--- catalog: uuid: 3de3ba7d-99df-47e9-bb1c-366caed7b5ac metadata: title: Information security manual published: 2026-09-03T23:10:47.63884244Z last-modified: 2026-09-03T23:10:47.63884244Z version: 2026.09.4 oscal-version: 1.1.2 links: - href: '#fe231f91-e589-461c-bf65-8dcdc5ff4941' rel: canonical - href: '#219fa690-b9c0-4e76-9333-d5136a5582d1' rel: latest-version - href: '#cdd2231b-3e35-46d0-910f-96b7c8832760' rel: predecessor-version - href: '#c8773dbd-4ada-4fa1-8d96-8b1483205ae8' rel: successor-version - href: '#493f335d-298a-4891-9a73-de2b5e6d8a89' rel: alternate roles: - id: prepared-by title: Document creator parties: - uuid: ae0012b5-2a98-4610-ba74-08928451a4c0 type: organization name: Australian Cyber Security Centre short-name: ACSC links: - href: https://www.cyber.gov.au rel: homepage email-addresses: - asd.assist@defence.gov.au addresses: - type: work addr-lines: - Australian Cyber Security Centre - General enquiries - PO Box 5076 city: Kingston state: ACT postal-code: "2604" country: AU responsible-parties: - role-id: prepared-by party-uuids: - ae0012b5-2a98-4610-ba74-08928451a4c0 groups: - title: Using the cyber security framework props: - name: sort-id value: "catalog[1].group[01]" groups: - title: Executive summary props: - name: sort-id value: "catalog[1].group[01].group[1]" groups: - title: Purpose props: - name: sort-id value: "catalog[1].group[01].group[1].group[1]" parts: - name: overview prose: "The purpose of the [Information security manual](#e7ce6e23-4bbb-45c1-a657-7e563c0837ed) (ISM) is to outline a cyber security framework that an organisation can apply, using their risk management framework, to protect their information technology (IT) and operational technology (OT) systems from cyber threats." - title: Intended audience props: - name: sort-id value: "catalog[1].group[01].group[1].group[2]" parts: - name: overview prose: "The ISM is intended for chief information security officers (CISOs), chief information officers, cyber security professionals, and IT and OT managers." - title: Authority props: - name: sort-id value: "catalog[1].group[01].group[1].group[3]" parts: - name: overview prose: |- The ISM represents the considered advice of the Australian Signals Directorate (ASD). This advice is provided in accordance with ASD’s designated functions under the [Intelligence Services Act 2001](#bf76a2ec-3cf5-4a02-839a-7b2ea11cb3fc). ASD also provides cyber security advice in the form of Australian Communications Security Instructions and other cyber security-related publications. In these cases, operating system, application and device-specific advice may take precedence over the advice in the ISM. - title: Legislation and legal considerations props: - name: sort-id value: "catalog[1].group[01].group[1].group[4]" parts: - name: overview prose: |- An organisation is not required as a matter of law to comply with the ISM, unless legislation, or a direction given under legislation or by some other lawful authority, compels them to comply. Furthermore, the ISM does not override any obligations imposed by legislation or law. Finally, if the ISM conflicts with legislation or law, the latter takes precedence. While the ISM contains examples of when legislation or laws may be relevant for an organisation, there is no comprehensive consideration of such issues. When designing, operating and decommissioning systems, an organisation is encouraged to familiarise themselves with relevant legislation, such as the [Archives Act 1983](#e0d3b5ea-6a5a-400c-8daa-8a8059816a06), [Privacy Act 1988](#6fac5a84-b86e-405f-b2b3-8c13ecee4a02), [Security of Critical Infrastructure Act 2018](#c0558477-3987-493c-99de-eeceff99847d) and [Telecommunications (Interception and Access) Act 1979](#e4c07309-9ca8-40b7-9571-4f6c032180a1). - title: Cyber security principles props: - name: sort-id value: "catalog[1].group[01].group[1].group[5]" parts: - name: overview prose: "The purpose of the cyber security principles within the ISM is to provide strategic guidance on how an organisation can protect their IT and OT systems from cyber threats. These cyber security principles are grouped into six functions: govern, identify, protect, detect, respond and recover. An organisation should be able to demonstrate that the cyber security principles are being adhered to within their organisation." - title: Cyber security guidelines props: - name: sort-id value: "catalog[1].group[01].group[1].group[6]" parts: - name: overview prose: The purpose of the cyber security guidelines within the ISM is to support the cyber security principles by providing practical guidance on how an organisation can protect their IT and OT systems from cyber threats. An organisation should consider the cyber security guidelines that are relevant to each of the systems they operate. - title: Applying a risk-based approach to cyber security props: - name: sort-id value: "catalog[1].group[01].group[2]" groups: - title: Using a risk management framework props: - name: sort-id value: "catalog[1].group[01].group[2].group[1]" parts: - name: overview prose: "The risk management framework defined by the ISM draws from National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37 Rev. 2, [Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy](#4ea4e1e9-09f5-46c2-b003-352bc862d5ed). Broadly, the risk management framework defined by the ISM has six steps: define the system, select security controls, implement security controls, assess security controls, authorise the system and monitor the system." - title: Define the system props: - name: sort-id value: "catalog[1].group[01].group[2].group[2]" parts: - name: overview prose: |- **Determine the system boundary, business criticality, and security and resilience objectives for the system based on an assessment of the impact if it were to be compromised or attacked.** When embarking upon the design of a system, the system boundary, business criticality, and security and resilience objectives for the system should be determined. This will ultimately guide activities, such as selecting and tailoring security controls, to meet those security and resilience objectives as well as determining the level of residual security risk that will be accepted before the system is authorised to operate. Following the determination of the system boundary, business criticality, and security and resilience objectives for a system, a description of the system and its characteristics should be documented in the system’s system security plan. - title: Select security controls props: - name: sort-id value: "catalog[1].group[01].group[2].group[3]" parts: - name: overview prose: |- **Select security controls for the system and tailor them to achieve desired security and resilience objectives.