwordless SSH logins	When using logins without a password for SSH connections, the following are disabled: - access from IP addresses that do...
ISM-0488	Forced commands for passwordless SSH access	If using remote access without the use of a password for SSH connections, the 'forced command' option is used to specify...
ISM-0489	Key caching limits for SSH-agent	When SSH-agent or similar key caching applications are used, it is limited to workstations and servers with screen locks...
ISM-0490	Minimum S/MIME version	Versions of S/MIME earlier than S/MIME version 3.0 are not used for S/MIME connections.
ISM-0494	IPsec tunnel mode	Tunnel mode is used for IPsec connections; however, if using transport mode, an IP tunnel is used.
ISM-0496	Using ESP for IPsec	The ESP protocol is used for authentication and encryption of IPsec connections.
ISM-0498	IPsec security association lifetimes	A security association lifetime of less than four hours (14400 seconds) is used for IPsec connections.
ISM-0499	Complying with ASD COMSEC doctrine for HACE	Communications security doctrine and policy produced by ASD for the management and operation of HACE is complied with.
ISM-0501	Transporting keyed cryptographic equipment	Keyed cryptographic equipment is transported based on the sensitivity or classification of its keying material.
ISM-0507	Cryptographic key management processes	Cryptographic key management processes, and supporting cryptographic key management procedures, are developed, implement...
ISM-0994	Preferring ECDH over DH	ECDH is used in preference to DH.
ISM-0998	IPsec integrity algorithms	AUTH_HMAC_SHA2_256_128, AUTH_HMAC_SHA2_384_192, AUTH_HMAC_SHA2_512_256 or NONE (only with AES-GCM) is used for authentic...
ISM-0999	IPsec key establishment groups	DH or ECDH is used for key establishment of IPsec connections, preferably 384-bit random ECP group, 3072-bit MODP Group...
ISM-1000	Perfect Forward Secrecy for IPsec	PFS is used for IPsec connections.
ISM-1080	Approved algorithms for media encryption	An ASD-Approved Cryptographic Algorithm (AACA) or high assurance cryptographic algorithm is used when encrypting media.
ISM-1091	Changing compromised keying material	Keying material is changed when compromised or suspected of being compromised.
ISM-1139	Using the latest TLS version	Only the latest version of TLS is used for TLS connections.
ISM-1233	Using IKE version 2	IKE version 2 is used for key exchange when establishing IPsec connections.
ISM-1369	Using AES-GCM for TLS	AES-GCM is used for encryption of TLS connections.
ISM-1370	Server-initiated secure renegotiation for TLS	Only server-initiated secure renegotiation is used for TLS connections.
ISM-1372	DH or ECDH for TLS key establishment	DH or ECDH is used for key establishment of TLS connections.
ISM-1373	Excluding anonymous DH for TLS	Anonymous DH is not used for TLS connections.
ISM-1374	SHA-2-based certificates for TLS	SHA-2-based certificates are used for TLS connections.
ISM-1375	SHA-2 for TLS HMAC and PRF	SHA-2 is used for the Hash-based Message Authentication Code (HMAC) and pseudorandom function (PRF) for TLS connections.
ISM-1446	Curve selection for elliptic curve cryptography	When using elliptic curve cryptography, a suitable curve from NIST SP 800-186 is used.
ISM-1448	Ephemeral DH and ECDH for TLS	When using DH or ECDH for key establishment of TLS connections, the ephemeral variant is used.
ISM-1449	Protecting SSH private keys	SSH private keys are protected with a password or a key encryption key.
ISM-1453	Perfect Forward Secrecy for TLS	Perfect Forward Secrecy (PFS) is used for TLS connections.
ISM-1506	Disabling SSH version 1	The use of SSH version 1 is disabled for SSH connections.
ISM-1553	Disabling TLS compression	TLS compression is disabled for TLS connections.
ISM-1629	Diffie-Hellman parameter selection	When using DH for agreeing on encryption session keys, a modulus and associated parameters are selected according to NIS...
ISM-1759	Diffie-Hellman modulus of at least 3072 bits	When using DH for agreeing on encryption session keys, a modulus of at least 3072 bits is used, preferably 3072 bits.
ISM-1761	ECDH curves P-256, P-384 or P-521	When using ECDH for agreeing on encryption session keys, NIST P-256, P-384 or P-521 curves are used, preferably the NIST...
ISM-1762	ECDH curves P-384 or P-521	When using ECDH for agreeing on encryption session keys, NIST P-384 or P-521 curves are used, preferably the NIST P-384...
ISM-1763	ECDSA curves P-256, P-384 or P-521	When using ECDSA for digital signatures, NIST P-256, P-384 or P-521 curves are used, preferably the NIST P-384 curve.
ISM-1764	ECDSA curves P-384 or P-521	When using ECDSA for digital signatures, NIST P-384 or P-521 curves are used, preferably the NIST P-384 curve.
ISM-1765	RSA modulus of at least 3072 bits	When using RSA for digital signatures, and transporting encryption session keys (and similar keys), a modulus of at leas...
ISM-1766	SHA-2 output size of at least 224 bits	When using SHA-2 for hashing, an output size of at least 224 bits is used, preferably SHA-384 or SHA-512.
ISM-1767	SHA-2 output size of at least 256 bits	When using SHA-2 for hashing, an output size of at least 256 bits is used, preferably SHA-384 or SHA-512.
ISM-1768	SHA-2 output size of at least 384 bits	When using SHA-2 for hashing, an output size of at least 384 bits is used, preferably SHA-384 or SHA-512.
ISM-1769	AES key lengths	When using AES for encryption, AES-128, AES-192 or AES-256 is used, preferably AES-256.
ISM-1770	AES-192 or AES-256 key lengths	When using AES for encryption, AES-192 or AES-256 is used, preferably AES-256.
ISM-1771	AES for IPsec encryption	AES is used for encrypting IPsec connections, preferably ENCR_AES_GCM_16.
ISM-1772	IPsec pseudorandom function	PRF_HMAC_SHA2_256, PRF_HMAC_SHA2_384 or PRF_HMAC_SHA2_512 is used for IPsec connections, preferably PRF_HMAC_SHA2_512.
ISM-1802	Approved High Assurance Cryptographic Equipment	HACE are issued an Approval for Use by ASD and operated in accordance with the latest version of their associated Austra...
ISM-1917	Procurement support for ML-DSA, ML-KEM and AES-256	The development and procurement of new cryptographic equipment, applications and libraries ensures support for the use o...
ISM-1990	FIPS 140-3 validation for ML-DSA and ML-KEM	When using ML-DSA and ML-KEM, as per FIPS 204 and FIPS 203 respectively, adherence to pre-requisite FIPS 140-3 validatio...
ISM-1991	ML-DSA parameter sets	When using ML-DSA for digital signatures, ML-DSA-65 or ML-DSA-87 is used, preferably ML-DSA-87.
ISM-1992	Hedged ML-DSA signing	When using ML-DSA for digital signatures, the hedged variant is used whenever possible.
ISM-1993	Restricting use of pre-hashed ML-DSA variants	Pre-hashed variants of ML-DSA-65 and ML-DSA-87 are only used when the performance of default variants is unacceptable.
ISM-1994	Hash functions for pre-hashed ML-DSA	When the pre-hashed variants of ML-DSA-65 and ML-DSA-87 are used, at least SHA-384 and SHA-512 respectively are used for...
ISM-1995	ML-KEM parameter sets for key encapsulation	When using ML-KEM for encapsulating encryption session keys (and similar keys), ML-KEM-768 or ML-KEM-1024 is used, prefe...
ISM-1996	Post-quantum traditional hybrid schemes	When a post-quantum traditional hybrid scheme is used, either the post-quantum cryptographic algorithm, the traditional...
ISM-2073	Post-quantum cryptography transition plan	A post-quantum cryptography transition plan is developed, implemented and maintained.

Guidelines for cyber security documentation

11 controls

Controls in the Guidelines for cyber security documentation domain of Australian Information Security Manual — 11 controls
Code	Title	Description
ISM-0039	Cyber security strategy	A cyber security strategy is developed, implemented and maintained.
ISM-0041	System security plan contents	Systems have a system security plan that includes an overview of the system (covering the system's purpose, the system b...
ISM-0043	Cyber security incident response plan contents	Systems have a cyber security incident response plan that covers the following: - guidelines on what constitutes a cyber...
ISM-0047	CISO and authorising officer document approvals	Organisational-level cyber security documentation is approved by the chief information security officer while system-spe...
ISM-0888	Annual review and currency statements	Cyber security documentation is reviewed at least annually and includes a 'current as at \[date\]' or equivalent stateme...
ISM-0912	Change and configuration management plan	Systems have a change and configuration management plan that includes: - the establishment and maintenance of authorised...
ISM-1163	Continuous monitoring plan	Systems have a continuous monitoring plan that includes: - conducting vulnerability scans for systems at least fortnight...
ISM-1563	Security assessment report	At the conclusion of a security assessment for a system, a security assessment report is produced by the assessor and co...
ISM-1564	Plan of action and milestones	At the conclusion of a security assessment for a system, a plan of action and milestones is produced by the system owner...
ISM-1602	Communication of cyber security documentation	Cyber security documentation, including notification of subsequent changes, is communicated to all stakeholders.
ISM-1739	Approval of security architecture before development	A system's security architecture is approved prior to the development of the system.

Guidelines for cyber security incidents

22 controls

Controls in the Guidelines for cyber security incidents domain of Australian Information Security Manual — 22 controls
Code	Title	Description
ISM-0120	Access to data sources and tools	Cyber security personnel have access to sufficient data sources and tools to ensure that systems can be monitored for ke...
ISM-0123	Reporting incidents to the CISO	Cyber security incidents are reported to the chief information security officer, or one of their delegates, as soon as p...
ISM-0125	Maintaining a cyber security incident register	A cyber security incident register is developed, implemented and maintained.
ISM-0133	Handling and containing data spills	When a data spill occurs, data owners are advised and access to the data is restricted.
ISM-0137	Legal advice before allowing intrusions to continue	Legal advice is sought before allowing intrusion activity to continue on a system for the purpose of collecting further...
ISM-0138	Maintaining the integrity of evidence	The integrity of evidence gathered during an investigation is maintained by investigators: - recording all of their acti...
ISM-0140	Reporting incidents to ASD	Cyber security incidents are reported to ASD as soon as possible after they occur or are discovered.
ISM-0576	Incident management policy and response plan	A cyber security incident management policy, and associated cyber security incident response plan, is developed, impleme...
ISM-0917	Handling malicious code infections	When malicious code is detected, the following steps are taken to handle the infection: - the infected systems are isola...
ISM-1213	Traffic capture after intrusion remediation	Following intrusion remediation activities, full network traffic is captured for at least seven days and analysed to det...
ISM-1609	Consulting system owners before allowing intrusions to continue	System owners are consulted before allowing intrusion activity to continue on a system for the purpose of collecting fur...
ISM-1625	Insider threat mitigation program	An insider threat mitigation program is developed, implemented and maintained.
ISM-1626	Legal advice on insider threat program	Legal advice is sought regarding the development and implementation of an insider threat mitigation program.
ISM-1731	Separate system for remediation planning	Planning and coordination of intrusion remediation activities are conducted on a separate system to that which has been...
ISM-1732	Coordinated remediation during a planned outage	To the extent possible, all intrusion remediation activities are conducted in a coordinated manner during the same plann...
ISM-1784	Annual exercising of incident response plan	The cyber security incident management policy, including the associated cyber security incident response plan, is exerci...
ISM-1803	Incident register entry contents	A cyber security incident register contains the following for each cyber security incident: - the date the cyber securit...
ISM-1819	Enacting cyber security incident response plans	Following the identification of a cyber security incident, the cyber security incident response plan is enacted.
ISM-1880	Reporting incidents involving customer data	Cyber security incidents that involve customer data are reported to customers and the public in a timely manner after th...
ISM-1881	Reporting incidents not involving customer data	Cyber security incidents that do not involve customer data are reported to customers and the public in a timely manner a...
ISM-1969	Treating malicious code before storage or transfer	Malicious code, when stored or communicated, is treated beforehand to prevent accidental execution.
ISM-1970	Dedicated malware analysis environment	Malicious code processed for cyber security incident response or research purposes is done so in a dedicated analysis en...

Guidelines for cyber security roles

42 controls

Controls in the Guidelines for cyber security roles domain of Australian Information Security Manual — 42 controls
Code	Title	Description
ISM-0009	Identifying supplementary controls	System owners, in consultation with each system's authorising officer, identify any supplementary controls required base...
ISM-0027	Authorisation to operate from authorising officer	System owners obtain an authorisation to operate for each non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET syst...
ISM-0714	Appointment of a CISO	A CISO is appointed to provide cyber security leadership and guidance for their organisation (covering information techn...
ISM-0717	CISO oversight of cyber security personnel	The CISO oversees the management of cyber security personnel within their organisation.
ISM-0718	CISO reporting to the board	The CISO regularly reports directly to their organisation's board of directors or executive committee on cyber security...
ISM-0720	Cyber security communications strategy	The CISO oversees the development, implementation and maintenance of a cyber security communications strategy to assist...
ISM-0724	Cyber security metrics and KPIs	The CISO implements cyber security measurement metrics and key performance indicators for their organisation.
ISM-0725	Cyber security steering committee	The CISO coordinates cyber security and business alignment through a cyber security steering committee or advisory board...
ISM-0726	Coordinating security risk management	The CISO coordinates security risk management activities between cyber security and business teams.
ISM-0731	Oversight of cyber supply chain risk management	The CISO oversees cyber supply chain risk management activities for their organisation.
ISM-0732	Dedicated cyber security budget	The CISO receives and manages a dedicated cyber security budget for their organisation.
ISM-0733	CISO awareness of all incidents	The CISO is fully aware of all cyber security incidents within their organisation.
ISM-0734	CISO contribution to continuity and recovery planning	The CISO contributes to the development, implementation and maintenance of business continuity and disaster recovery pla...
ISM-0735	Oversight of awareness training program	The CISO oversees the development, implementation and maintenance of their organisation's cyber security awareness train...
ISM-1071	Designated system owners	Each system has a designated system owner.
ISM-1203	Threat and risk assessment for each system	System owners, in consultation with each system's authorising officer, conduct a threat and risk assessment for each sys...
ISM-1478	Oversight of cyber security program and compliance	The CISO oversees their organisation's cyber security program and ensures their organisation's compliance with cyber sec...
ISM-1525	Registering systems with the authorising officer	System owners register each system with its authorising officer.
ISM-1526	Continuous security monitoring by system owners	System owners continuously monitor the security of each system, and manage associated cyber threats, security risks and...
ISM-1587	Annual reporting of system security status	System owners report the security status of each system to its authorising officer at least annually.
ISM-1617	Review and update of cyber security program	The CISO regularly reviews and updates their organisation's cyber security program to ensure its relevance in addressing...
ISM-1618	CISO oversight of incident response	The CISO oversees their organisation's response to cyber security incidents.
ISM-1633	System boundary, criticality and objectives	System owners, in consultation with each system's authorising officer, determine the system boundary, business criticali...
ISM-1634	Selecting and tailoring controls	System owners, in consultation with each system's authorising officer, select controls for each system and tailor them t...
ISM-1635	Implementing controls for each system	System owners implement controls for each system and its operating environment.
ISM-1636	Security assessment by organisational or IRAP assessors	System owners, in consultation with each system's authorising officer, ensure controls for each non-classified, OFFICIAL...
ISM-1918	CISO reporting to audit and risk committee	The CISO regularly reports directly to their organisation's audit, risk and compliance committee (or equivalent) on cybe...
ISM-1966	Register of systems	The CISO develops, implements, maintains and verifies on a regular basis a register of systems used by their organisatio...
ISM-1967	ASD assessment of TOP SECRET systems	System owners, in consultation with each system's authorising officer, ensure controls for each TOP SECRET system and it...
ISM-1968	Authorisation to operate for TOP SECRET systems	System owners obtain an authorisation to operate for each TOP SECRET system, including for each sensitive compartmented...
ISM-1997	Defining cyber security roles and responsibilities	The board of directors or executive committee defines clear roles and responsibilities for cyber security both within th...
ISM-1998	Integrating cyber security across business functions	The board of directors or executive committee ensures that cyber security is integrated throughout all business function...
ISM-1999	Aligning cyber strategy with business strategy	The board of directors or executive committee ensures the cyber security strategy for their organisation is aligned with...
ISM-2000	Cyber security briefings to the board	The board of directors or executive committee seeks regular briefings or reporting on the cyber security posture of thei...
ISM-2001	Championing a positive cyber security culture	The board of directors or executive committee champions a positive cyber security culture within their organisation, inc...
ISM-2002	Board cyber security literacy	The board of directors or executive committee maintains a sufficient level of cyber security literacy to fulfil both the...
ISM-2003	Awareness of cyber workforce and skills gaps	The board of directors or executive committee maintains awareness of key cyber security recruitment activities, retentio...
ISM-2004	Supporting cyber skills development	The board of directors or executive committee supports the development of cyber security skills and experience for all p...
ISM-2005	Understanding critical business assets	The board of directors or executive committee understands the business criticality of their organisation's systems, incl...
ISM-2006	Board planning for major cyber security incidents	The board of directors or executive committee plans for major cyber security incidents, including by participating in ex...
ISM-2020	CISO oversight of cyber security workforce	The CISO ensures sufficient cyber security personnel, with the right skills and experience, are acquired to support cybe...
ISM-2021	System owner data minimisation practices	System owners implement and maintain data minimisation practices for each of their systems.