** Each cyber security guideline discusses security risks associated with the topics it covers. Paired with these discussions are security controls that ASD considers to provide efficient and effective mitigations based on their suitability to achieve the security and resilience objectives for a system. To assist with selecting and tailoring security controls for a system, each security control is assigned an applicability marking. For example, ‘NC’ for the protection of non-classified systems (including both government and non-government systems), ‘OS’ for the protection of OFFICIAL: Sensitive systems, ‘P’ for the protection of PROTECTED systems, ‘S’ for the protection of SECRET systems and ‘TS’ for the protection of TOP SECRET systems. While security risks and security controls are discussed in the cyber security guidelines, and act as a baseline, they should not be considered an exhaustive list for a specific system type or technology. As such, the cyber security guidelines provide an important input into an organisation’s risk identification and risk treatment activities however do not represent the full extent of such activities. While the cyber security guidelines can assist with risk identification and risk treatment activities, an organisation will still need to undertake their own risk analysis and risk evaluation activities due to the unique nature of each system, its operating environment and the organisation’s risk tolerances. Following the selection and tailoring of security controls for a system, including the identification of any inherited security controls, they should be documented along with the details of their planned implementation in the system’s system security plan annex. In addition, and as appropriate, security controls should also be documented in the system’s cyber security incident response plan, change and configuration management plan, and continuous monitoring plan. Finally, the selection of security controls for a system, as documented in the system’s system security plan annex, should be approved by the system’s authorising officer. - title: Implement security controls props: - name: sort-id value: "catalog[1].group[01].group[2].group[4]" parts: - name: overview prose: |- **Implement security controls for the system and its operating environment.** Once suitable security controls have been identified for a system, and approved by the authorising officer, they should be implemented. In doing so, the details of their actual implementation, if different from their planned implementation, should be documented in the system’s system security plan annex. - title: Assess security controls props: - name: sort-id value: "catalog[1].group[01].group[2].group[5]" parts: - name: overview prose: |- **Assess security controls for the system and its operating environment to determine if they have been implemented correctly and are operating as intended.** In conducting a security control assessment, it is important that the assessor, system owner and authorising officer first agree to the scope, type and extent of assessment activities, which may be documented in a security assessment plan, such that any risks associated with the security control assessment can be appropriately managed. Generally, the scope of the security control assessment will be determined by the type of system and the security controls implemented for the system and its operating environment. For TOP SECRET systems, including sensitive compartmented information systems, security control assessments can be undertaken by ASD assessors (or their delegates). For non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET systems, security control assessments can be undertaken by an organisation’s own assessors or Infosec Registered Assessors Program (IRAP) assessors. In all cases, assessors should hold an appropriate security clearance and have an appropriate level of experience and understanding of the type of system they are assessing. At the conclusion of a security control assessment, a security assessment report should be produced outlining the scope of the security control assessment, the system’s strengths and weaknesses, security risks associated with the operation of the system, the effectiveness of the implementation of security controls, and any recommended remediation actions. This will assist in performing any initial remediation actions as well as guiding the development of the system’s plan of action and milestones. - title: Authorise the system props: - name: sort-id value: "catalog[1].group[01].group[2].group[6]" parts: - name: overview prose: |- **Authorise the system to operate based on the acceptance of the security risks associated with its operation.** Before a system can be granted an authorisation to operate, sufficient information should be provided to the authorising officer for them to make an informed decision as to whether to accept the security risks associated with its operation or not. This information should take the form of an authorisation package that includes the system’s system security plan, cyber security incident response plan, change and configuration management plan, continuous monitoring plan, security assessment report, and plan of action and milestones. In some cases, the security risks associated with a system’s operation will be acceptable and it will be granted an ongoing authorisation to operate. However, in other cases the security risks associated with the operation of a system may be unacceptable. In such cases, the authorising officer may request further work be undertaken by the system owner. In the intervening time, the authorising officer may choose to grant an authorisation to operate but with constraints placed on the system’s use, such as limiting the system’s functionality or specifying an expiration date for an authorisation to operate. Finally, if the authorising officer deems the security risks to be unacceptable, regardless of any potential constraints placed on the system’s use, they may deny an authorisation to operate until such time that sufficient remediation actions, if possible, have been completed to an acceptable standard. For non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET systems, the authorising officer is an organisation’s CISO (or their delegate). For TOP SECRET systems, including sensitive compartmented information systems, the authorising officer is Director-General ASD (or their delegate). For commercial providers providing services to an organisation, the authorising officer is the CISO of the supported organisation (or their delegate). For multinational, multi-organisation and multi-stakeholder systems, a single authorising officer may be identified and assigned, via a formal agreement, to consider whether to accept the security risks associated with a system’s operation and, if so, grant a traditional authorisation to operate. Alternatively, it may be more appropriate for multiple authorising officers to consider jointly whether to accept the security risks associated with a system’s operation and, if so, grant a joint authorisation to operate. In all cases, the authorising officer should have an appropriate level of seniority and understanding of security risks they are accepting. In cases where an organisation does not have a CISO, the authorising officer could be a chief security officer, a chief information officer or other senior executive within the organisation. - title: Monitor the system props: - name: sort-id value: "catalog[1].group[01].group[2].group[7]" parts: - name: overview prose: |- **Continuously monitor the system and associated cyber threats, security risks and security controls.** Real-time monitoring of cyber threats, security risks and security controls associated with a system and its operating environment, as outlined in a continuous monitoring plan, is essential to maintaining its security posture. In doing so, specific events may necessitate additional risk management activities. Such events may include: - changes in security policies relating to the system - detection of new or emerging cyber threats to the system or its operating environment - the discovery that security controls for the system are not as effective as planned - a major cyber security incident involving the system - major architectural changes to the system. Following the implementation or modification of any security controls as a result of risk management activities, another security control assessment should be completed. In doing so, the system’s authorisation package should be updated. This in turn allows the authorising officer to make an informed decision as to whether the security risks associated with the system’s operation are still acceptable. If the security risks are no longer acceptable, the authorising officer may choose to either place constraints on the system’s use, such as introducing or amending an expiration date for an authorisation to operate or revoke an authorisation to operate altogether. - title: Further information props: - name: sort-id value: "catalog[1].group[01].group[2].group[8]" parts: - name: overview prose: |- Further information on various risk management frameworks and practices can be found in the following publications: - International Organization for Standardization (ISO) 31000:2018, [Risk management – Guidelines](#5d217b62-2aa7-4d9c-93cc-da3916279802) - International Electrotechnical Commission 31010:2019, [Risk management – Risk assessment techniques](#69c67e26-82cf-426a-8358-0e486b5a9287) - ISO/International Electrotechnical Commission 27005:2022, [Information security, cybersecurity and privacy protection – Guidance on managing information security risks](#941626b7-cfcc-4ab2-83a0-f9a91b2e453e) - NIST SP 800-30 Rev. 1, [Guide for Conducting Risk Assessments](#81401de7-184d-4535-a3f7-4de1c336630f) - NIST SP 800-37 Rev. 2, [Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy](#4ea4e1e9-09f5-46c2-b003-352bc862d5ed). Further information on [the purpose of IRAP](#84d3cbab-ab84-4981-a4f7-2bd469c8deaf) is available from ASD. - title: Cyber security principles props: - name: sort-id value: "catalog[1].group[02]" groups: - title: The cyber security principles props: - name: sort-id value: "catalog[1].group[02].group[1]" parts: - name: overview prose: |- # Purpose of the cyber security principles The purpose of the cyber security principles is to provide strategic guidance on how an organisation can protect their information technology and operational technology systems from cyber threats. These cyber security principles are grouped into six functions: - **Govern:** Develop and maintain a strong and resilient cyber security culture. - **Identify:** Identify assets and associated security risks. - **Protect:** Implement and maintain security controls to manage security risks. - **Detect:** Detect and analyse cyber security events to identify cyber security incidents. - **Respond:** Respond to cyber security incidents. - **Recover:** Resume normal business operations following cyber security incidents. # Implementing the cyber security principles Within each function, the cyber security principles are listed in a logical sequence that reflects how they should be considered for implementation. The numbers used for the cyber security principles are identifiers only and do not indicate an implementation order. When implementing the cyber security principles, each cyber security principle should be supported by administrative and technical security controls proportionate to an organisation’s size, complexity, operating environment and risk profile. These security controls should be subject to ongoing risk-based monitoring and assurance activities. Where the term ‘systems’ is used, the elements listed in brackets define the scope of that cyber security principle. Overall, the cyber security principles are interdependent and must be implemented collectively to achieve comprehensive cyber security outcomes. groups: - title: Govern cyber security principles props: - name: sort-id value: "catalog[1].group[02].group[1].group[1]" parts: - name: overview prose: 'The Govern (GOV) cyber security principles are:' controls: - id: ism-principle-gov-01 class: ISM-principle title: Executive cyber security accountability props: - name: sort-id value: "catalog[1].group[02].group[1].group[1].control[01]" - name: label value: GOV-01 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-gov-01_smt name: statement prose: The board of directors or executive committee is accountable for cyber security. - id: ism-principle-gov-08 class: ISM-principle title: Executive artificial intelligence accountability props: - name: sort-id value: "catalog[1].group[02].group[1].group[1].control[02]" - name: label value: GOV-08 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-gov-08_smt name: statement prose: "The board of directors or executive committee is accountable for ensuring that artificial intelligence is secure, controllable, human-supervised and used in an ethical and accountable manner." - id: ism-principle-gov-02 class: ISM-principle title: Cyber security leadership props: - name: sort-id value: "catalog[1].group[02].group[1].group[1].control[03]" - name: label value: GOV-02 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-gov-02_smt name: statement prose: "A chief information security officer provides leadership and oversight of cyber security activities and delivers regular and timely risk-based reporting to the board of directors or executive committee on their organisation’s cyber security posture, the effectiveness of security controls, current security risks and emerging cyber threats." - id: ism-principle-gov-04 class: ISM-principle title: Cyber security resourcing props: - name: sort-id value: "catalog[1].group[02].group[1].group[1].control[04]" - name: label value: GOV-04 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-gov-04_smt name: statement prose: "Suitable and sufficient personnel and resources are identified, acquired and maintained in support of cyber security activities." - id: ism-principle-gov-09 class: ISM-principle title: Security risk management responsibilities props: - name: sort-id value: "catalog[1].group[02].group[1].group[1].control[05]" - name: label value: GOV-09 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-gov-09_smt name: statement prose: "Security risk management responsibilities for an organisation and their suppliers, partners and customers, including any shared responsibilities, are documented and communicated to all relevant parties with accountability arrangements in place to ensure their effective implementation." - id: ism-principle-gov-03 class: ISM-principle title: Security risk management assurance props: - name: sort-id value: "catalog[1].group[02].group[1].group[1].control[06]" - name: label value: GOV-03 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-gov-03_smt name: statement prose: "Security risk management activities for an organisation and their systems (infrastructure, operating systems, applications and data) are embedded into organisational risk management frameworks and subject to ongoing monitoring and assurance activities by the board of directors or executive committee." - id: ism-principle-gov-05 class: ISM-principle title: Security risk acceptance props: - name: sort-id value: "catalog[1].group[02].group[1].group[1].control[07]" - name: label value: GOV-05 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-gov-05_smt