Guidelines for data transfers

14 controls

Controls in the Guidelines for data transfers domain of Australian Information Security Manual — 14 controls
Code	Title	Description
ISM-0657	Scanning manually imported data	When manually importing data to systems, the data is scanned for malicious and active content.
ISM-0660	Full monthly verification of SECRET and TOP SECRET transfer logs	Data transfer logs for SECRET and TOP SECRET systems are fully verified at least monthly.
ISM-0661	User accountability for data transfers	Users transferring data to and from systems are held accountable for data transfers they perform.
ISM-0663	Data transfer processes and procedures	Data transfer processes, and supporting data transfer procedures, are developed, implemented and maintained.
ISM-0664	Review and authorisation of classified data exports	Data exported from SECRET and TOP SECRET systems is reviewed and authorised by a trustworthy source beforehand.
ISM-0665	Trustworthy sources for classified systems	Trustworthy sources for SECRET and TOP SECRET systems are limited to people and services that have been verified and aut...
ISM-0669	Signature validation and keyword checks on manual exports	When manually exporting data from SECRET and TOP SECRET systems, digital signatures are validated and keyword checks are...
ISM-0675	Digital signing of authorised classified exports	Data authorised for export from SECRET and TOP SECRET systems is digitally signed by a trustworthy source.
ISM-1187	Checking manual exports for unsuitable markings	When manually exporting data from systems, the data is checked for unsuitable protective markings.
ISM-1294	Partial monthly verification of transfer logs	Data transfer logs for systems are partially verified at least monthly.
ISM-1535	Preventing export of AUSTEO, AGAO and REL data	Processes, and supporting procedures, are developed, implemented and maintained to prevent AUSTEO, AGAO and REL data in...
ISM-1586	Logging all data imports and exports	Data transfer logs are used to record all data imports and exports from systems.
ISM-1778	Quarantining failed manual imports	When manually importing data to systems, all data that fails security checks is quarantined until reviewed and subsequen...
ISM-1779	Quarantining failed manual exports	When manually exporting data from systems, all data that fails security checks is quarantined until reviewed and subsequ...

Guidelines for database systems

13 controls

Controls in the Guidelines for database systems domain of Australian Information Security Manual — 13 controls
Code	Title	Description
ISM-0393	Classifying databases and their contents	Databases and their contents are classified based on the sensitivity or classification of data that they contain.
ISM-1243	Maintaining and verifying a database register	A database register is developed, implemented, maintained and verified on a regular basis.
ISM-1255	Restricting database user actions by duty	Database users' ability to access, insert, modify and remove database contents is restricted based on their work duties.
ISM-1256	File-based access controls on database files	File-based access controls are applied to database files.
ISM-1268	Need-to-know enforcement for database contents	The need-to-know principle is enforced for database contents through the application of minimum privileges, database vie...
ISM-1269	Separating database servers from web servers	Database servers and web servers are functionally separated.
ISM-1270	Network segmentation of database servers	Database servers are placed on a different network segment to user workstations.
ISM-1271	Restricting database server network communications	Network access controls are implemented to restrict database server communications to strictly defined network resources...
ISM-1272	Disabling unneeded database networking	If only local access to a database is required, networking functionality of database management system applications are...
ISM-1273	Segregating database servers across environments	Database servers for development, testing, staging and production environments are segregated.
ISM-1274	Production database contents in non-production environments	Database contents from production environments are not used in non-production environments unless the non-production env...
ISM-1277	Encrypting web to database communications	Data communicated between database servers and web servers is encrypted.
ISM-1537	Database event logging	Security-relevant events for databases are centrally logged, including: - access or modification of particularly importa...

Guidelines for email

26 controls

Controls in the Guidelines for email domain of Australian Information Security Manual — 26 controls
Code	Title	Description
ISM-0264	Email usage policy	An email usage policy is developed, implemented and maintained.
ISM-0267	Blocking non-approved webmail services	Access to non-approved webmail services is blocked.
ISM-0269	Caveated email and distribution lists	Emails containing Australian Eyes Only, Australian Government Access Only or Releasable To data are not sent to email di...
ISM-0270	Protective markings on emails	Protective markings are applied to emails and reflect the highest sensitivity or classification of the subject, body and...
ISM-0271	No automatic insertion of protective markings	Protective marking tools do not automatically insert protective markings into emails.
ISM-0272	Restricting marking choices to authorised levels	Protective marking tools do not allow users to select protective markings that a system has not been authorised to proce...
ISM-0565	Blocking emails with inappropriate markings	Email servers are configured to block, log and report emails with inappropriate protective markings.
ISM-0567	Preventing open relay email servers	Email servers only relay emails destined for or originating from their domains (including subdomains).
ISM-0569	Routing email through central gateways	Emails are routed via centralised email gateways.
ISM-0570	Maintaining backup email gateways	Where backup or alternative email gateways are in place, they are maintained at the same standard as the primary email g...
ISM-0571	Authenticated encrypted client email channels	When users send or receive emails, an authenticated and encrypted channel is used to route emails via their organisation...
ISM-0572	Opportunistic TLS on email servers	Opportunistic TLS encryption is enabled on email servers that make incoming or outgoing email connections over public ne...
ISM-0574	SPF records for organisational domains	SPF is used to specify authorised email servers (or lack thereof) for an organisation's domains (including subdomains).
ISM-0861	DKIM signing of outgoing email	DKIM signing is enabled on emails originating from an organisation's domains (including subdomains).
ISM-1023	Notifying senders and recipients of blocked email	The intended recipients of blocked inbound emails, and the senders of blocked outbound emails, are notified.
ISM-1024	Verified senders for undeliverable notifications	Notifications of undeliverable emails are only sent to senders that can be verified via SPF or other trusted means.
ISM-1026	Verifying DKIM signatures on incoming email	DKIM signatures on incoming emails are verified.
ISM-1027	Distribution list handling of external DKIM	Email distribution list applications used by external senders is configured such that it does not break the validity of...
ISM-1089	Preventing marking downgrades on replies	Protective marking tools do not allow users replying to or forwarding emails to select protective markings lower than pr...
ISM-1151	SPF verification of incoming email	SPF is used to verify the authenticity of incoming emails.
ISM-1183	Hard fail SPF records	A hard fail SPF record is used when specifying authorised email servers (or lack thereof) for an organisation's domains...
ISM-1234	Filtering email bodies and attachments	Email content filtering is implemented to filter potentially harmful content in email bodies and attachments.
ISM-1502	Blocking external email using internal domains	Emails arriving via an external connection where the email source address uses an internal domain, or internal subdomain...
ISM-1540	DMARC reject policy for organisational domains	DMARC records are configured for an organisation's domains (including subdomains) such that emails are rejected if they...
ISM-1589	MTA-STS for email transport	MTA-STS is enabled to prevent the unencrypted transfer of emails between email servers.
ISM-1799	Rejecting incoming email failing DMARC	Incoming emails are rejected if they do not pass DMARC checks.

Guidelines for enterprise mobility

50 controls

Controls in the Guidelines for enterprise mobility domain of Australian Information Security Manual — 50 controls
Code	Title	Description
ISM-0240	Paging, SMS and messaging apps for sensitive data	Paging, Multimedia Message Service, Short Message Service and messaging apps are not used to communicate sensitive or cl...
ISM-0682	Bluetooth on SECRET and TOP SECRET mobile devices	Bluetooth functionality is not enabled on SECRET and TOP SECRET mobile devices.
ISM-0687	ASD-approved platforms for classified mobility	Mobile devices that access SECRET or TOP SECRET systems or data use mobile platforms that have been issued an Approval f...
ISM-0694	Private devices and classified systems	Privately-owned mobile devices and desktop computers do not access SECRET and TOP SECRET systems or data.
ISM-0701	Mobile device emergency sanitisation procedures	Mobile device emergency sanitisation processes, and supporting mobile device emergency sanitisation procedures, are deve...
ISM-0702	Cryptographic zeroise in emergency sanitisation	If a cryptographic zeroise or sanitise function is provided for cryptographic keys on a SECRET or TOP SECRET mobile devi...
ISM-0705	Disabling VPN split tunnelling	When accessing an organisation's network via a VPN connection, split tunnelling is disabled.
ISM-0863	Blocking unapproved application installation	Mobile devices prevent personnel from installing non-approved applications once provisioned.
ISM-0864	Locking mobile device security settings	Mobile devices prevent personnel from disabling or modifying security functionality once provisioned.
ISM-0866	Viewing classified data in public	Sensitive or classified data is not viewed on mobile devices in public locations unless care is taken to reduce the chan...
ISM-0869	Encrypting mobile device storage	Mobile devices encrypt their internal storage and any removable media.
ISM-0870	Securing mobile devices when not in use	Mobile devices are carried or stored in a secured state when not being actively used.
ISM-0871	Supervising mobile devices in use	Mobile devices are kept under continual direct supervision when being actively used.
ISM-0874	Internet access via organisational gateways	Mobile devices and desktop computers access the internet via an organisation's internet gateway rather than via a direct...
ISM-1082	Mobile device usage policy	A mobile device usage policy is developed, implemented and maintained.
ISM-1083	Advising permitted classification for mobile communications	Personnel are advised of the sensitivity or classification permitted for voice and data communications when using mobile...
ISM-1084	Transporting mobile devices in approved containers	If unable to carry or store mobile devices in a secured state, they are physically transferred in a security briefcase o...
ISM-1085	Encrypting mobile data over public networks	Mobile devices encrypt all sensitive or classified data communicated over public network infrastructure.
ISM-1088	Reporting potential mobile device compromise	Personnel report the potential compromise of mobile devices, removable media or credentials to their organisation as soo...
ISM-1145	Privacy filters on classified mobile devices	Privacy filters are applied to the screens of SECRET and TOP SECRET mobile devices.
ISM-1195	Common Criteria evaluated MDM solutions	Mobile Device Management solutions that have completed a Common Criteria evaluation against the Protection Profile for M...
ISM-1196	Bluetooth discoverability on mobile devices	Non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices are configured to remain undiscoverable to other Blueto...
ISM-1198	Pairing only with intended Bluetooth devices	Bluetooth pairing for non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices is performed in a manner such tha...
ISM-1199	Removing unneeded Bluetooth pairings	Bluetooth pairings for non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices are removed when there is no lon...
ISM-1200	Bluetooth Secure Connections and Numeric Comparison	Bluetooth pairing for non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices is performed using Secure Connect...
ISM-1297	Legal advice before allowing privately-owned devices	Legal advice is sought prior to allowing privately-owned mobile devices and desktop computers to access systems or data.
ISM-1298	Overseas travel privacy and security briefing	Personnel are advised of privacy and security risks when travelling overseas with mobile devices.
ISM-1299	Mobile device security precautions for personnel	Personnel are advised to take the following precautions when using mobile devices: - never leave mobile devices or remov...
ISM-1300	Actions after overseas travel	Upon returning from travelling overseas with mobile devices, personnel take the following actions: - sanitise and reset...
ISM-1366	Applying security updates to mobile devices	Security updates are applied to mobile devices as soon as they become available.
ISM-1400	Separating data on privately-owned devices	Personnel using privately-owned mobile devices or desktop computers to access OFFICIAL: Sensitive or PROTECTED systems o...
ISM-1482	Separating data on organisation-owned devices	Personnel using organisation-owned mobile devices or desktop computers to access classified systems or data have enforce...
ISM-1533	Mobile device management policy	A mobile device management policy is developed, implemented and maintained.
ISM-1554	Travel to high or extreme risk countries	If travelling overseas with mobile devices to high or extreme risk countries, personnel are: - issued with newly provisi...
ISM-1555	Preparing mobile devices before overseas travel	Before travelling overseas with mobile devices, personnel take the following actions: - record all details of the mobile...
ISM-1556	Actions after travel to high risk countries	If returning from travelling overseas with mobile devices to high or extreme risk countries, personnel take the followin...
ISM-1644	Sensitive conversations in public locations	Sensitive or classified phone calls and conversations are not conducted in public locations unless care is taken to redu...
ISM-1866	Preventing storage of classified data on private devices	Personnel using privately-owned mobile devices or desktop computers to access OFFICIAL: Sensitive or PROTECTED systems o...
ISM-1867	Evaluated mobile platforms and ASD configuration	Mobile devices that access OFFICIAL: Sensitive or PROTECTED systems or data use mobile platforms that have completed a C...
ISM-1868	Removable media on SECRET and TOP SECRET mobile devices	SECRET and TOP SECRET mobile devices do not use removable media unless approved beforehand by ASD.
ISM-1886	Supervised mode for mobile devices	Mobile devices are configured to operate in a supervised (or equivalent) mode.
ISM-1887	Remote locate and wipe for mobile devices	Mobile devices are configured with remote locate and wipe functionality.
ISM-1888	Password-based lock screens on mobile devices	Mobile devices are configured with secure password-based lock screens.
ISM-2095	Unapproved AI agents on privately-owned devices	Personnel using privately-owned mobile devices or desktop computers to access OFFICIAL: Sensitive or PROTECTED systems o...
ISM-2096	Separating organisational and personal apps	Mobile devices are configured to enforce separation between organisational and personal mobile applications and data.
ISM-2097	Always on VPN for mobile devices	Mobile devices are configured with always on VPN functionality.
ISM-2098	Blocking USB data transfer on mobile devices	Mobile devices are configured to prevent data transfers over Universal Serial Bus connections.
ISM-2099	Connecting mobile devices to vehicle infotainment	Mobile devices are not connected to the infotainment systems of connected vehicles.
ISM-2100	Viewing sensitive data near connected vehicles	Sensitive or classified data is not viewed on mobile devices within or near connected vehicles.
ISM-2101	Conversations within or near connected vehicles	Sensitive or classified phone calls and conversations are not conducted within or near connected vehicles.