name: statement prose: "Residual security risks for systems (infrastructure, operating systems, applications and data), including inherited and shared security risks, are accepted before they are authorised for use and continuously monitored and managed throughout their operational life." - id: ism-principle-gov-06 class: ISM-principle title: Security risk communication props: - name: sort-id value: "catalog[1].group[02].group[1].group[1].control[08]" - name: label value: GOV-06 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-gov-06_smt name: statement prose: "Residual security risks for systems (infrastructure, operating systems, applications and data), including inherited and shared security risks, are transparently and mutually communicated with stakeholders." - id: ism-principle-gov-10 class: ISM-principle title: System exposure minimisation props: - name: sort-id value: "catalog[1].group[02].group[1].group[1].control[09]" - name: label value: GOV-10 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-gov-10_smt name: statement prose: "Information about the design, configuration and operation of systems (infrastructure, operating systems, applications and data) is not publicly disclosed or shared externally unless necessary for commercial, legal, regulatory or security purposes, with any disclosure minimised, controlled and logged." - id: ism-principle-gov-11 class: ISM-principle title: Supplier cyber security assurance props: - name: sort-id value: "catalog[1].group[02].group[1].group[1].control[10]" - name: label value: GOV-11 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-gov-11_smt name: statement prose: "Systems (infrastructure, operating systems, applications and data) are delivered and supported by trustworthy suppliers whose cyber security practices are regularly independently verified or otherwise risk-assessed." - id: ism-principle-gov-12 class: ISM-principle title: Personnel suitability assurance props: - name: sort-id value: "catalog[1].group[02].group[1].group[1].control[11]" - name: label value: GOV-12 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-gov-12_smt name: statement prose: "Personnel are granted access to systems (infrastructure, operating systems, applications and data) only where their suitability and trustworthiness have been established and are subject to ongoing assurance." - id: ism-principle-gov-13 class: ISM-principle title: Cyber security and safety props: - name: sort-id value: "catalog[1].group[02].group[1].group[1].control[12]" - name: label value: GOV-13 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-gov-13_smt name: statement prose: "Security controls for systems (infrastructure, operating systems, applications and data) do not compromise human, physical or environmental safety." - id: ism-principle-gov-14 class: ISM-principle title: Legacy system management props: - name: sort-id value: "catalog[1].group[02].group[1].group[1].control[13]" - name: label value: GOV-14 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-gov-14_smt name: statement prose: "Systems (infrastructure, operating systems, applications and data) that are not capable of meeting cyber security requirements are managed using compensating security controls, along with enhanced monitoring and assurance activities, to maintain an acceptable level of residual risk until they can be decommissioned or replaced." - id: ism-principle-gov-07 class: ISM-principle title: Continuous cyber security improvement props: - name: sort-id value: "catalog[1].group[02].group[1].group[1].control[14]" - name: label value: GOV-07 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-gov-07_smt name: statement prose: "Security risk management and associated cyber security activities are continually measured and reviewed using cyber threat intelligence and assurance activities, including exercises informed by real-world cyber threats, to identify, prioritise and incorporate improvements in governance arrangements, shared responsibilities and the effectiveness of security controls." - title: Identify cyber security principles props: - name: sort-id value: "catalog[1].group[02].group[1].group[2]" parts: - name: overview prose: 'The Identify (IDE) cyber security principles are:' controls: - id: ism-principle-ide-01 class: ISM-principle title: Asset identification props: - name: sort-id value: "catalog[1].group[02].group[1].group[2].control[1]" - name: label value: IDE-01 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-ide-01_smt name: statement prose: "Systems (infrastructure, operating systems, applications, identities, credentials and data) are continually and centrally identified and documented." - id: ism-principle-ide-05 class: ISM-principle title: Asset interdependencies props: - name: sort-id value: "catalog[1].group[02].group[1].group[2].control[2]" - name: label value: IDE-05 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-ide-05_smt name: statement prose: "Interdependencies between systems (infrastructure, operating systems, applications and data) are continually and centrally identified and documented, including how the compromise of one system could affect the security or business operations of other dependent systems." - id: ism-principle-ide-02 class: ISM-principle title: Business criticality rating identification props: - name: sort-id value: "catalog[1].group[02].group[1].group[2].control[3]" - name: label value: IDE-02 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-ide-02_smt name: statement prose: "Business criticality ratings for systems (infrastructure, operating systems, applications and data) are identified and documented." - id: ism-principle-ide-03 class: ISM-principle title: Security requirement identification props: - name: sort-id value: "catalog[1].group[02].group[1].group[2].control[4]" - name: label value: IDE-03 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-ide-03_smt name: statement prose: "Security requirements for systems (infrastructure, operating systems, applications and data) are identified and documented." - id: ism-principle-ide-06 class: ISM-principle title: Resilience requirement identification props: - name: sort-id value: "catalog[1].group[02].group[1].group[2].control[5]" - name: label value: IDE-06 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-ide-06_smt name: statement prose: "Resilience requirements for systems (infrastructure, operating systems, applications and data) are identified and documented." - id: ism-principle-ide-04 class: ISM-principle title: Security risk identification props: - name: sort-id value: "catalog[1].group[02].group[1].group[2].control[6]" - name: label value: IDE-04 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-ide-04_smt name: statement prose: "Security risks for an organisation and their systems (infrastructure, operating systems, applications and data) are identified, including by using current strategic and sector-specific cyber threat intelligence and threat modelling, and are documented along with any associated risk management decisions." - title: Protect cyber security principles props: - name: sort-id value: "catalog[1].group[02].group[1].group[3]" parts: - name: overview prose: 'The Protect (PRO) cyber security principles are:' controls: - id: ism-principle-pro-01 class: ISM-principle title: Secure system lifecycle props: - name: sort-id value: "catalog[1].group[02].group[1].group[3].control[01]" - name: label value: PRO-01 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-pro-01_smt name: statement prose: "Systems (infrastructure, operating systems and applications) are planned, designed, developed, tested, deployed, maintained and decommissioned according to their business criticality ratings and security and resilience requirements using Secure by Design and Secure by Default principles and practices." - id: ism-principle-pro-16 class: ISM-principle title: Cyber supply chain security props: - name: sort-id value: "catalog[1].group[02].group[1].group[3].control[02]" - name: label value: PRO-16 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-pro-16_smt name: statement prose: "Cyber supply chains supporting systems (infrastructure, operating systems, applications and data) are secure, resilient and support effective and coordinated cyber security incident response." - id: ism-principle-pro-13 class: ISM-principle title: "Identity, credential and access management" props: - name: sort-id value: "catalog[1].group[02].group[1].group[3].control[03]" - name: label value: PRO-13 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-pro-13_smt name: statement prose: "Robust and secure identity, credential and access management is used to establish, maintain and control access to systems (infrastructure, operating systems, applications and data) and to support effective detection of identity and credential misuse." - id: ism-principle-pro-12 class: ISM-principle title: Least privilege access props: - name: sort-id value: "catalog[1].group[02].group[1].group[3].control[04]" - name: label value: PRO-12 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-pro-12_smt name: statement prose: "Users are granted the minimum access to systems (infrastructure, operating systems, applications and data) required to undertake their duties or functions." - id: ism-principle-pro-05 class: ISM-principle title: Secure administration props: - name: sort-id value: "catalog[1].group[02].group[1].group[3].control[05]" - name: label value: PRO-05 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-pro-05_smt name: statement prose: "Systems (infrastructure, operating systems, applications and data) are administered in a secure, accountable and auditable manner." - id: ism-principle-pro-04 class: ISM-principle title: Secure configuration management props: - name: sort-id value: "catalog[1].group[02].group[1].group[3].control[06]" - name: label value: PRO-04 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-pro-04_smt name: statement prose: "Systems (infrastructure, operating systems and applications) are securely configured to approved and maintained baselines, including by reducing attack surfaces and attack paths, with configurations continually monitored and consistently enforced." - id: ism-principle-pro-06 class: ISM-principle title: Vulnerability management props: - name: sort-id value: "catalog[1].group[02].group[1].group[3].control[07]" - name: label value: PRO-06 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-pro-06_smt name: statement prose: "Vulnerabilities in systems (infrastructure, operating systems, applications and data) are identified, documented, validated and prioritised for remediation or mitigation in a timely manner, with all remediation and mitigation actions verified for effectiveness." - id: ism-principle-pro-07 class: ISM-principle title: Trustworthy software props: - name: sort-id value: "catalog[1].group[02].group[1].group[3].control[08]" - name: label value: PRO-07 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-pro-07_smt name: statement prose: "Systems (operating systems and applications) only permit the execution of software that is supported, verified and authorised." - id: ism-principle-pro-08 class: ISM-principle title: Cryptographic protection props: - name: sort-id value: "catalog[1].group[02].group[1].group[3].control[09]" - name: label value: PRO-08 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-pro-08_smt name: statement prose: Data is encrypted and authenticated at rest and in transit using ASD-approved cryptography to protect its confidentiality and integrity. - id: ism-principle-pro-17 class: ISM-principle title: Cryptographic agility props: - name: sort-id value: "catalog[1].group[02].group[1].group[3].control[10]" - name: label value: PRO-17 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-pro-17_smt name: statement prose: "Systems (infrastructure, operating systems and applications) are designed, configured and managed to support timely, prioritised and orderly changes to cryptography, including post-quantum cryptography." - id: ism-principle-pro-10 class: ISM-principle title: Regular and proven backups props: - name: sort-id value: "catalog[1].group[02].group[1].group[3].control[11]" - name: label value: PRO-10 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-pro-10_smt name: statement prose: "Systems (infrastructure, operating systems, applications and data) are regularly backed up in a secure and proven manner, including through the validation of restoration capabilities." - id: ism-principle-pro-18 class: ISM-principle title: Network segmentation and segregation props: - name: sort-id value: "catalog[1].group[02].group[1].group[3].control[12]" - name: label value: PRO-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-pro-18_smt name: statement prose: "Systems (infrastructure, operating systems and applications) are segmented into network zones based on business criticality and trust levels, with only authorised, controlled and monitored inbound and outbound communication paths between network zones permitted." - id: ism-principle-pro-19 class: ISM-principle title: Operational technology isolation props: - name: sort-id value: "catalog[1].group[02].group[1].group[3].control[13]" - name: label value: PRO-19 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-pro-19_smt name: statement prose: "Operational technology systems (infrastructure) are logically and physically isolated from information technology systems (infrastructure) and all external infrastructure, with only authorised, controlled and monitored communication paths between systems permitted." - id: ism-principle-pro-20 class: ISM-principle title: Remote access to operational technology props: - name: sort-id value: "catalog[1].group[02].group[1].group[3].control[14]" - name: label value: PRO-20 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-pro-20_smt name: statement prose: "Access to operational technology systems (infrastructure, operating systems, applications and data) over untrusted infrastructure is authorised, controlled and monitored." - id: ism-principle-pro-09 class: ISM-principle title: Content filtering props: - name: sort-id value: "catalog[1].group[02].group[1].group[3].control[15]" - name: label value: PRO-09 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-pro-09_smt name: statement prose: Data communicated between different security domains for systems (infrastructure and applications) is controlled and subject to inspection and verification. - id: ism-principle-pro-14 class: ISM-principle title: Cyber security awareness training props: - name: sort-id value: "catalog[1].group[02].group[1].group[3].control[16]" - name: label value: PRO-14 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-pro-14_smt name: statement