Guidelines for evaluated products

5 controls

Controls in the Guidelines for evaluated products domain of Australian Information Security Manual — 5 controls
Code	Title	Description
ISM-0280	Preferring PP-based evaluated products	If procuring an evaluated product, a product that has completed a PP-based evaluation, including against all applicable...
ISM-0285	Delivery procedures for evaluated products	Evaluated products are delivered in a manner consistent with any delivery procedures defined in associated evaluation do...
ISM-0286	Delivery of high assurance IT equipment	When procuring high assurance information technology (IT) equipment, ASD is contacted for any equipment-specific deliver...
ISM-0289	Operating products in evaluated configuration	Evaluated products are installed, configured, administered and operated in an evaluated configuration and in accordance...
ISM-0290	Operating high assurance IT equipment	High assurance IT equipment is installed, configured, administered and operated in an evaluated configuration and in acc...

Guidelines for gateways

63 controls

Controls in the Guidelines for gateways domain of Australian Information Security Manual — 63 controls
Code	Title	Description
ISM-0100	IRAP assessment of gateways	Non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET gateways undergo an IRAP assessment, using the latest release...
ISM-0260	Web access through web proxies	All web access, including that by internal servers, is conducted through web proxies.
ISM-0261	Web proxy event logging	The following details are centrally logged for websites accessed via web proxies: - web address - date and time - user -...
ISM-0263	Transport Layer Security filtering	TLS traffic communicated through gateways is decrypted and inspected.
ISM-0591	Using evaluated peripheral switches	Evaluated peripheral switches are used when sharing peripherals between systems.
ISM-0597	Consulting ASD on Cross Domain Solutions	When planning, designing, implementing or introducing additional connectivity to CDSs, ASD is consulted and any directio...
ISM-0610	Cross Domain Solution user training	Users are trained on the secure use of CDSs before access is granted.
ISM-0611	Minimum privileges for gateway administrators	System administrators for gateways are assigned the minimum privileges required to perform their duties.
ISM-0612	Formal training for gateway administrators	System administrators for gateways are formally trained on the operation and management of gateways.
ISM-0613	Australian nationals administering AUSTEO and REL gateways	System administrators for gateways that connect to Australian Eyes Only or Releasable To networks are Australian nationa...
ISM-0616	Separation of duties for gateway administration	Separation of duties is implemented in performing administrative activities for gateways.
ISM-0619	User authentication to networks via gateways	Users authenticate to other networks accessed via gateways.
ISM-0622	IT equipment authentication via gateways	IT equipment authenticates to other networks accessed via gateways.
ISM-0626	Cross Domain Solutions for SECRET and TOP SECRET networks	CDSs are implemented between SECRET or TOP SECRET networks and any other networks belonging to different security domain...
ISM-0628	Gateways between security domains	Gateways are implemented between networks belonging to different security domains.
ISM-0629	Administering shared gateway components	For gateways between networks belonging to different security domains, any shared components are managed by system admin...
ISM-0631	Explicitly authorised gateway data flows	Gateways only allow explicitly authorised data flows.
ISM-0634	Gateway event logging	Security-relevant events for gateways are centrally logged, including: - data packets and data flows permitted through g...
ISM-0635	Isolated upward and downward CDS paths	CDSs implement isolated upward and downward network paths.
ISM-0637	Demilitarised zones for external access	Gateways implement a demilitarised zone if external parties require access to an organisation's services.
ISM-0639	Evaluated firewalls between security domains	Evaluated firewalls are used between networks belonging to different security domains.
ISM-0643	Evaluated diodes for public network connections	Evaluated diodes are used for controlling the data flow of unidirectional gateways between an organisation's networks an...
ISM-0645	High assurance diodes for classified public connections	Evaluated diodes used for controlling the data flow of unidirectional gateways between SECRET or TOP SECRET networks and...
ISM-0649	Filtering allowed file types	Files imported or exported via gateways or CDSs are filtered for allowed file types.
ISM-0651	Blocking malicious and uninspectable files	Files identified by content filtering checks as malicious, or that cannot be inspected, are blocked.
ISM-0652	Quarantining suspicious files	Files identified by content filtering checks as suspicious are quarantined until reviewed and subsequently approved or n...
ISM-0659	Content filtering checks on transferred files	Files imported or exported via gateways or CDSs undergo content filtering checks.
ISM-0670	Cross Domain Solution event logging	Security-relevant events for CDSs are centrally logged.
ISM-0677	Validating file signatures and checksums	Files imported or exported via gateways or CDSs that have a digital signature or cryptographic checksum are validated.
ISM-0958	Approved domain or category lists for web traffic	An organisation-approved list of domain names, or list of website categories, is implemented for all Hypertext Transfer...
ISM-0961	Restricting client-side active content	Client-side active content is restricted by web content filters to an organisation-approved list of domain names.
ISM-0963	Filtering harmful web content	Web content filtering is implemented to filter potentially harmful web-based content.
ISM-1037	Gateway testing after changes and six-monthly	Gateways undergo testing following configuration changes, and at regular intervals no more than six months apart, to val...
ISM-1157	Evaluated diodes for unidirectional gateways	Evaluated diodes are used for controlling the data flow of unidirectional gateways between networks.
ISM-1158	High assurance diodes for SECRET and TOP SECRET networks	Evaluated diodes used for controlling the data flow of unidirectional gateways between SECRET or TOP SECRET networks and...
ISM-1171	Blocking website access by IP address	Attempts to access websites through their IP addresses instead of their domain names are blocked by web content filters.
ISM-1192	Transport and application layer gateway inspection	Gateways inspect and filter data flows at the transport and above network layers.
ISM-1236	Blocking malicious, dynamic and free domains	Malicious domain names, dynamic domain names and domain names that can be registered anonymously for free are blocked by...
ISM-1237	Outbound web content filtering	Web content filtering is applied to outbound web traffic where appropriate.
ISM-1284	Content validation of transferred files	Files imported or exported via gateways or CDSs undergo content validation.
ISM-1286	Content conversion of transferred files	Files imported or exported via gateways or CDSs undergo content conversion.
ISM-1287	Content sanitisation of transferred files	Files imported or exported via gateways or CDSs undergo content sanitisation.
ISM-1288	Multi-engine antivirus scanning of transferred files	Files imported or exported via gateways or CDSs undergo antivirus scanning using multiple different scanning engines.
ISM-1289	Unpacking archive files for filtering	Archive files imported or exported via gateways or CDSs are unpacked in order to undergo content filtering checks.
ISM-1290	Controlled unpacking of archive files	Archive files are unpacked in a controlled manner to ensure content filter performance or availability is not adversely...
ISM-1293	Decrypting encrypted files for filtering	Encrypted files imported or exported via gateways or CDSs are decrypted in order to undergo content filtering checks.
ISM-1389	Sandboxing imported executable files	Executable files imported via gateways or CDSs are automatically executed in a sandbox to detect any suspicious behaviou...
ISM-1427	Ingress filtering against IP spoofing	Gateways perform ingress traffic filtering to detect and prevent IP source address spoofing.
ISM-1457	High assurance switches between SECRET domains	Evaluated peripheral switches used for sharing peripherals between SECRET and TOP SECRET systems, or between SECRET or T...
ISM-1480	High assurance switches to lower classified systems	Evaluated peripheral switches used for sharing peripherals between SECRET or TOP SECRET systems and any non-SECRET or TO...
ISM-1520	Screening of gateway administrators	System administrators for gateways undergo appropriate employment screening, and where necessary hold an appropriate sec...
ISM-1521	Protocol breaks in CDSs	CDSs implement protocol breaks at each network layer.
ISM-1522	Independent upward and downward paths	CDSs implement independent security-enforcing functions for upward and downward network paths.
ISM-1523	Quarterly CDS event sampling	A sample of security-relevant events relating to data transfer policies are taken at least every three months and assess...
ISM-1524	Security testing of CDS content filters	Content filters used by CDSs undergo rigorous security testing to ensure they perform as expected and cannot be bypassed...
ISM-1528	Evaluated firewalls at public network boundaries	Evaluated firewalls are used between an organisation's networks and public network infrastructure.
ISM-1773	Nationality of AGAO gateway administrators	System administrators for gateways that connect to Australian Government Access Only networks are Australian nationals o...
ISM-1774	Isolated gateway management path	Gateways are managed via a secure path isolated from all connected networks.
ISM-1783	ROA signing of public IP addresses	Public IP addresses controlled by, or used by, an organisation are signed by valid ROA records.
ISM-1862	Protecting WAF origin servers	If using a WAF, disclosing the IP addresses of web servers under an organisation's control (referred to as origin server...
ISM-1965	Content checking of transferred files	Files imported or exported via gateways or CDSs undergo content checking.
ISM-2018	RPKI route origin validation on BGP routers	Routes for RPKI-registered IP addresses that are advertised from invalid Autonomous Systems, or that are longer than all...
ISM-2019	ASD assessment of TOP SECRET gateways	TOP SECRET gateways undergo a security assessment by ASD assessors (or their delegates), using the latest release of the...

Guidelines for information technology equipment

35 controls

Controls in the Guidelines for information technology equipment domain of Australian Information Security Manual — 35 controls
Code	Title	Description
ISM-0293	Classifying IT equipment	IT equipment is classified based on the highest sensitivity or classification of data that it is approved for processing...
ISM-0294	Labelling IT equipment	IT equipment, with the exception of high assurance IT equipment, is labelled with protective markings reflecting its sen...
ISM-0296	Labelling high assurance IT equipment	ASD's approval is sought before applying labels to external surfaces of high assurance IT equipment.
ISM-0305	Cleared technicians for on-site maintenance	Maintenance and repairs of IT equipment is carried out on site by an appropriately cleared technician.
ISM-0306	Escorting uncleared technicians	If an appropriately cleared technician is not used to undertake maintenance or repairs of IT equipment, the technician i...
ISM-0307	Sanitisation before uncleared maintenance	If an appropriately cleared technician is not used to undertake maintenance or repairs of IT equipment, the IT equipment...
ISM-0310	Approved facilities for off-site repair	IT equipment maintained or repaired off site is done so at facilities approved for handling the sensitivity or classific...
ISM-0311	Sanitising media within IT equipment	IT equipment containing media is sanitised by removing the media from the IT equipment or by sanitising the media in sit...
ISM-0312	Returning overseas AUSTEO and AGAO equipment	IT equipment, including associated media, that is located overseas and has processed, stored or communicated AUSTEO or A...
ISM-0313	IT equipment sanitisation processes and procedures	IT equipment sanitisation processes, and supporting IT equipment sanitisation procedures, are developed, implemented and...
ISM-0315	Destroying high assurance IT equipment	High assurance IT equipment is destroyed prior to its disposal.
ISM-0316	Release of IT equipment to the public domain	Following sanitisation, destruction or declassification, a formal administrative decision is made to release IT equipmen...
ISM-0317	Printing random text on cartridges and drums	At least three pages of random text with no blank areas are printed on each colour printer cartridge or MFD print drum.
ISM-0318	Destroying unsanitisable cartridges and drums	When unable to sanitise printer cartridges or MFD print drums, they are destroyed as per electrostatic memory devices.
ISM-0321	Disposing of emanation security equipment	When disposing of IT equipment that has been designed or modified to meet emanation security standards, ASD is contacted...
ISM-0336	Networked IT equipment register	A networked IT equipment register is developed, implemented, maintained and verified on a regular basis.
ISM-1076	Sanitising monitors with minor burn-in	Televisions and computer monitors with minor burn-in or image persistence are sanitised by displaying a solid white imag...
ISM-1079	Approval for high assurance maintenance	ASD's approval is sought before undertaking any maintenance or repairs to high assurance IT equipment.
ISM-1217	Removing labels before disposal	Labels and markings indicating the owner, sensitivity, classification or any other marking that can associate IT equipme...
ISM-1218	Sanitising overseas AUSTEO and AGAO equipment	IT equipment, including associated media, that is located overseas and has processed, stored or communicated AUSTEO or A...
ISM-1219	Inspecting MFD drums and transfer rollers	MFD print drums and image transfer rollers are inspected and destroyed if there is remnant toner which cannot be removed...
ISM-1220	Inspecting printer and MFD platens	Printer and MFD platens are inspected and destroyed if any text or images are retained on the platen.
ISM-1221	Checking paper paths for trapped pages	Printers and MFDs are checked to ensure no pages are trapped in the paper path due to a paper jam.
ISM-1222	Destroying unsanitisable displays	Televisions and computer monitors that cannot be sanitised are destroyed.
ISM-1223	Sanitising memory in network devices	Memory in network devices is sanitised using the following processes, in order of preference: - following device-specifi...
ISM-1534	Destroying printer ribbons	Printer ribbons in printers and MFDs are removed and destroyed.
ISM-1550	IT equipment disposal processes and procedures	IT equipment disposal processes, and supporting IT equipment disposal procedures, are developed, implemented and maintai...
ISM-1551	IT equipment management policy	An IT equipment management policy is developed, implemented and maintained.
ISM-1598	Inspection after maintenance and repair	Following maintenance or repair activities for IT equipment, the IT equipment is inspected to confirm it retains its app...
ISM-1599	Handling IT equipment	IT equipment is handled in a manner suitable for its sensitivity or classification.
ISM-1741	IT equipment destruction processes and procedures	IT equipment destruction processes, and supporting IT equipment destruction procedures, are developed, implemented and m...
ISM-1742	Destroying unsanitisable IT equipment	IT equipment that cannot be sanitised is destroyed.
ISM-1858	Hardening IT equipment using ASD and vendor guidance	IT equipment is hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence w...
ISM-1869	Non-networked IT equipment register	A non-networked IT equipment register is developed, implemented, maintained and verified on a regular basis.
ISM-1913	Approved configurations for IT equipment	Approved configurations for IT equipment are developed, implemented and maintained.

Guidelines for media

54 controls

Controls in the Guidelines for media domain of Australian Information Security Manual — 54 controls
Code	Title	Description
ISM-0323	Classifying media by data held	Media is classified to the highest sensitivity or classification of data it stores, unless the media has been classified...
ISM-0325	Reclassifying media to a higher classification	Any media connected to a system with a higher sensitivity or classification than the media is reclassified to the higher...
ISM-0330	Reclassifying media to a lower classification	Before reclassifying media to a lower sensitivity or classification, the media is sanitised or destroyed, and a formal a...
ISM-0332	Labelling media with protective markings	Media, with the exception of internally mounted fixed media within information technology equipment, is labelled with pr...
ISM-0337	Using media only with authorised systems	Media is only used with systems that are authorised to process, store or communicate its sensitivity or classification.
ISM-0347	Write-once media for cross-domain transfers	When transferring data manually between two systems belonging to different security domains, write-once media is used un...
ISM-0348	Media sanitisation processes and procedures	Media sanitisation processes, and supporting media sanitisation procedures, are developed, implemented and maintained.
ISM-0350	Destroying media that cannot be sanitised	The following media types are destroyed prior to their disposal: - microfiche and microfilm - optical discs - programmab...
ISM-0351	Removing power from volatile media	Volatile media is sanitised by removing its power for at least 10 minutes.
ISM-0352	Overwriting SECRET and TOP SECRET volatile media	SECRET and TOP SECRET volatile media is sanitised by overwriting it at least once in its entirety with a random pattern...
ISM-0354	Overwriting non-volatile magnetic media	Non-volatile magnetic media is sanitised by overwriting it at least once (or three times if pre-2001 or under 15 GB) in...
ISM-0356	Classification of sanitised magnetic media	Following sanitisation, SECRET and TOP SECRET non-volatile magnetic media retains its classification.
ISM-0357	Sanitising EPROM media	Non-volatile EPROM media is sanitised by applying three times the manufacturer's specified ultraviolet erasure time and...
ISM-0358	Classification of sanitised EPROM and EEPROM	Following sanitisation, SECRET and TOP SECRET non-volatile EPROM and EEPROM media retains its classification.
ISM-0359	Overwriting flash memory media	Non-volatile flash memory media is sanitised by overwriting it at least twice in its entirety with a random pattern foll...
ISM-0360	Classification of sanitised flash media	Following sanitisation, SECRET and TOP SECRET non-volatile flash memory media retains its classification.
ISM-0361	Degausser field strength and orientation	Magnetic media is destroyed using a degausser with a suitable magnetic field strength and magnetic orientation.
ISM-0362	Following degausser manufacturer directions	Product-specific directions provided by degausser manufacturers are followed.
ISM-0363	Media destruction processes and procedures	Media destruction processes, and supporting media destruction procedures, are developed, implemented and maintained.
ISM-0368	Particle size for destroyed media	Media destroyed using a hammer mill, disintegrator, grinder/sander or by cutting results in media waste particles no lar...
ISM-0370	Cleared supervision of media destruction	The destruction of media is performed under the supervision of at least one cleared person.
ISM-0371	Supervising media to the point of destruction	Personnel supervising the destruction of media supervise its handling to the point of destruction and ensure that the de...
ISM-0372	Two-person supervision of accountable media destruction	The destruction of media storing accountable material is performed under the supervision of at least two cleared personn...
ISM-0373	Supervisor duties and destruction certificates	Personnel supervising the destruction of media storing accountable material supervise its handling to the point of destr...
ISM-0374	Media disposal process and procedures	Media disposal processes, and supporting media disposal procedures, are developed, implemented and maintained.
ISM-0375	Formal decision to release media	Following sanitisation, destruction or declassification, a formal administrative decision is made to release media, or i...
ISM-0378	Removing labels and markings before disposal	Labels and markings indicating the owner, sensitivity, classification or any other marking that can associate media with...
ISM-0831	Handling media by sensitivity or classification	Media is handled in a manner suitable for its sensitivity or classification.
ISM-0835	TOP SECRET volatile media after sanitisation	Following sanitisation, TOP SECRET volatile media retains its classification if it stored static data for an extended pe...
ISM-0836	EEPROM overwrite and verification	Non-volatile EEPROM media is sanitised by overwriting it at least once in its entirety with a random pattern followed by...
ISM-0839	Keeping accountable media destruction in-house	The destruction of media storing accountable material is not outsourced.
ISM-0840	NAID AAA certified destruction services	When outsourcing the destruction of media storing non-accountable material, a National Association for Information Destr...
ISM-0947	Sanitising media after cross-domain transfers	When transferring data manually between two systems belonging to different security domains, rewritable media is sanitis...
ISM-1059	Encrypting data on media	All data stored on media is encrypted.
ISM-1065	Resetting HPA and DCO before drive sanitisation	The host-protected area and device configuration overlay table are reset prior to the sanitisation of non-volatile magne...
ISM-1067	ATA secure erase for growth defects table	The ATA secure erase command is used, in addition to block overwriting software, to ensure the growth defects table of n...
ISM-1160	Using NSA-evaluated degaussers	If using degaussers to destroy media, degaussers evaluated by the United States' National Security Agency are used.
ISM-1359	Removable media usage policy	A removable media usage policy is developed, implemented and maintained.
ISM-1361	SCEC or ASIO-approved destruction equipment	Security Construction and Equipment Committee-approved equipment or ASIO-approved equipment is used when destroying medi...
ISM-1517	Destroying microfiche and microfilm	Equipment that is capable of reducing microform to a fine powder, with resultant particles not showing more than five co...
ISM-1549	Media management policy	A media management policy is developed, implemented and maintained.
ISM-1600	Sanitising new media before first use	Media is sanitised before it is used for the first time.
ISM-1641	Physical damage to media after degaussing	Following the use of a degausser, magnetic media is physically damaged by deforming any internal platters.
ISM-1642	Sanitising media before reuse in another domain	Media is sanitised before it is reused in a different security domain.
ISM-1713	Removable media register	A removable media register is developed, implemented, maintained and verified on a regular basis.
ISM-1722	Destroying electrostatic memory devices	Electrostatic memory devices are destroyed using a furnace/incinerator, hammer mill, disintegrator or grinder/sander.
ISM-1723	Destroying magnetic floppy disks	Magnetic floppy disks are destroyed using a furnace/incinerator, hammer mill, disintegrator, degausser or by cutting.
ISM-1724	Destroying magnetic hard disks	Magnetic hard disks are destroyed using a furnace/incinerator, hammer mill, disintegrator, grinder/sander or degausser.
ISM-1725	Destroying magnetic tapes	Magnetic tapes are destroyed using a furnace/incinerator, hammer mill, disintegrator, degausser or by cutting.
ISM-1726	Destroying optical disks	Optical disks are destroyed using a furnace/incinerator, hammer mill, disintegrator, grinder/sander or by cutting.
ISM-1727	Destroying semiconductor memory	Semiconductor memory is destroyed using a furnace/incinerator, hammer mill or disintegrator.
ISM-1728	Handling SECRET media waste particles	The resulting media waste particles from the destruction of SECRET media is stored and handled as OFFICIAL if less than...
ISM-1729	Handling TOP SECRET media waste particles	The resulting media waste particles from the destruction of TOP SECRET media is stored and handled as OFFICIAL if less t...
ISM-1735	Destroying media that fails sanitisation	Media that cannot be successfully sanitised is destroyed prior to its disposal.

Guidelines for networking

71 controls

Controls in the Guidelines for networking domain of Australian Information Security Manual — 71 controls
Code	Title	Description
ISM-0385	Functional separation between servers	Servers maintain effective functional separation with other servers allowing them to operate independently.
ISM-0516	Content of network diagrams	Network documentation includes high-level network diagrams showing all connections into networks and logical network dia...
ISM-0518	Maintaining network documentation	Network documentation is developed, implemented and maintained.
ISM-0520	Blocking unauthorised network devices	Network access controls are implemented on networks to prevent the connection of unauthorised network devices and networ...
ISM-0521	Disabling unused IPv6 on dual-stack devices	IPv6 functionality is disabled in dual-stack network devices unless it is being used.
ISM-0529	VLANs not used between security domains	VLANs are not used to separate network traffic between networks belonging to different security domains.
ISM-0530	Administering VLAN devices from trusted domain	Network devices managing VLANs are administered from the most trusted security domain.
ISM-0534	Disabling unused physical network ports	Unused physical ports on network devices are disabled.
ISM-0535	No shared trunks between security domains	Network devices managing VLANs belonging to different security domains do not share VLAN trunks.
ISM-0536	Segregating public wireless networks	Public wireless networks provided for general public use are segregated from all other organisation networks.
ISM-1006	Protecting network management traffic	Security measures are implemented to prevent unauthorised access to network management traffic.
ISM-1013	RF shielding for classified wireless	The effective range of wireless communications outside an organisation's area of control is limited by implementing RF s...
ISM-1028	NIDS or NIPS at external gateways	A NIDS or NIPS is deployed in gateways between an organisation's networks and other networks they do not manage.
ISM-1030	NIDS placement and firewall rule alerts	A NIDS or NIPS is located immediately inside the outermost firewall for gateways and configured to generate event logs a...
ISM-1178	Limiting network documentation to third parties	Network documentation provided to a third party, or published in public tender documentation, only contains details nece...
ISM-1181	Network zones by criticality	Networks are segregated into multiple network zones according to the criticality of servers, services and data.
ISM-1182	Restricting traffic between network segments	Network access controls are implemented to limit the flow of network traffic within and between network segments to only...
ISM-1186	IPv6-capable network security appliances	IPv6 capable network security appliances are used on IPv6 and dual-stack networks.
ISM-1304	Default network device credentials	Default user accounts or credentials for network devices, including for any pre-configured user accounts, are changed, d...
ISM-1311	Disabling SNMP versions 1 and 2	SNMP version 1 and SNMP version 2 are not used on networks.
ISM-1312	Default SNMP community strings	All default SNMP community strings on network devices are changed and write access is disabled.
ISM-1314	Wi-Fi Alliance certified devices	All wireless devices are Wi-Fi Alliance certified.
ISM-1315	Disabling wireless admin interface access	The administrative interface on wireless access points is disabled for wireless network connections.
ISM-1316	Changing default SSIDs	Default SSIDs of wireless access points are changed.
ISM-1317	SSIDs that do not identify the organisation	SSIDs of non-public wireless networks are not readily associated with an organisation, the location of their premises or...
ISM-1318	Keeping SSID broadcasting enabled	SSID broadcasting is not disabled on wireless access points.
ISM-1319	No static addressing on wireless networks	Static addressing is not used for assigning IP addresses on wireless networks.
ISM-1320	Not relying on MAC address filtering	MAC address filtering is not used to restrict which devices can connect to wireless networks.
ISM-1321	802.1X with EAP-TLS only	802.1X authentication with EAP-TLS, using X.509 certificates, is used for mutual authentication; with all other EAP meth...
ISM-1322	Evaluated 802.1X components	Evaluated supplicants, authenticators, wireless access points and authentication servers are used in wireless networks.
ISM-1323	Certificates for wireless devices and users	Certificates are required for devices and users accessing wireless networks.
ISM-1324	Certificate generation using evaluated CA or HSM	Certificates are generated using an evaluated certificate authority or hardware security module.
ISM-1327	Protecting wireless authentication certificates	Certificates are protected by logical and physical access controls, encryption, and user authentication.
ISM-1330	PMK caching period limit	The PMK caching period is not set to greater than 1440 minutes (24 hours).
ISM-1332	WPA3-Enterprise 192-bit mode	WPA3-Enterprise 192-bit mode is used to protect the confidentiality and integrity of all wireless network traffic.
ISM-1334	Frequency separation between wireless networks	Wireless networks implement sufficient frequency separation from other wireless networks.
ISM-1335	Protecting wireless management frames	Wireless access points enable the use of the 802.11w amendment to protect management frames.
ISM-1338	Low-power access point deployment	Instead of deploying a small number of wireless access points that broadcast on high power, a greater number of wireless...
ISM-1364	Separate interfaces for different domain VLANs	Network devices managing VLANs terminate VLANs belonging to different security domains on separate physical network inte...
ISM-1428	Disabling IPv6 tunnelling on devices	Unless explicitly required, IPv6 tunnelling is disabled on all network devices.
ISM-1429	Blocking IPv6 tunnelling at boundaries	IPv6 tunnelling is blocked by network security appliances at externally-connected network boundaries.
ISM-1430	Stateful DHCPv6 with central lease logging	Dynamically assigned IPv6 addresses are configured with Dynamic Host Configuration Protocol version 6 in a stateful mann...
ISM-1431	Discussing DoS mitigation with cloud providers	Denial-of-service attack mitigation strategies are discussed with cloud service providers, specifically: - their capacit...
ISM-1432	Registrar locking for domain names	Domain names for online services are protected via registrar locking and confirming that domain registration details are...
ISM-1436	Segregating critical online services	Critical online services are segregated from other online services that are more likely to be targeted as part of denial...
ISM-1437	Cloud-based hosting of online services	Cloud service providers are used for hosting online services.
ISM-1438	CDNs for high availability website hosting	Where a high availability requirement exists for website hosting, CDNs that cache websites are used.
ISM-1439	Protecting origin servers behind CDNs	If using CDNs, disclosing the IP addresses of web servers under an organisation's control (referred to as origin servers...
ISM-1454	Encapsulating RADIUS communications with IPsec or TLS	Communications between authenticators and a RADIUS server are encapsulated with an additional layer of encryption using...
ISM-1479	Minimising server-to-server communications	Servers minimise communications with other servers at the network and file system level.
ISM-1532	VLANs not used with public network infrastructure	VLANs are not used to separate network traffic between an organisation's networks and public network infrastructure.
ISM-1577	Segregating networks from service provider networks	An organisation's networks are segregated from their service providers' networks.
ISM-1579	Verifying CSP dynamic scaling for demand spikes	Cloud service providers' ability to dynamically scale resources in response to a genuine spike in demand is discussed an...
ISM-1580	Automatic failover between availability zones	Where a high availability requirement exists for online services, the services are architected to automatically transiti...
ISM-1581	Real-time capacity and availability monitoring	Continuous real-time monitoring of the capacity and availability of online services is performed.
ISM-1627	Blocking inbound anonymity network connections	Inbound network connections from anonymity networks are blocked.
ISM-1628	Blocking outbound anonymity network connections	Outbound network connections to anonymity networks are blocked.
ISM-1710	Hardening wireless access point settings	Settings for wireless access points are hardened.
ISM-1711	EAP-TLS user identity confidentiality	User identity confidentiality is used if available with EAP-TLS implementations.
ISM-1712	Fast BSS transition (802.11r) restrictions	The use of FT (802.11r) is disabled unless authenticator-to-authenticator communications are secured by an ASD-Approved...
ISM-1781	Encrypting all data over network infrastructure	All data communicated over network infrastructure is encrypted.
ISM-1782	Protective DNS for malicious domains	A protective DNS service is used to block access to known malicious domain names.
ISM-1800	Flashing network devices with trusted firmware	Network devices are flashed with trusted firmware before they are used for the first time.
ISM-1801	Monthly restarts of network devices	Network devices are restarted on at least a monthly basis.
ISM-1863	Management interfaces not exposed to the internet	Networked management interfaces for IT equipment are not directly exposed to the internet.
ISM-1912	Device settings in network documentation	Network documentation includes device settings for all critical servers, high-value servers, network devices and network...
ISM-1962	Disabling SMB version 1	SMB version 1 is not used on networks.
ISM-1963	Logging events from internet-facing network devices	Security-relevant events for internet-facing network devices are centrally logged.
ISM-1964	Logging events from internal network devices	Security-relevant events for non-internet-facing network devices are centrally logged.
ISM-2017	Encrypting DNS traffic where supported	DNS traffic is encrypted by clients and servers wherever supported.
ISM-2068	Limiting internet access for networked devices	Internet connectivity for networked devices is strictly limited to those that require access.