prose: "Personnel are provided with ongoing cyber security awareness training, including operational security considerations, tailored to their duties, access levels and current cyber threats." - id: ism-principle-pro-15 class: ISM-principle title: Physical access control props: - name: sort-id value: "catalog[1].group[02].group[1].group[3].control[17]" - name: label value: PRO-15 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-pro-15_smt name: statement prose: Physical access to facilities and systems (infrastructure and data) is restricted to authorised personnel and monitored for unusual activities. - title: Detect cyber security principles props: - name: sort-id value: "catalog[1].group[02].group[1].group[4]" parts: - name: overview prose: 'The Detect (DET) cyber security principles are:' controls: - id: ism-principle-det-01 class: ISM-principle title: Centralised event logging props: - name: sort-id value: "catalog[1].group[02].group[1].group[4].control[1]" - name: label value: DET-01 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-det-01_smt name: statement prose: "Security-relevant event logs and configuration changes for systems (infrastructure, operating systems, applications and data) are centrally collected, protected against unauthorised modification or deletion, and retained to support effective cyber security event detection and investigation." - id: ism-principle-det-04 class: ISM-principle title: Baselined high-risk access activities props: - name: sort-id value: "catalog[1].group[02].group[1].group[4].control[2]" - name: label value: DET-04 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-det-04_smt name: statement prose: "Baseline patterns of identity and credential access activities, privileged access activities, and remote access activities are established and maintained for systems (infrastructure, operating systems, applications and data) to enable the detection of anomalous or unexpected behaviour." - id: ism-principle-det-02 class: ISM-principle title: Cyber security event detection props: - name: sort-id value: "catalog[1].group[02].group[1].group[4].control[3]" - name: label value: DET-02 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-det-02_smt name: statement prose: "Anomalous or unexpected events and behaviours for systems (infrastructure, operating systems, applications and data) are analysed in a timely manner to detect cyber security events." - id: ism-principle-det-03 class: ISM-principle title: Cyber security incident identification props: - name: sort-id value: "catalog[1].group[02].group[1].group[4].control[4]" - name: label value: DET-03 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-det-03_smt name: statement prose: Cyber security events are analysed in a timely manner to identify cyber security incidents. - id: ism-principle-det-05 class: ISM-principle title: Detection capability efficacy props: - name: sort-id value: "catalog[1].group[02].group[1].group[4].control[5]" - name: label value: DET-05 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-det-05_smt name: statement prose: "Cyber security event detection capabilities are regularly evaluated for effectiveness and continuously refined, including by using current strategic and sector-specific cyber threat intelligence, to improve the detection of cyber security events." - title: Respond cyber security principles props: - name: sort-id value: "catalog[1].group[02].group[1].group[5]" parts: - name: overview prose: 'The Respond (RES) cyber security principles are:' controls: - id: ism-principle-res-01 class: ISM-principle title: Cyber security incident planning props: - name: sort-id value: "catalog[1].group[02].group[1].group[5].control[1]" - name: label value: RES-01 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-res-01_smt name: statement prose: "Cyber security incident response, business continuity and disaster recovery plans for systems (infrastructure, operating systems, applications and data) support continued business operations during cyber security incidents, and the resumption of normal business operations following cyber security incidents." - id: ism-principle-res-05 class: ISM-principle title: Cyber security incident coordination props: - name: sort-id value: "catalog[1].group[02].group[1].group[5].control[2]" - name: label value: RES-05 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-res-05_smt name: statement prose: "Cyber security incident roles and responsibilities are defined, documented and exercised to support the internal and external coordination and management of cyber security incidents, including responsibilities for declaring cyber security incidents and undertaking pre-approved response and recovery activities." - id: ism-principle-res-03 class: ISM-principle title: Cyber security incident response props: - name: sort-id value: "catalog[1].group[02].group[1].group[5].control[3]" - name: label value: RES-03 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-res-03_smt name: statement prose: "Cyber security incidents are contained, eradicated and recovered from in a timely manner." - id: ism-principle-res-02 class: ISM-principle title: Cyber security incident reporting props: - name: sort-id value: "catalog[1].group[02].group[1].group[5].control[4]" - name: label value: RES-02 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-res-02_smt name: statement prose: "Cyber security incidents, including associated response and recovery activities, are reported internally and externally to relevant bodies and stakeholders in a timely manner." - id: ism-principle-res-04 class: ISM-principle title: Cyber security incident insights props: - name: sort-id value: "catalog[1].group[02].group[1].group[5].control[5]" - name: label value: RES-04 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-res-04_smt name: statement prose: "Lessons learnt from cyber security incidents are captured, and areas for improvement are identified, prioritised and actioned in a timely manner." - title: Recover cyber security principles props: - name: sort-id value: "catalog[1].group[02].group[1].group[6]" parts: - name: overview prose: 'The Recover (REC) cyber security principles are:' controls: - id: ism-principle-rec-02 class: ISM-principle title: System recovery assurance props: - name: sort-id value: "catalog[1].group[02].group[1].group[6].control[1]" - name: label value: REC-02 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-rec-02_smt name: statement prose: "Following cyber security incidents, systems (infrastructure, operating systems, applications and data) are verified through assurance activities to ensure they are secure and capable of supporting the resumption of normal business operations." - id: ism-principle-rec-01 class: ISM-principle title: Business operations resumption props: - name: sort-id value: "catalog[1].group[02].group[1].group[6].control[2]" - name: label value: REC-01 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-principle-rec-01_smt name: statement prose: "Residual security risks for systems (infrastructure, operating systems, applications and data), including inherited and shared security risks, are accepted prior to the resumption of normal business operations following cyber security incidents." - title: Guidelines for cyber security roles props: - name: sort-id value: "catalog[1].group[03]" groups: - title: Board of directors and