Guidelines for personnel security

53 controls

Controls in the Guidelines for personnel security domain of Australian Information Security Manual — 53 controls
Code	Title	Description
ISM-0078	Australian control of AUSTEO and AGAO systems	Systems processing, storing or communicating AUSTEO or AGAO data remain at all times under the control of an Australian...
ISM-0252	Annual cyber security awareness training content	Cyber security awareness training is undertaken annually by all personnel and covers: - the purpose of the cyber securit...
ISM-0258	Web usage policy	A web usage policy is developed, implemented and maintained.
ISM-0405	Validating unprivileged access requests	Requests for unprivileged access to systems and their resources are validated when first requested.
ISM-0407	Secure record of user access authorisations	A secure record is maintained for the life of systems and their resources that covers the following for each user: - the...
ISM-0409	Foreign national access to AUSTEO and REL systems	Foreign nationals, including seconded foreign nationals, do not have access to systems that process, store or communicat...
ISM-0411	Foreign national access to AGAO systems	Foreign nationals, excluding seconded foreign nationals, do not have access to systems that process, store or communicat...
ISM-0414	Unique identification of system users	Personnel granted access to systems and their resources are uniquely identifiable.
ISM-0415	Controlling shared user accounts	The use of shared user accounts is strictly controlled, and personnel using such accounts are uniquely identifiable.
ISM-0420	Identifying foreign nationals by nationality	Where systems process, store or communicate AUSTEO, AGAO or REL data, personnel who are foreign nationals are identified...
ISM-0430	Same-day removal of access	Access to systems and their resources are removed or suspended the same day personnel no longer have a legitimate requir...
ISM-0432	Documenting access requirements in the SSP	Access requirements for systems and their resources are documented in their system security plan.
ISM-0434	Screening and clearances before access	Personnel undergo appropriate employment screening and, where necessary, hold an appropriate security clearance before b...
ISM-0435	Briefings before system access	Personnel receive any necessary briefings before being granted access to systems and their resources.
ISM-0441	Restricting temporary access to required data	When personnel are granted temporary access to systems and their resources, effective controls are put in place to restr...
ISM-0443	No temporary access to caveated or SCI systems	Temporary access is not granted to systems that process, store or communicate caveated or sensitive compartmented inform...
ISM-0445	Dedicated privileged user accounts	Privileged users are assigned a dedicated privileged user account to be used solely for duties requiring privileged acce...
ISM-0446	Foreign national privileged access to AUSTEO and REL systems	Foreign nationals, including seconded foreign nationals, do not have privileged access to systems that process, store or...
ISM-0447	Foreign national privileged access to AGAO systems	Foreign nationals, excluding seconded foreign nationals, do not have privileged access to systems that process, store or...
ISM-0817	Reporting suspicious contact via online services	Personnel are advised of what suspicious contact via online services is and how to report it.
ISM-0820	Not posting work information online	Personnel are advised to not post work information to unauthorised online services and to report cases where such inform...
ISM-0821	Posting personal information to online services	Personnel are advised of security risks associated with posting personal information to online services and are encourag...
ISM-0824	Sending and receiving files via online services	Personnel are advised not to send or receive files via unauthorised online services.
ISM-0854	Accessing AUSTEO and AGAO data from authorised facilities	AUSTEO and AGAO data can only be accessed from systems under the sole control of the Australian Government that are loca...
ISM-1146	Separate work and personal online accounts	Personnel are advised to maintain separate work and personal user accounts for online services.
ISM-1175	Blocking internet, email and web for privileged accounts	Privileged user accounts (excluding those explicitly authorised to access online services) are prevented from accessing...
ISM-1263	Unique privileged accounts per server application	Unique privileged user accounts are used for administering individual server applications.
ISM-1404	Disabling unprivileged access after 45 days inactivity	Unprivileged access to systems and their resources are disabled after 45 days of inactivity.
ISM-1507	Validating privileged access requests	Requests for privileged access to systems and their resources are validated when first requested.
ISM-1508	Least privilege for privileged access	Privileged access to systems and their resources is limited to only what is required for users and services to undertake...
ISM-1509	Central logging of privileged access events	Privileged access events are centrally logged.
ISM-1565	Annual tailored privileged user training	Tailored privileged user training is undertaken annually by all privileged users.
ISM-1566	Central logging of unprivileged access	Use of unprivileged access is centrally logged.
ISM-1583	Identification of contractor personnel	Personnel who are contractors are identified as such.
ISM-1591	Removing access for detected malicious activity	Access to systems and their resources are removed or suspended as soon as practicable when personnel are detected undert...
ISM-1610	Documenting and testing emergency access	A method of emergency access to systems and their resources is documented and tested at least once when initially implem...
ISM-1611	Break glass use only when normal authentication fails	Break glass accounts are only used when normal authentication processes cannot be used.
ISM-1612	Break glass use for authorised activities	Break glass accounts are only used for specific authorised activities.
ISM-1613	Central logging of break glass use	Use of break glass accounts is centrally logged.
ISM-1614	Changing break glass credentials after use	Break glass account credentials are changed by the account custodian after they are accessed by any other party.
ISM-1615	Testing break glass accounts after credential changes	Break glass accounts are tested after credentials are changed.
ISM-1647	Disabling privileged access after 12 months	Privileged access to systems and their resources are disabled after 12 months unless revalidated.
ISM-1648	Disabling privileged access after 45 days inactivity	Privileged access to systems and their resources are disabled after 45 days of inactivity.
ISM-1649	Just-in-time administration of systems	Just-in-time administration is used for the administration of systems and their resources.
ISM-1650	Logging privileged account and group management	Privileged user account and security group management events are centrally logged.
ISM-1740	Business email compromise awareness for payment staff	Personnel dealing with banking details and payment requests are advised of what business email compromise is, how to man...
ISM-1852	Least privilege for unprivileged access	Unprivileged access to systems and their resources is limited to only what is required for users and services to underta...
ISM-1864	System usage policy	A system usage policy is developed, implemented and maintained.
ISM-1865	Agreement to system usage policies before access	Personnel agree to abide by system usage policies before being granted access to systems and their resources.
ISM-1883	Limiting privileged accounts authorised for online services	Privileged user accounts explicitly authorised to access online services are strictly limited to only what is required f...
ISM-2022	Cyber security awareness training register	A cyber security awareness training register is developed, implemented and maintained.
ISM-2071	Social engineering advice for account support staff	Personnel dealing with user account details are advised of what social engineering attacks are, how to manage such situa...
ISM-2074	General-purpose AI usage policy	A general-purpose artificial intelligence usage policy is developed, implemented and maintained.

Guidelines for physical security

19 controls

Controls in the Guidelines for physical security domain of Australian Information Security Manual — 19 controls
Code	Title	Description
ISM-0161	Securing IT equipment and media	IT equipment and media are secured when not in use.
ISM-0164	Preventing observation by unauthorised people	Unauthorised people are prevented from observing systems, in particular workstation displays and keyboards, within facil...
ISM-0225	Prohibiting unauthorised RF and IR devices	Unauthorised RF and IR devices are not brought into SECRET and TOP SECRET areas.
ISM-0810	Security zones for classified systems	Classified systems are secured in facilities that meet the requirements for a security zone suitable for their classific...
ISM-0813	Securing server rooms and containers	Server rooms, communications rooms and security containers are not left in unsecured states.
ISM-0829	Detecting unauthorised RF devices	Security measures are used to detect and respond to unauthorised RF devices in SECRET and TOP SECRET areas.
ISM-1053	Zoned rooms for classified infrastructure	Classified servers, network devices and cryptographic equipment are secured in server rooms or communications rooms that...
ISM-1074	Controlling keys to secure areas	Keys or equivalent access mechanisms to server rooms, communications rooms and security containers are appropriately con...
ISM-1296	Protecting network devices in public areas	Physical security is implemented to protect network devices in public areas from physical damage or unauthorised access.
ISM-1530	Security containers for classified infrastructure	Classified servers, network devices and cryptographic equipment are secured in security containers suitable for their cl...
ISM-1543	Authorised RF and IR device register	An authorised RF and IR device register for SECRET and TOP SECRET areas is developed, implemented, maintained and verifi...
ISM-1973	Securing non-classified systems	Non-classified systems are secured in suitably secure facilities.
ISM-1974	Securing non-classified server rooms	Non-classified servers, network devices and cryptographic equipment are secured in suitably secure server rooms or commu...
ISM-1975	Security containers for non-classified equipment	Non-classified servers, network devices and cryptographic equipment are secured in suitably secure security containers.
ISM-2007	Authorised medical device register	An authorised medical device register for SECRET and TOP SECRET areas is developed, implemented, maintained and verified...
ISM-2008	Criteria for authorising medical devices	Medical devices that are authorised to be brought into SECRET and TOP SECRET areas meet, at a minimum, the following cri...
ISM-2009	Prohibiting unauthorised medical devices	Unauthorised medical devices are not brought into SECRET and TOP SECRET areas.
ISM-2069	Authorised photographic and recording device register	An authorised photographic and video recording device register for SECRET and TOP SECRET areas is developed, implemented...
ISM-2070	Prohibiting unauthorised recording devices	Unauthorised photographic and video recording devices are not brought into SECRET and TOP SECRET areas.

Guidelines for procurement and outsourcing

38 controls

Controls in the Guidelines for procurement and outsourcing domain of Australian Information Security Manual — 38 controls
Code	Title	Description
ISM-0072	Documenting data security requirements in contracts	Security requirements associated with the confidentiality, integrity and availability of data are documented in contract...
ISM-0141	Incident reporting obligations for providers	The requirement for service providers to report cyber security incidents to a designated point of contact as soon as pos...
ISM-1073	Contracts before provider system access	An organisation's systems are not accessed or administered by a service provider unless a contractual arrangement exists...
ISM-1395	Provider and subcontractor data protection	Service providers, including any subcontractors, provide an appropriate level of protection for any data entrusted to th...
ISM-1451	Data types and ownership in contracts	Types of data and its ownership is documented in contractual arrangements with service providers.
ISM-1452	Supply chain risk assessment	A supply chain risk assessment is performed for suppliers of operating systems, applications, IT equipment, OT equipment...
ISM-1529	Cloud models for SECRET and TOP SECRET	Only community or private clouds are used for outsourced SECRET and TOP SECRET cloud services.
ISM-1567	Excluding high risk suppliers	Suppliers identified as high risk by a cyber supply chain risk assessment are not used.
ISM-1568	Suppliers committed to product security	Operating systems, applications, IT equipment, OT equipment and services are procured from suppliers that have demonstra...
ISM-1569	Shared responsibility model	A shared responsibility model is created, documented and shared between suppliers and their customers in order to articu...
ISM-1570	IRAP assessment of cloud providers	Outsourced cloud service providers and their non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET cloud services un...
ISM-1571	Right to verify provider compliance	The right to verify compliance with security requirements is documented in contractual arrangements with service provide...
ISM-1572	Data locations and change notification	The regions or availability zones where data will be processed, stored and communicated, as well as a minimum notificati...
ISM-1573	Access to provider logs	Access to all logs relating to an organisation's data and services is documented in contractual arrangements with servic...
ISM-1574	Portable data storage in contracts	The storage of data in a portable manner that allows for backups, service migration and service decommissioning without...
ISM-1575	Notice of service cessation	A minimum notification period of one month for the cessation of any services by a service provider is documented in cont...
ISM-1576	Notification of unauthorised provider access	If an organisation's systems are accessed or administered by a service provider in an unauthorised manner, the organisat...
ISM-1631	Identifying suppliers for systems	Suppliers of operating systems, applications, IT equipment, OT equipment and services associated with systems are identi...
ISM-1632	Suppliers with a strong security track record	Operating systems, applications, IT equipment, OT equipment and services are procured from suppliers that have a strong...
ISM-1637	Outsourced cloud service register	An outsourced cloud service register is developed, implemented, maintained and verified on a regular basis.
ISM-1638	Cloud service register contents	An outsourced cloud service register contains the following for each outsourced cloud service: - cloud service provider'...
ISM-1736	Managed service register	A managed service register is developed, implemented, maintained and verified on a regular basis.
ISM-1737	Managed service register contents	A managed service register contains the following for each managed service: - managed service provider's name - managed...
ISM-1738	Exercising the right to verify compliance	The right to verify compliance with security requirements documented in contractual arrangements with service providers...
ISM-1785	Supplier relationship management policy	A supplier relationship management policy is developed, implemented and maintained.
ISM-1786	Approved supplier list	An approved supplier list is developed, implemented and maintained.
ISM-1787	Sourcing from approved suppliers	Operating systems, applications, IT equipment, OT equipment and services are sourced from approved suppliers.
ISM-1788	Alternative suppliers for critical products	Multiple potential suppliers are identified for sourcing critical operating systems, applications, IT equipment, OT equi...
ISM-1789	Spares for critical equipment	Sufficient spares of critical IT equipment and OT equipment are sourced and kept in reserve.
ISM-1790	Maintaining integrity during delivery	Operating systems, applications, IT equipment, OT equipment and services are delivered in a manner that maintains their...
ISM-1791	Integrity checks at acceptance	The integrity of operating systems, applications, IT equipment, OT equipment and services are assessed as part of accept...
ISM-1792	Authenticity checks at acceptance	The authenticity of operating systems, applications, IT equipment, OT equipment and services are assessed as part of acc...
ISM-1793	IRAP assessment of managed service providers	Managed service providers and their non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET managed services undergo a...
ISM-1794	Notice of provider arrangement changes	A minimum notification period of one month by service providers for significant changes to their own service provider ar...
ISM-1804	Break clauses for security failures	Break clauses associated with failure to meet security requirements are documented in contractual arrangements with serv...
ISM-1882	Suppliers committed to transparency	Operating systems, applications, IT equipment, OT equipment and services are procured from suppliers that have demonstra...
ISM-1971	ASD assessment of TOP SECRET managed services	Managed service providers and their TOP SECRET managed services, including sensitive compartmented information managed s...
ISM-1972	ASD assessment of TOP SECRET cloud services	Outsourced cloud service providers and their TOP SECRET cloud services, including sensitive compartmented information cl...