executive committee props: - name: sort-id value: "catalog[1].group[03].group[1]" parts: - name: overview prose: |- # Further information Further information on how the board of directors or executive committee can protect themselves from cyber threats can be found in the Australian Signals Directorate’s (ASD) [Practical cyber security tips for business leaders](#2667c626-d3e8-4ee5-9044-2ada9f133df2) publication. Further information on questions the board of directors or executive committee should be asking of their organisation can be found in ASD’s [Ten things to know about data security](#dc0469b3-3901-4d2c-8b22-7c6b6627ab97) publication. Further information on how the board of directors or executive committee can plan for major cyber security incidents can be found in ASD’s [Planning for critical vulnerabilities: What the board of directors needs to know](#86814651-26b5-43f5-807d-0040c2d71169) publication. Further information on cyber security considerations for the board of directors or executive committee during mergers, acquisitions and Machinery of Government changes can be found in ASD’s [Mergers, acquisitions and Machinery of Government changes](#fd4e2255-74ca-4b20-811c-a64a93282f57) publication. Further information on cyber security responsibilities and duties of the board of directors or executive committee can be found in the United Kingdom’s National Cyber Security Centre’s [Cyber Security Toolkit for Boards](#490f4622-8562-4333-a263-b64f660620e8). groups: - title: Embedding cyber security props: - name: sort-id value: "catalog[1].group[03].group[1].group[1]" parts: - name: overview prose: "To ensure that cyber security is embedded throughout an organisation, it is important that the board of directors or executive committee commits to defining clear roles and responsibilities for cyber security and integrating cyber security throughout all business functions within their organisation. They should also align their organisation’s cyber security strategy with their organisation’s overarching strategic direction and business strategy and seek regular briefings or reporting on the cyber security posture of their organisation and the threat environment in which it operates." controls: - id: ism-1997 class: ISM-control title: "Control: ism-1997" props: - name: sort-id value: "catalog[1].group[03].group[1].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1997_smt name: statement prose: The board of directors or executive committee defines clear roles and responsibilities for cyber security both within the board of directors or executive committee and broadly within their organisation. - id: ism-1998 class: ISM-control title: "Control: ism-1998" props: - name: sort-id value: "catalog[1].group[03].group[1].group[1].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1998_smt name: statement prose: The board of directors or executive committee ensures that cyber security is integrated throughout all business functions within their organisation. - id: ism-1999 class: ISM-control title: "Control: ism-1999" props: - name: sort-id value: "catalog[1].group[03].group[1].group[1].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1999_smt name: statement prose: The board of directors or executive committee ensures the cyber security strategy for their organisation is aligned with the overarching strategic direction and business strategy for their organisation. - id: ism-2000 class: ISM-control title: "Control: ism-2000" props: - name: sort-id value: "catalog[1].group[03].group[1].group[1].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2000_smt name: statement prose: "The board of directors or executive committee seeks regular briefings or reporting on the cyber security posture of their organisation, as well as the threat environment in which they operate, from internal and external subject matter experts." - title: Championing a positive cyber security culture props: - name: sort-id value: "catalog[1].group[03].group[1].group[2]" parts: - name: overview prose: "To provide cyber security leadership within an organisation, it is important that the board of directors or executive committee champions a positive cyber security culture, including through leading by example." controls: - id: ism-2001 class: ISM-control title: "Control: ism-2001" props: - name: sort-id value: "catalog[1].group[03].group[1].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2001_smt name: statement prose: "The board of directors or executive committee champions a positive cyber security culture within their organisation, including through leading by example." - title: Building cyber security expertise props: - name: sort-id value: "catalog[1].group[03].group[1].group[3]" parts: - name: overview prose: "To assist with embedding cyber security throughout an organisation, it is important that the board of directors or executive committee maintains a sufficient level of cyber security literacy to fulfil both their fiduciary duties and any legislative or regulatory obligations. In addition, the board of directors or executive committee should maintain awareness of key cyber security recruitment activities, retention rates for cyber security personnel, and cyber security skills and experience gaps for their organisation. Finally, the board of directors or executive committee should support the development of cyber security skills and experience for all personnel within their organisation." controls: - id: ism-2002 class: ISM-control title: "Control: ism-2002" props: - name: sort-id value: "catalog[1].group[03].group[1].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2002_smt name: statement prose: The board of directors or executive committee maintains a sufficient level of cyber security literacy to fulfil both their fiduciary duties and any legislative or regulatory obligations. - id: ism-2003 class: ISM-control title: "Control: ism-2003" props: - name: sort-id value: "catalog[1].group[03].group[1].group[3].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2003_smt name: statement prose: "The board of directors or executive committee maintains awareness of key cyber security recruitment activities, retention rates for cyber security personnel, and cyber security skills and experience gaps within their organisation." - id: ism-2004 class: ISM-control title: "Control: ism-2004" props: - name: sort-id value: "catalog[1].group[03].group[1].group[3].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2004_smt name: statement prose: The board of directors or executive committee supports the development of cyber security skills and experience for all personnel via internal and external cyber security awareness raising and training opportunities. - title: Identifying critical business assets props: - name: sort-id value: "catalog[1].group[03].group[1].group[4]" parts: - name: overview prose: "For the board of directors or executive committee to fulfil both their fiduciary duties and any legislative or regulatory obligations, it is important that they understand the business criticality of their organisation’s systems. This includes a basic understanding of what systems exist, their value, where they reside, who has access, who might seek access, how they are protected and how that protection is verified." controls: - id: ism-2005 class: ISM-control title: "Control: ism-2005" props: - name: sort-id value: "catalog[1].group[03].group[1].