Guidelines for software development

104 controls

Controls in the Guidelines for software development domain of Australian Information Security Manual — 104 controls
Code	Title	Description
ISM-0400	Segregating software environments	Development, testing, staging and production environments are segregated.
ISM-0401	Secure by Design in software development	Secure by Design principles and practices are followed throughout the software development life cycle.
ISM-0402	SAST, DAST and SCA testing	Software is comprehensively tested for vulnerabilities, using SAST, DAST and SCA prior to its initial release, any subse...
ISM-0971	Using the OWASP ASVS	The OWASP Application Security Verification Standard is used in the development of web applications.
ISM-1238	Threat modelling in the development life cycle	Threat modelling is used in support of the software development life cycle.
ISM-1239	Robust web application frameworks	Robust web application frameworks are used in the development of web applications.
ISM-1240	Validating and sanitising internet input	Validation and sanitisation are performed on all input received over the internet by software.
ISM-1241	Output encoding in web applications	Output encoding is performed on all output produced by web applications.
ISM-1275	Filtering database queries	All queries to databases from software are filtered for legitimate content and correct syntax.
ISM-1276	Parameterised queries and stored procedures	Parameterised queries or stored procedures, instead of dynamically generated queries, are used by software for database...
ISM-1278	Limiting database error information	Software is designed or configured to provide as little error information as possible about the structure of databases.
ISM-1419	Developing only in development environments	Development and modification of software only takes place in development environments.
ISM-1420	Production data in non-production environments	Data from production environments is not used in non-production environments unless the non-production environment is se...
ISM-1422	Protecting the authoritative software source	Unauthorised access to the authoritative source for software is prevented.
ISM-1424	Web security policy response headers	Content-Security-Policy, Hypertext Transfer Protocol Strict Transport Security and X-Frame-Options are specified by web...
ISM-1536	Central logging of database queries and errors	All queries to databases from software that are initiated by users, and any resulting crash or error messages, are centr...
ISM-1552	HTTPS-only web application content	All web application content is offered exclusively using HTTPS.
ISM-1616	Vulnerability disclosure program	A vulnerability disclosure program is implemented to assist with the secure development and maintenance of products and...
ISM-1717	Hosting security.txt files for website domains	A 'security.txt' file is hosted for each of an organisation's internet-facing website domains to assist in the responsib...
ISM-1730	Producing a software bill of materials	A software bill of materials is produced and made available to consumers of software.
ISM-1754	Timely resolution of software vulnerabilities	Vulnerabilities identified in software are resolved in a timely manner.
ISM-1755	Vulnerability disclosure policy	A vulnerability disclosure policy is developed, implemented and maintained.
ISM-1756	Vulnerability disclosure processes and procedures	Vulnerability disclosure processes, and supporting vulnerability disclosure procedures, are developed, implemented and m...
ISM-1780	SecDevOps practices for software development	SecDevOps practices are used for software development.
ISM-1796	Signing executable content	Files containing executable content are digitally signed by a certificate with a verifiable chain of trust as part of so...
ISM-1797	Signing installers, patches and updates	Installers, patches and updates are digitally signed or provided with cryptographic checksums as part of software develo...
ISM-1798	Secure configuration guidance for consumers	Secure configuration guidance, in the form of a hardening guide or loosening guide, is produced and made available to co...
ISM-1816	Protecting the authoritative source from modification	Unauthorised modification of the authoritative source for software is prevented.
ISM-1817	Authenticating internet-facing APIs that expose data	Authentication and authorisation of clients is performed when clients call network APIs that facilitate access to data n...
ISM-1818	Authenticating internet-facing APIs that modify data	Authentication and authorisation of clients is performed when clients call network APIs that facilitate modification of...
ISM-1849	Using the OWASP Top 10 Proactive Controls	The OWASP Top 10 Proactive Controls are used in the development of web applications.
ISM-1850	Mitigating the OWASP Top 10	The OWASP Top 10 are mitigated in the development of web applications.
ISM-1851	Mitigating the OWASP API Security Top 10	The OWASP API Security Top 10 are mitigated in the development of web APIs.
ISM-1908	Public disclosure of software vulnerabilities	Vulnerabilities identified in software are publicly disclosed in a responsible and timely manner, including with Common...
ISM-1909	Root cause analysis of vulnerabilities	In resolving vulnerabilities, root cause analysis is performed and, to the greatest extent possible, entire vulnerabilit...
ISM-1910	Central logging of internet-facing API calls	Network API calls that facilitate modification of data, or access to data not authorised for release into the public dom...
ISM-1911	Central logging of software events	Security-relevant usage, error messages and crashes for software are centrally logged.
ISM-1922	Using the OWASP MASVS	The OWASP Mobile Application Security Verification Standard is used in the development of mobile applications.
ISM-1924	Detecting and mitigating prompt injection	Generative artificial intelligence applications evaluate user prompts to detect and mitigate adversarial inputs or suffi...
ISM-2013	Authenticating internal APIs that modify data	Authentication and authorisation of clients is performed when clients call network APIs that facilitate modification of...
ISM-2014	Authenticating internal APIs that expose data	Authentication and authorisation of clients is performed when clients call network APIs that facilitate access to data n...
ISM-2015	Central logging of internal API calls	Network API calls that facilitate modification of data, or access to data not authorised for release into the public dom...
ISM-2016	Validating input received over local networks	Validation and sanitisation are performed on all input received over a local network by software.
ISM-2023	Establishing an authoritative source for software	An authoritative source for software is established and maintained.
ISM-2024	Using the authoritative source for all development	The authoritative source for software is used for all software development activities.
ISM-2025	Issue tracking for development tasks	An issue tracking solution is used to link software development tasks to security issues and decisions, change or featur...
ISM-2026	Scanning software artefacts for malicious content	All software artefacts are scanned for malicious content before being imported into the authoritative source for softwar...
ISM-2027	Verifying software artefacts before import	All software artefacts are verified by a digital signature, or a secure hash provided over a secure channel, before bein...
ISM-2028	Testing software artefacts for known weaknesses	All software artefacts are tested to detect known weaknesses using static application security testing (SAST), dynamic a...
ISM-2029	Restricting third-party libraries to trustworthy sources	The authoritative source for software restricts the use and import of third-party libraries and software components to t...
ISM-2030	Scanning commits for secrets and keys	Scanning is used during commits to identify plain text or encoded secrets and keys, which are then blocked from being st...
ISM-2031	Using security features of build tools	Compilers, interpreters and build tools (including pipelines) that provide security features to improve executable file...
ISM-2032	Completing automated testing before builds	The build solution ensures that all automated testing is completed without warnings, alerts or errors before building so...
ISM-2033	Documenting software security requirements	All software security requirements are documented, stored securely and maintained throughout the software development li...
ISM-2034	Documenting security design decisions	Security design decisions are documented and reviewed throughout the software development cycle.
ISM-2035	Security roles in the development life cycle	Security roles, responsibilities and knowledge requirements required to support the software development life cycle are...
ISM-2036	Security responsibilities of software developers	Security responsibilities for software developers are identified and documented.
ISM-2037	Secure development training for developers	Software developers that lack sufficient cyber security knowledge and skills required for their projects or tasks undert...
ISM-2038	Developer cyber security skills register	A software developer cyber security knowledge and skills register is implemented and maintained.
ISM-2039	Reviewing the software threat model	The software threat model is reviewed throughout the software development life cycle to ensure it reflects the as-built...
ISM-2040	Secure programming practices for chosen languages	Secure programming practices for the chosen programming language are used for software development.
ISM-2041	Memory-safe programming languages and practices	Memory-safe programming languages, or less preferably memory-safe programming practices, are used for software developme...
ISM-2042	Secure by Default principles	Secure by Default principles and practices are followed throughout the software development life cycle, including by ens...
ISM-2043	Readable and maintainable software architecture	Software is architected and structured to support readability and maintainability.
ISM-2044	No default credentials in software	Software has no default credentials; however, if credentials are required, they are created on first install by the inst...
ISM-2045	Backwards compatibility without weakening security	Application backwards compatibility does not compromise any security measures or features.
ISM-2046	Logging and permissions for user impersonation	Where software allows user impersonation, sensitive data is not logged and appropriate permissions are set.
ISM-2047	Notifying users of authentication factor resets	Where software allows an authentication factor to be reset, the user is notified of the reset through a secondary channe...
ISM-2048	Preventing users altering their own privileges	Where software supports multiple user roles, non-administrative users are prevented from altering their profile permissi...
ISM-2049	Re-authentication after permission or credential changes	When user permissions or credentials are changed, software forces all impacted users to re-authenticate.
ISM-2050	Validating digital signatures and revocation	When digital signatures are processed by software, they are validated against a certificate trust chain and checked for...
ISM-2051	Software event log generation	Software generates sufficient event logs to support the detection of cyber security events.
ISM-2052	Protecting sensitive data in event logs	Event logs produced by software ensure that any sensitive data is protected.
ISM-2053	Software end of life procedures	End of life procedures for software, covering how to remove the software and how to archive or destroy any user accounts...
ISM-2054	Using third-party software bills of materials	If a software bill of materials is available for imported third-party software components, it is used during software de...
ISM-2055	Using third-party build provenance	If a software build provenance is available for imported third-party software components, it is used during software dev...
ISM-2056	Producing software build provenance	A software build provenance is produced and made available to consumers of software.
ISM-2057	Documenting and testing input validation rules	All input validation rules are documented, matched in code and tested with both positive and negative unit testing or in...
ISM-2058	Validating data before deserialisation	Data sources and serialised data inputs are validated before being deserialised.
ISM-2059	Restricting and scanning file uploads	File uploads or input are restricted to specific file types, with malicious content scanning occurring prior to file acc...
ISM-2060	Code reviews for secure design and programming	Code reviews are utilised to ensure software meets Secure by Design principles and practices as well as secure programmi...
ISM-2061	Security peer reviews of critical components	Software developer-supported security-focused peer reviews are conducted on all critical and security-focused software c...
ISM-2062	Positive and negative unit and integration testing	Unit testing and integration testing, covering both positive and negative use cases, are used to ensure code quality and...
ISM-2063	Session cookie security flags	If supported, web application session cookies set the HttpOnly flag, Secure flag and the SameSite flag by default.
ISM-2064	Signed opaque bearer tokens in session cookies	Web application session cookies contain only digitally signed opaque bearer tokens.
ISM-2065	Entropy of unsigned session identifiers	Web application session cookies using opaque bearer tokens that are not digitally signed use non-sequential random ident...
ISM-2066	Server-side session management	Web application sessions are centrally managed server side.
ISM-2067	Single Logout for Single Sign On	Web applications that support Single Sign On equally support Single Logout.
ISM-2072	Non-executable AI model file formats	Artificial intelligence models are stored in a non-executable file format that does not allow arbitrary code execution.
ISM-2082	Using third-party cryptographic bills of materials	If a cryptographic bill of materials is available for imported third-party software components, it is used during softwa...
ISM-2083	Producing a cryptographic bill of materials	A cryptographic bill of materials is produced and made available to consumers of software.
ISM-2084	AI model and system cards	Artificial intelligence-specific documentation, including model and system cards (or equivalent artefacts), is used to d...
ISM-2085	Hiding exact AI model confidence scores	The exposure of exact artificial intelligence model confidence scores in API responses or user interfaces is prevented.
ISM-2086	Verifying AI model source and integrity	The source and integrity of artificial intelligence models, structures and weights are verified.
ISM-2087	Verifying AI training data source and integrity	The source and integrity of training data for artificial intelligence models is verified.
ISM-2088	Validating AI training data	Data validation and verification techniques are used to ensure the reliability and accuracy of training data used by art...
ISM-2089	Monitoring AI model performance metrics	Artificial intelligence model performance metrics are monitored and anomalies are investigated.
ISM-2090	Rate limiting AI inference queries	Rate limiting is applied to inference queries for artificial intelligence models.
ISM-2091	Resource limits for AI models	Resource limits are enforced for artificial intelligence models.
ISM-2092	Fine-grained permissions for AI applications	Access control policies are implemented to enforce fine-grained permissions for artificial intelligence applications.
ISM-2093	Role-based access for AI applications	Role-based access controls are implemented for artificial intelligence applications to restrict access to sensitive data...
ISM-2094	Content filtering for AI output	Content filtering is implemented by artificial intelligence applications to detect and block sensitive data exposure and...
ISM-2102	Periodic weakness testing of software artefacts	Existing software artefacts in the authoritative source for software are periodically tested to detect known weaknesses...
ISM-2103	Consent for training on organisational data	Organisational data generated, collected or processed by artificial intelligence applications is not used for training,...

Guidelines for system hardening

215 controls

Controls in the Guidelines for system hardening domain of Australian Information Security Manual — 215 controls
Code	Title	Description
ISM-0341	Disabling automatic execution for removable media	Automatic execution features for removable media are disabled.
ISM-0343	Blocking writes to removable media	If there is no business requirement for writing to removable media and devices, such functionality is disabled via the u...
ISM-0345	Disabling DMA-capable interfaces	External communication interfaces that allow DMA are disabled.
ISM-0380	Removing unneeded operating system functionality	Unneeded user accounts, components, services and functionality of operating systems are disabled or removed.
ISM-0382	Preventing removal of approved applications	Unprivileged users do not have the ability to uninstall or disable approved applications.
ISM-0383	Default operating system accounts and credentials	Default user accounts or credentials for operating systems, including for any pre-configured user accounts, are changed,...
ISM-0408	Logon banner for security responsibilities	Systems have a logon banner that reminds users of their security responsibilities when accessing the system and its reso...
ISM-0417	Single-factor authentication fallback	When systems cannot support multi-factor authentication, single-factor authentication using passwords is implemented ins...
ISM-0418	Keeping physical credentials apart from systems	Physical credentials are kept separate from systems they are used to authenticate to, except for when performing authent...
ISM-0421	Single-factor password length for PROTECTED systems	Passwords used for single-factor authentication on non-classified, OFFICIAL: Sensitive and PROTECTED systems are a minim...
ISM-0422	Single-factor password length for TOP SECRET systems	Passwords used for single-factor authentication on TOP SECRET systems are a minimum of 20 characters.
ISM-0428	Session lock configuration	Services are configured with a session lock that: - activates after a maximum of 15 minutes of user inactivity, a maximu...
ISM-0582	Centralised Microsoft Windows event logging	Security-relevant events for Microsoft Windows operating systems are centrally logged.
ISM-0843	Application control on workstations	Application control is implemented on workstations.
ISM-0846	Preventing bypass of application control	All users (with the exception of local administrator accounts and break glass accounts) cannot disable, bypass or be exe...
ISM-0853	Daily session termination and workstation restart	On a daily basis, outside of business hours and after an appropriate period of inactivity, user sessions are terminated...
ISM-0938	Selecting secure-by-design user application vendors	Vendors that have demonstrated a commitment to Secure by Design and Secure by Default principles and practices, includin...
ISM-0955	Application control rule types	Application control is implemented using cryptographic hash rules, publisher certificate rules or path rules.
ISM-0974	Multi-factor authentication for unprivileged users	Multi-factor authentication is used to authenticate unprivileged users of systems.
ISM-1034	HIPS or EDR on critical servers	A HIPS or EDR solution is implemented on critical servers and high-value servers.
ISM-1055	Disabling LAN Manager and NTLM	LAN Manager and NT LAN Manager authentication methods are disabled.
ISM-1173	Multi-factor authentication for privileged users	Multi-factor authentication is used to authenticate privileged users of systems.
ISM-1227	Randomly generated credentials for user accounts	Credentials set for user accounts are randomly generated.
ISM-1235	Restricting add-ons, extensions and plug-ins	Add-ons, extensions and plug-ins for office productivity suites, web browsers, email clients, PDF applications and secur...
ISM-1245	Removing server application installation files	All temporary installation files and logs created during server application installation processes are removed after ser...
ISM-1246	Hardening server applications	Server applications are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking prec...
ISM-1247	Removing unneeded server application functionality	Unneeded user accounts, components, services and functionality of server applications are disabled or removed.
ISM-1249	Running server applications with minimum privileges	Server applications are configured to run as a separate user account with the minimum privileges needed to perform their...
ISM-1250	Limiting server application file system access	The user accounts under which server applications run have limited access to their underlying server's file system.
ISM-1260	Default server application accounts and credentials	Default user accounts or credentials for server applications, including for any pre-configured user accounts, are change...
ISM-1341	HIPS or EDR on workstations	A HIPS or EDR solution is implemented on workstations.
ISM-1392	Protecting folders used in path rules	When implementing application control using path rules, only approved users can modify approved files and write to appro...
ISM-1401	Acceptable multi-factor authentication factors	Multi-factor authentication uses either: something users have and something users know, or something users have that is...
ISM-1402	Protecting stored credentials	Credentials stored on systems are protected by a password manager; a hardware security module; or by salting, hashing an...
ISM-1403	Account lockout after failed logons	User accounts, except for break glass accounts, are locked out after a maximum of five failed logon attempts.
ISM-1406	Standard Operating Environments	SOEs are used for workstations and servers.
ISM-1407	Operating system release currency	The latest release, or the previous release, of operating systems are used.
ISM-1408	Using 64-bit operating systems	Where supported, 64-bit versions of operating systems are used.
ISM-1409	Hardening operating systems	Operating systems are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking preced...
ISM-1412	Hardening web browsers	Web browsers are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence...
ISM-1416	Host-based software firewall	A software firewall is implemented on workstations and servers to restrict inbound and outbound network connections to a...
ISM-1417	Antivirus application configuration	An antivirus application is implemented on workstations and servers with: - signature-based detection functionality enab...
ISM-1418	Blocking reads from removable media	If there is no business requirement for reading from removable media and devices, such functionality is disabled via the...
ISM-1460	Secure-by-design vendors for isolation mechanisms	When using a software-based isolation mechanism to share a physical server's hardware, the isolation mechanism is from a...
ISM-1461	Shared hardware for SECRET and TOP SECRET environments	When using a software-based isolation mechanism to share a physical server's hardware for SECRET or TOP SECRET computing...
ISM-1467	User application release currency	The latest release of office productivity suites, web browsers and their extensions, email clients, PDF applications, an...
ISM-1470	Removing unneeded user application functionality	Unneeded components, services and functionality of office productivity suites, web browsers, email clients, PDF applicat...
ISM-1471	Publisher and product names in certificate rules	When implementing application control using publisher certificate rules, publisher names and product names are used.
ISM-1483	Internet-facing server application release currency	The latest release of internet-facing server applications are used.
ISM-1485	Blocking web advertisements in browsers	Web browsers do not process web advertisements from the internet.
ISM-1486	Blocking Java in web browsers	Web browsers do not process Java from the internet.
ISM-1487	Write access to Trusted Locations	Only privileged users responsible for checking that Microsoft Office macros are free of malicious code can write to and...
ISM-1488	Blocking macros from the internet	Microsoft Office macros in files originating from the internet are blocked.
ISM-1489	Locking Microsoft Office macro security settings	Microsoft Office macro security settings cannot be changed by users.
ISM-1490	Application control on internet-facing servers	Application control is implemented on internet-facing servers.
ISM-1491	Blocking script execution engines for unprivileged users	Unprivileged users are prevented from running script execution engines, including: - Windows Script Host (cscript.exe an...
ISM-1492	Operating system exploit protection	Operating system exploit protection functionality is enabled.
ISM-1504	Multi-factor authentication for online services	Multi-factor authentication is used to authenticate users to their organisation's online services that process, store or...
ISM-1505	Multi-factor authentication for data repositories	Multi-factor authentication is used to authenticate users of data repositories.
ISM-1542	Blocking Object Linking and Embedding packages	Microsoft Office is configured to prevent activation of Object Linking and Embedding packages.
ISM-1544	Microsoft recommended application blocklist	Microsoft's recommended application blocklist is implemented.
ISM-1546	Authenticating users before access	Users are authenticated before they are granted access to a system and its resources.
ISM-1557	Single-factor password length for SECRET systems	Passwords used for single-factor authentication on SECRET systems are a minimum of 17 characters.
ISM-1558	Constructing word-sequence passphrases	Passwords using a sequence of words for single-factor authentication are not constructed using: - a list of categorised...
ISM-1559	MFA password length for PROTECTED systems	Passwords used for multi-factor authentication on non-classified, OFFICIAL: Sensitive and PROTECTED systems are a minimu...
ISM-1560	MFA password length for SECRET systems	Passwords used for multi-factor authentication on SECRET systems are a minimum of 8 characters.
ISM-1561	MFA password length for TOP SECRET systems	Passwords used for multi-factor authentication on TOP SECRET systems are a minimum of 10 characters.
ISM-1582	Annual validation of application control rulesets	Application control rulesets are validated on an annual or more frequent basis.
ISM-1584	Preventing users bypassing operating system security	Unprivileged users are prevented from bypassing, disabling or modifying security functionality of operating systems.
ISM-1585	Locking web browser security settings	Web browser security settings cannot be changed by users.
ISM-1588	Annual review of Standard Operating Environments	SOEs are reviewed and updated at least annually.
ISM-1590	Changing compromised or exposed user credentials	Credentials for user accounts are changed if: - they are compromised - they are suspected of being compromised - they ar...
ISM-1592	Blocking user installation of unapproved applications	Unprivileged users do not have the ability to install unapproved applications.
ISM-1593	Identity verification before issuing credentials	Users provide sufficient evidence to verify their identity when requesting new credentials.
ISM-1594	Secure delivery of new credentials	Credentials are provided to users via a secure communications channel or, if not possible, split into two parts with one...
ISM-1595	Changing credentials on first use	Credentials provided to users are changed on first use.
ISM-1596	No credential reuse across systems	Credentials are not reused by users across different systems.
ISM-1597	Obscuring credentials during entry	Credentials are obscured as they are entered into systems.
ISM-1601	Microsoft attack surface reduction rules	Microsoft's attack surface reduction rules are implemented.
ISM-1603	Disabling replay-susceptible authentication methods	Authentication methods susceptible to replay attacks are disabled.
ISM-1604	Hardening software-based isolation mechanisms	When using a software-based isolation mechanism to share a physical server's hardware, the configuration of the isolatio...
ISM-1605	Hardening the isolation host operating system	When using a software-based isolation mechanism to share a physical server's hardware, the underlying operating system i...
ISM-1606	Patching isolation mechanisms and host operating systems	When using a software-based isolation mechanism to share a physical server's hardware, patches, updates or vendor mitiga...
ISM-1607	Monitoring and logging isolation mechanisms	When using a software-based isolation mechanism to share a physical server's hardware, integrity monitoring and centrali...
ISM-1608	Scanning third-party SOEs before use	SOEs provided by third parties are scanned for malicious code and configurations.
ISM-1619	Group Managed Service Accounts for service accounts	Service accounts are created as group Managed Service Accounts.
ISM-1620	Protected Users group for privileged accounts	Privileged user accounts are members of the Protected Users security group.
ISM-1621	Disabling Windows PowerShell 2.0	Windows PowerShell 2.0 is disabled or removed.
ISM-1622	PowerShell Constrained Language Mode	PowerShell is configured to use Constrained Language Mode.
ISM-1623	Central logging of PowerShell events	PowerShell module logging, script block logging and transcription events are centrally logged.
ISM-1624	Protected Event Logging for script block logs	PowerShell script block logs are protected by Protected Event Logging functionality.
ISM-1654	Disabling Internet Explorer 11	Internet Explorer 11 is disabled or removed.
ISM-1655	Disabling .NET Framework 3.5	.NET Framework 3.5 (includes .NET 2.0 and 3.0) is disabled or removed.
ISM-1656	Application control on internal servers	Application control is implemented on non-internet-facing servers.
ISM-1657	Application control scope of file types	Application control restricts the execution of executables, libraries, scripts, installers, compiled HTML, HTML applicat...
ISM-1658	Application control for drivers	Application control restricts the execution of drivers to an organisation-approved set.
ISM-1659	Microsoft vulnerable driver blocklist	Microsoft's vulnerable driver blocklist is implemented.
ISM-1660	Central logging of application control events	Allowed and blocked application control events are centrally logged.
ISM-1667	Blocking Office child process creation	Microsoft Office is blocked from creating child processes.
ISM-1668	Blocking Office creating executable content	Microsoft Office is blocked from creating executable content.
ISM-1669	Blocking Office code injection	Microsoft Office is blocked from injecting code into other processes.
ISM-1670	Blocking PDF application child processes	PDF applications are blocked from creating child processes.
ISM-1671	Disabling Microsoft Office macros by default	Microsoft Office macros are disabled for users that do not have a demonstrated business requirement.
ISM-1672	Antivirus scanning of Office macros	Microsoft Office macro antivirus scanning is enabled.
ISM-1673	Blocking Win32 API calls from macros	Microsoft Office macros are blocked from making Win32 API calls.
ISM-1674	Restricting which Office macros can run	Only Microsoft Office macros running from within a sandboxed environment, a Trusted Location or that are digitally signe...
ISM-1675	Blocking user enablement of untrusted macros	Microsoft Office macros digitally signed by an untrusted publisher cannot be enabled via the Message Bar or Backstage Vi...
ISM-1676	Annual validation of trusted macro publishers	Microsoft Office's list of trusted publishers is validated on an annual or more frequent basis.
ISM-1679	Multi-factor authentication for sensitive online services	Multi-factor authentication is used to authenticate users to third-party online services that process, store or communic...
ISM-1680	Multi-factor authentication for other online services	Multi-factor authentication (where available) is used to authenticate users to third-party online services that process,...
ISM-1681	Multi-factor authentication for customer services	Multi-factor authentication is used to authenticate customers to online customer services that process, store or communi...
ISM-1682	Phishing-resistant multi-factor authentication	Multi-factor authentication used for authenticating users of systems is phishing-resistant.
ISM-1683	Central logging of multi-factor authentication events	Successful and unsuccessful multi-factor authentication events are centrally logged.
ISM-1685	Managing break glass and service account credentials	Credentials for break glass accounts, local administrator accounts and service accounts are long, unique, unpredictable...
ISM-1686	Enabling Credential Guard	Credential Guard functionality is enabled.
ISM-1743	Operating system vendor selection	Vendors that have demonstrated a commitment to Secure by Design and Secure by Default principles and practices, includin...
ISM-1745	Secure boot and measured boot functionality	Early Launch Antimalware, Secure Boot, Trusted Boot and Measured Boot functionality is enabled.
ISM-1746	Protecting paths used by application control rules	When implementing application control using path rules, only approved users can change file system permissions for appro...
ISM-1748	Locking email client security settings	Email client security settings cannot be changed by users.
ISM-1749	Limiting cached logon credentials	Cached credentials are limited to one previous logon.
ISM-1795	Minimum length for privileged local credentials	Credentials for built-in Administrator accounts, break glass accounts, local administrator accounts and service accounts...
ISM-1806	Changing default user application accounts	Default user accounts or credentials for user applications, including for any pre-configured user accounts, are changed,...
ISM-1823	Locking Office productivity suite security settings	Office productivity suite security settings cannot be changed by users.
ISM-1824	Locking PDF application security settings	PDF application security settings cannot be changed by users.
ISM-1825	Locking security product settings	Security product security settings cannot be changed by users.
ISM-1826	Server application vendor selection	Vendors that have demonstrated a commitment to Secure by Design and Secure by Default principles and practices, includin...
ISM-1827	Dedicated accounts for administering domain controllers	Microsoft AD DS domain controllers are administered using dedicated domain administrator user accounts that are not used...
ISM-1828	Disabling Print Spooler on domain controllers	The Print Spooler service is disabled on Microsoft AD DS domain controllers.
ISM-1829	No passwords in Group Policy Preferences	Passwords are not stored in Group Policy Preferences.
ISM-1830	Central logging of Active Directory services events	Security-relevant events for Microsoft AD DS domain controllers, Microsoft AD CS CA servers, Microsoft AD FS servers and...
ISM-1832	Service Principal Names only on service accounts	Only service accounts and computer accounts are configured with Service Principal Names (SPNs).
ISM-1833	Minimum privileges for user accounts	User accounts are provisioned with the minimum privileges required.
ISM-1834	No duplicate Service Principal Names	Duplicate SPNs do not exist within the domain.
ISM-1835	Privileged accounts marked sensitive and not delegated	Privileged user accounts are configured as sensitive and cannot be delegated.
ISM-1836	Requiring Kerberos pre-authentication	User accounts require Kerberos pre-authentication.
ISM-1838	Not using the UserPassword attribute	The UserPassword attribute for user accounts is not used.
ISM-1839	No passwords in readable account properties	Account properties accessible by unprivileged users are not used to store passwords.
ISM-1840	No reversible encryption for passwords	User account passwords do not use reversible encryption.
ISM-1841	Restricting who can add machines to domains	Unprivileged user accounts cannot add machines to the domain.
ISM-1842	Dedicated accounts for joining machines to domains	Dedicated privileged service accounts are used to add machines to the domain.
ISM-1843	Reviewing accounts with unconstrained delegation	User accounts with unconstrained delegation are reviewed at least annually, and those without an SPN or demonstrated bus...
ISM-1844	No delegation trust for non-DC computer accounts	Computer accounts that are not Microsoft AD DS domain controllers are not trusted for delegation to services.
ISM-1845	Removing group memberships from disabled accounts	When a user account is disabled, it is removed from all security group memberships.
ISM-1846	Pre-Windows 2000 Compatible Access group membership	The Pre-Windows 2000 Compatible Access security group does not contain user accounts.
ISM-1847	Changing KRBTGT account credentials	Credentials for the Kerberos Key Distribution Center's service account (KRBTGT) are changed twice, allowing for replicat...
ISM-1848	Replacing unsupported isolation mechanisms	When using a software-based isolation mechanism to share a physical server's hardware, the isolation mechanism or underl...
ISM-1859	Office productivity suite hardening	Office productivity suites are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taki...
ISM-1860	PDF application hardening	PDF applications are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precede...
ISM-1861	Local Security Authority protection	Local Security Authority protection functionality is enabled.
ISM-1870	Application control in user profiles and temporary folders	Application control is applied to user profiles and temporary folders used by operating systems, web browsers and email...
ISM-1871	Application control in all other locations	Application control is applied to all locations other than user profiles and temporary folders used by operating systems...
ISM-1872	Phishing-resistant MFA for online services	Multi-factor authentication used for authenticating users of online services is phishing-resistant.
ISM-1873	Phishing-resistant MFA option for customers	Multi-factor authentication used for authenticating customers of online customer services provides a phishing-resistant...
ISM-1874	Enforcing phishing-resistant MFA for customers	Multi-factor authentication used for authenticating customers of online customer services is phishing-resistant.
ISM-1875	Scanning networks for cleartext credentials	Networks are scanned at least monthly to identify any credentials that are being stored in the clear.
ISM-1889	Logging command line process creation	Command line process creation events are centrally logged.
ISM-1890	Checking macros before signing or trusting	Microsoft Office macros are checked to ensure they are free of malicious code before being digitally signed or placed wi...
ISM-1891	Blocking macros without V3 signatures	Microsoft Office macros digitally signed by signatures other than V3 signatures cannot be enabled via the Message Bar or...
ISM-1892	MFA for own sensitive customer services	Multi-factor authentication is used to authenticate users to their organisation's online customer services that process,...
ISM-1893	MFA for third-party customer services	Multi-factor authentication is used to authenticate users to third-party online customer services that process, store or...
ISM-1894	Phishing-resistant MFA for data repositories	Multi-factor authentication used for authenticating users of data repositories is phishing-resistant.
ISM-1895	Logging single-factor authentication events	Successful and unsuccessful single-factor authentication events are centrally logged.
ISM-1896	Memory integrity functionality	Memory integrity functionality is enabled.
ISM-1897	Remote Credential Guard	Remote Credential Guard functionality is enabled.
ISM-1914	Approved operating system configurations	Approved configurations for operating systems are developed, implemented and maintained.
ISM-1915	Approved user application configurations	Approved configurations for user applications are developed, implemented and maintained.
ISM-1916	Approved server application configurations	Approved configurations for server applications are developed, implemented and maintained.
ISM-1919	Disabling authentication protocols without MFA	When multi-factor authentication is used to authenticate users or customers to online services or online customer servic...
ISM-1920	Preventing MFA self-enrolment from untrustworthy devices	When multi-factor authentication is used to authenticate users to online services, online customer services, systems or...
ISM-1926	Dedicated roles for identity servers	Microsoft AD DS domain controllers, Microsoft AD CS CA servers, Microsoft AD FS servers and Microsoft Entra Connect serv...
ISM-1927	Limiting privileged access to identity servers	Access to Microsoft AD DS domain controllers, Microsoft AD CS CA servers, Microsoft AD FS servers and Microsoft Entra Co...
ISM-1928	Securing identity server backups	Backups of Microsoft AD DS domain controllers, Microsoft AD CS CA servers, Microsoft AD FS servers and Microsoft Entra C...
ISM-1929	LDAP signing on domain controllers	Lightweight Directory Access Protocol signing is enabled on Microsoft AD DS domain controllers.
ISM-1930	Passwords in Group Policy Preferences	Passwords are prevented from being stored in Group Policy Preferences.
ISM-1931	SID filtering for domain and forest trusts	SID Filtering is enabled for domain and forest trusts.
ISM-1932	Minimising service accounts with SPNs	The number of service accounts configured with an SPN is minimised.
ISM-1933	DCSync permissions for SPN service accounts	Service accounts configured with an SPN do not have DCSync permissions.
ISM-1934	Annual review of DCSync permissions	User accounts with DCSync permissions are reviewed at least annually, and those without an ongoing requirement for the p...
ISM-1935	Unconstrained delegation on computer accounts	Computer accounts are not configured for unconstrained delegation.
ISM-1936	Not using sIDHistory	The sIDHistory attribute for user accounts is not used.
ISM-1937	Weekly checks for sIDHistory	User accounts are checked at least weekly for the presence of the sIDHistory attribute.
ISM-1938	Domain Computers write permissions	The Domain Computers security group does not have write or modify permissions to any Microsoft Active Directory objects.
ISM-1939	Minimising highly-privileged group membership	The number of user accounts that are members of the Domain Admins, Enterprise Admins or other highly-privileged security...
ISM-1940	Service accounts in privileged groups	Service accounts are not members of the Domain Admins, Enterprise Admins or other highly-privileged security groups.
ISM-1941	Computer accounts in privileged groups	Computer accounts are not members of the Domain Admins, Enterprise Admins or other highly-privileged security groups.
ISM-1942	Domain Computers in privileged groups	The Domain Computers security group is not a member of any privileged or highly-privileged security groups.
ISM-1943	Strong certificate mapping	Strong mapping between certificates and users is enforced.
ISM-1944	Removing the EDITF_ATTRIBUTESUBJECTALTNAME2 flag	The EDITF_ATTRIBUTESUBJECTALTNAME2 flag is removed from Microsoft AD CS CA configurations.
ISM-1945	Enrollee supplied subject in templates	The CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag is removed from certificate templates.
ISM-1946	Write access to certificate templates	Unprivileged user accounts do not have write access to certificate templates.
ISM-1947	Authentication EKUs in certificate templates	Extended Key Usages that enable user authentication are removed.
ISM-1948	CA manager approval for SAN templates	CA Certificate Manager approval is required for certificate templates that allow a Subject Alternative Name to be suppli...
ISM-1949	Dedicated AD FS administration account	Microsoft AD FS servers are administered using a dedicated service account that is not used to administer other systems.
ISM-1950	Disabling soft matching after initial sync	Soft matching between Microsoft AD DS and Microsoft Entra ID is disabled following initial synchronisation activities.
ISM-1951	Hard match takeover	Hard match takeover is disabled for Microsoft Entra Connect servers.
ISM-1952	Not synchronising privileged accounts	Privileged user accounts are not synchronised between Microsoft AD DS and Microsoft Entra ID.
ISM-1953	Built-in Administrator account credentials	Credentials for the built-in Administrator account in each domain are long, unique, unpredictable and managed.
ISM-1954	Randomly generated privileged account credentials	Credentials for built-in Administrator accounts, break glass accounts, local administrator accounts and service accounts...
ISM-1955	Changing computer account credentials	Credentials for computer accounts are changed if they are compromised, they are suspected of being compromised or they h...
ISM-1956	Changing AD FS certificates	Microsoft AD FS token-signing and encryption certificates are changed twice in quick succession if they are compromised,...
ISM-1957	HSM protection of CA private keys	Private keys for Microsoft AD CS CA servers are protected by a hardware security module.
ISM-1976	Logging events for macOS	Security-relevant events for Apple macOS operating systems are centrally logged.
ISM-1977	Logging events for Linux	Security-relevant events for Linux operating systems are centrally logged.
ISM-1978	Logging internet-facing server applications	Security-relevant events for server applications on internet-facing servers are centrally logged.
ISM-1979	Logging internal server applications	Security-relevant events for server applications on non-internet-facing servers are centrally logged.
ISM-1980	Credential hint functionality	Credential hint functionality is not used for systems.
ISM-2010	AES for SPN service accounts	Service accounts configured with an SPN use the Advanced Encryption Standard for encryption.
ISM-2011	Disabling weaker MFA options	When phishing-resistant multi-factor authentication is used by user accounts, other non-phishing-resistant multi-factor...
ISM-2012	Screen lock configuration	Systems are configured with a screen lock that: - activates after a maximum of 15 minutes of user inactivity, or when ma...
ISM-2076	Security questions for authentication	Security questions are not used for authentication purposes.
ISM-2077	Email for out-of-band authentication	Email is not used for out-of-band authentication purposes.
ISM-2078	Blocking common and compromised passwords	Passwords appearing in lists of commonly used passwords or lists of compromised passwords are not used.
ISM-2079	Maximum password length	Maximum length limits for passwords are not less than 64 characters.
ISM-2080	Password complexity requirements	Password complexity requirements are not imposed for passwords.
ISM-2081	Characters supported in passwords	All ASCII printable characters are supported for passwords.

Guidelines for system management

68 controls

Controls in the Guidelines for system management domain of Australian Information Security Manual — 68 controls
Code	Title	Description
ISM-0042	System administration processes and procedures	System administration processes, and supporting system administration procedures, are developed, implemented and maintai...
ISM-0298	Centralised and managed patching	A centralised and managed approach that maintains the integrity of patches or updates, and confirms that they have been...
ISM-0300	Patching high assurance IT equipment	Patches, updates or other vendor mitigations for vulnerabilities in high assurance IT equipment are applied only when ap...
ISM-0304	Removing unsupported applications	Applications other than office productivity suites, web browsers and their extensions, email clients, PDF applications,...
ISM-1143	Patch management processes and procedures	Patch management processes, and supporting patch management procedures, are developed, implemented and maintained.
ISM-1211	Administration under change and configuration management	System administrators perform system administration activities in accordance with the system's change and configuration...
ISM-1380	Separate privileged operating environments	Privileged users use separate privileged and unprivileged operating environments.
ISM-1385	Segregation of administrative infrastructure	Administrative infrastructure is segregated from the wider network and the internet.
ISM-1386	Management traffic sourced from administrative infrastructure	Network management traffic can only originate from administrative infrastructure.
ISM-1387	Administration through jump servers	Administrative activities are conducted through jump servers.
ISM-1493	Maintaining software registers	Software registers for workstations, servers, network devices and networked IT equipment are developed, implemented, mai...
ISM-1501	Replacing unsupported operating systems	Operating systems that are no longer supported by vendors are replaced.
ISM-1510	Digital preservation policy	A digital preservation policy is developed, implemented and maintained.
ISM-1511	Backups aligned to business criticality	Backups of data, applications and settings are performed and retained in accordance with business criticality and busine...
ISM-1515	Testing restoration to a common point	Restoration of data, applications and settings from backups to a common point in time is tested as part of disaster reco...
ISM-1547	Data backup processes and procedures	Data backup processes, and supporting data backup procedures, are developed, implemented and maintained.
ISM-1548	Data restoration processes and procedures	Data restoration processes, and supporting data restoration procedures, are developed, implemented and maintained.
ISM-1643	Versions and patch histories in software registers	Software registers contain versions and patch histories of applications, drivers, operating systems and firmware.
ISM-1687	Privileged environments not virtualised within unprivileged ones	Privileged operating environments are not virtualised within unprivileged operating environments.
ISM-1688	Unprivileged accounts denied privileged environment logon	Unprivileged user accounts cannot logon to privileged operating environments.
ISM-1689	Privileged accounts denied unprivileged environment logon	Privileged user accounts (excluding local administrator accounts) cannot logon to unprivileged operating environments.
ISM-1690	Non-critical patches for online services within two weeks	Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of rele...
ISM-1691	Patching user-facing applications within two weeks	Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their e...
ISM-1692	Critical patches for user-facing applications within 48 hours	Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their e...
ISM-1693	Patching other applications within one month	Patches, updates or other vendor mitigations for vulnerabilities in applications other than office productivity suites,...
ISM-1694	Non-critical OS patches for internet-facing systems within two weeks	Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and int...
ISM-1695	OS patches for workstations and internal systems within one month	Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-faci...
ISM-1696	Critical OS patches for internal systems within 48 hours	Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-faci...
ISM-1697	Non-critical driver patches within one month	Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release when...
ISM-1698	Daily vulnerability scanning of online services	A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online serv...
ISM-1699	Weekly scanning of office, browser, email, PDF and security products	A vulnerability scanner is used at least weekly to identify missing patches or updates for vulnerabilities in office pro...
ISM-1700	Fortnightly scanning of other applications	A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in appli...
ISM-1701	Daily scanning of internet-facing OS	A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in operating s...
ISM-1702	Fortnightly scanning of workstation and internal system OS	A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in opera...
ISM-1703	Fortnightly scanning for driver updates	A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in drive...
ISM-1704	Removing unsupported office, browser, email, PDF and security products	Office productivity suites, web browsers and their extensions, email clients, PDF applications, Adobe Flash Player, and...
ISM-1705	Privileged access to other users' backups	Privileged user accounts (excluding backup administrator accounts) cannot access backups belonging to other user account...
ISM-1706	Privileged access to own backups	Privileged user accounts (excluding backup administrator accounts) cannot access their own backups.
ISM-1707	Privileged accounts prevented from altering backups	Privileged user accounts (excluding backup administrator accounts) are prevented from modifying and deleting backups.
ISM-1708	Backup administrators prevented from altering retained backups	Backup administrator accounts are prevented from modifying and deleting backups during their retention period.
ISM-1750	Segregating administrative infrastructure by server tier	Administrative infrastructure for critical servers, high-value servers and regular servers is segregated from each other...
ISM-1751	Non-critical OS patches for other IT equipment within one month	Patches, updates or other vendor mitigations for vulnerabilities in operating systems of IT equipment other than worksta...
ISM-1752	Fortnightly scanning of other IT equipment OS	A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in opera...
ISM-1753	Replacing unsupported internet-facing network devices	Internet-facing network devices that are no longer supported by vendors are replaced.
ISM-1807	Fortnightly automated asset discovery	An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vu...
ISM-1808	Up-to-date vulnerability database for scanning	A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities.
ISM-1809	Compensating controls for unsupported systems	When applications, operating systems, network devices or networked IT equipment that are no longer supported by vendors...
ISM-1810	Synchronised backups for a common restore point	Backups of data, applications and settings are synchronised to enable restoration to a common point in time.
ISM-1811	Secure and resilient retention of backups	Backups of data, applications and settings are retained in a secure and resilient manner.
ISM-1812	Unprivileged access to other users' backups	Unprivileged user accounts cannot access backups belonging to other user accounts.
ISM-1813	Unprivileged access to own backups	Unprivileged user accounts cannot access their own backups.
ISM-1814	Unprivileged accounts prevented from altering backups	Unprivileged user accounts are prevented from modifying and deleting backups.
ISM-1876	Critical patches for online services within 48 hours	Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within 48 hours of relea...
ISM-1877	Critical OS patches for internet-facing systems within 48 hours	Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and int...
ISM-1878	Critical OS patches for other IT equipment within 48 hours	Patches, updates or other vendor mitigations for vulnerabilities in operating systems of IT equipment other than worksta...
ISM-1879	Critical driver patches within 48 hours	Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within 48 hours of release when...
ISM-1898	Use of Secure Admin Workstations	Secure Admin Workstations are used in the performance of administrative activities.
ISM-1899	Blocking inbound connections to administrative infrastructure	Network devices that do not belong to administrative infrastructure cannot initiate connections with administrative infr...
ISM-1900	Fortnightly scanning for firmware updates	A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in firmw...
ISM-1901	Non-critical patches for user-facing applications within two weeks	Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their e...
ISM-1902	Non-critical OS patches for internal systems within one month	Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-faci...
ISM-1903	Critical firmware patches within 48 hours	Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within 48 hours of release when...
ISM-1904	Non-critical firmware patches within one month	Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within one month of release whe...
ISM-1905	Removing unsupported online services	Online services that are no longer supported by vendors are removed.
ISM-1921	Assessing compromise likelihood for exploited vulnerabilities	The likelihood of system compromise is frequently assessed when working exploits exist for unmitigated vulnerabilities.
ISM-1958	DCSync-permissioned accounts denied unprivileged logon	User accounts with DCSync permissions cannot logon to unprivileged operating environments.
ISM-1981	Replacing unsupported internal network devices	Non-internet-facing network devices that are no longer supported by vendors are replaced.
ISM-1982	Replacing unsupported networked IT equipment	Networked IT equipment that is no longer supported by vendors is replaced.

Guidelines for system monitoring

19 controls

Controls in the Guidelines for system monitoring domain of Australian Information Security Manual — 19 controls
Code	Title	Description
ISM-0109	Analysing workstation event logs	Event logs from workstations are analysed in a timely manner to detect cyber security events.
ISM-0580	Event logging policy	An event logging policy is developed, implemented and maintained.
ISM-0585	Details captured for each logged event	For each event logged, the date and time of the event, the relevant user or process, the relevant filename, the event de...
ISM-0988	Consistent time source for event logs	An accurate and consistent time source is used for event logging.
ISM-1228	Analysing cyber security events for incidents	Cyber security events are analysed in a timely manner to identify cyber security incidents.
ISM-1405	Implementing a centralised event logging facility	A centralised event logging facility is implemented.
ISM-1815	Protecting event logs from modification and deletion	Event logs are protected from unauthorised modification and deletion.
ISM-1906	Analysing internet-facing server event logs	Event logs from internet-facing servers are analysed in a timely manner to detect cyber security events.
ISM-1907	Analysing internal server event logs	Event logs from non-internet-facing servers are analysed in a timely manner to detect cyber security events.
ISM-1959	Consistent structured event log format	To the extent possible, event logs are captured and stored in a consistent and structured format.
ISM-1960	Analysing internet-facing network device event logs	Event logs from internet-facing network devices are analysed in a timely manner to detect cyber security events.
ISM-1961	Analysing internal network device event logs	Event logs from non-internet-facing network devices are analysed in a timely manner to detect cyber security events.
ISM-1983	Timely forwarding to the centralised facility	Event logs sent to a centralised event logging facility are done so as soon as possible after they occur.
ISM-1984	Encrypting event logs in transit	Event logs sent to a centralised event logging facility are encrypted in transit.
ISM-1985	Protecting event logs from unauthorised access	Event logs are protected from unauthorised access.
ISM-1986	Analysing critical server event logs	Event logs from critical servers are analysed in a timely manner to detect cyber security events.
ISM-1987	Analysing security product event logs	Event logs from security products are analysed in a timely manner to detect cyber security events.
ISM-1988	Searchable retention for 12 months	Event logs are retained in a searchable manner for at least 12 months.
ISM-1989	Retention under AFDA Express requirements	Event logs are retained as per minimum retention requirements for various classes of records as set out by the National...

Your Compliance Coverage

If you comply with Australian Information Security Manual, you already cover:

ISO 27002:2022

30%

327 controls mapped

Compare →

New Zealand Information Security Manual (NZISM)

21%

226 controls mapped

Compare →

CIS Controls v8

21%

222 controls mapped

Compare →

+ 5 more: NIST Cybersecurity Framework 2.0 (19%), ACSC Essential Eight (12%)

See all 8 mapped frameworks ↓

Maps to 8 other frameworks

1081 total controls

ISO 27002:2022

327 source controls mapped|81 target controls covered

30%

New Zealand Information Security Manual (NZISM)

226 source controls mapped|275 target controls covered

21%

CIS Controls v8

222 source controls mapped|137 target controls covered

21%

NIST Cybersecurity Framework 2.0

202 source controls mapped|103 target controls covered

19%

ACSC Essential Eight

126 source controls mapped|167 target controls covered

12%

Protective Security Policy Framework (PSPF) Release 2026

38 source controls mapped|42 target controls covered

ATO Digital Service Provider (DSP) Operational Security Framework

16 source controls mapped|9 target controls covered

Australia IRAP - Information Security Registered Assessors Program

5 source controls mapped|5 target controls covered

Compare Australian Information Security Manual with ISO 27002:2022

Coverage is not the same as your position

This page shows what Australian Information Security Manual overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.

The Compliance Position Diagnostic, $5,000 fixed, ten business days

What is Australian Information Security Manual and who does it apply to?

Australian Information Security Manual is a compliance framework from Australia with 22 domains and 1081 controls. ACSC Information Security Manual. Australian Government cybersecurity controls baseline. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does Australian Information Security Manual actually require?

Australian Information Security Manual has 1081 controls organised across 22 domains. The largest domains are Guidelines for system hardening (215 controls), Guidelines for software development (104 controls), Guidelines for cryptography (73 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of Australian Information Security Manual do I already cover?

Australian Information Security Manual maps to 8 other compliance frameworks. The top mapping partners are ISO 27002:2022 (30% coverage), New Zealand Information Security Manual (NZISM) (21% coverage), CIS Controls v8 (21% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement Australian Information Security Manual?

Start your Australian Information Security Manual compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Australian Information Security Manual requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 1081 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 868 frameworks.

Get Started Free →

Free forever — no credit card required