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2005_smt name: statement prose: "The board of directors or executive committee understands the business criticality of their organisation’s systems, including at least a basic understanding of what systems exist, their value, where they reside, who has access, who might seek access, how they are protected, and how that protection is verified." - title: Planning for major cyber security incidents props: - name: sort-id value: "catalog[1].group[03].group[1].group[5]" parts: - name: overview prose: "For the board of directors or executive committee to fulfil both their fiduciary duties and any legislative or regulatory obligations, it is important that they plan for major cyber security incidents, including by participating in exercises, and understand their duties in relation to such cyber security incidents." controls: - id: ism-2006 class: ISM-control title: "Control: ism-2006" props: - name: sort-id value: "catalog[1].group[03].group[1].group[5].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2006_smt name: statement prose: "The board of directors or executive committee plans for major cyber security incidents, including by participating in exercises, and understands their duties in relation to such cyber security incidents." - title: Chief information security officer props: - name: sort-id value: "catalog[1].group[03].group[2]" parts: - name: overview prose: |- # Context The role of the chief information security officer (CISO) is to anticipate changes in the threat and technology environment and lead proportionate and evidence-based improvements to their organisation’s cyber security capabilities. This requires a combination of technical and soft skills, such as business acumen, leadership, communications and relationship building. In support of this, a CISO should adopt a continuous approach to learning and up-skilling to maintain pace with evolving cyber security frameworks and emerging technologies. The role of the CISO within an organisation should cover both information technology (IT) and operational technology (OT). However, where appropriate and practical to do so, responsibility for OT cyber security may be delegated by the CISO. Within this section, the breadth of responsibilities for IT and OT is collectively referenced under the banner of cyber security. # Further information Further information on responding to cyber security incidents can be found in the ‘Managing cyber security incidents’ section of the [Guidelines for cyber security incidents](#fe0138db-e83b-4a23-85d3-d84e1c22816f). Further information on the development of a cyber security strategy can be found in the ‘Development and maintenance of cyber security documentation’ section of the [Guidelines for cyber security documentation](#578d0434-6b3f-46f3-aad8-c7ac75c2ebcc). Further information on cyber supply chain risk management can be found in the ‘Cyber supply chain risk management’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on the procurement of outsourced services can be found in the ‘Managed services and cloud services’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on cyber security awareness training programs can be found in the ‘Cyber security awareness training’ section of the [Guidelines for personnel security](#7d16ae67-87a7-4861-b939-e13ec279b5a2). groups: - title: Providing cyber security leadership and guidance props: - name: sort-id value: "catalog[1].group[03].group[2].group[01]" parts: - name: overview prose: "To provide cyber security leadership and guidance within an organisation (for IT and OT), it is important that the organisation appoints a CISO." controls: - id: ism-0714 class: ISM-control title: "Control: ism-0714" props: - name: sort-id value: "catalog[1].group[03].group[2].group[01].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0714_smt name: statement prose: A CISO is appointed to provide cyber security leadership and guidance for their organisation (covering IT and OT). - title: Overseeing the cyber security program props: - name: sort-id value: "catalog[1].group[03].group[2].group[02]" parts: - name: overview prose: "The CISO within an organisation is responsible for overseeing their organisation’s cyber security program and ensuring compliance with cyber security policy, standards, regulations and legislation. They are likely to work with a chief security officer, a chief information officer and other senior executives within their organisation." controls: - id: ism-1478 class: ISM-control title: "Control: ism-1478" props: - name: sort-id value: "catalog[1].group[03].group[2].group[02].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Oct-20 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1478_smt name: statement prose: "The CISO oversees their organisation’s cyber security program and ensures their organisation’s compliance with cyber security policy, standards, regulations and legislation." - id: ism-1617 class: ISM-control title: "Control: ism-1617" props: - name: sort-id value: "catalog[1].group[03].group[2].group[02].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Oct-20 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1617_smt name: statement prose: The CISO regularly reviews and updates their organisation’s cyber security program to ensure its relevance in addressing cyber threats and harnessing business and cyber security opportunities. - id: ism-1966 class: ISM-control title: "Control: ism-1966" props: - name: sort-id value: "catalog[1].group[03].group[2].group[02].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1966_smt name: statement prose: "The CISO develops, implements, maintains and regularly verifies a register of systems used by their organisation." - id: ism-0724 class: ISM-control title: "Control: ism-0724" props: - name: sort-id value: "catalog[1].group[03].group[2].group[02].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Oct-20 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0724_smt name: statement prose: The CISO implements cyber security measurement metrics and key performance indicators for their organisation. - title: Coordinating cyber security props: - name: sort-id value: "catalog[1].group[03].group[2].group[03]" parts: - name: overview prose: "The CISO is responsible for ensuring the alignment of cyber security and business objectives within their organisation. To achieve this, they should facilitate communication between cyber security and business stakeholders. This includes translating cyber security concepts and language into business concepts and language, as well as ensuring that business teams consult with cyber security teams to determine appropriate security controls when planning new business projects. Additionally, as the CISO is responsible for the development of their organisation’s cyber security program, they are best placed to advise projects on the strategic direction of cyber security within their organisation." controls: - id: ism-0725 class: ISM-control title: "Control: ism-0725" props: - name: sort-id value: "catalog[1].group[03].group[2].group[03].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0725_smt name: statement prose: "The CISO coordinates cyber security and business alignment through a cyber security steering committee or advisory board, comprising key cyber security and business executives, which meets formally and regularly." - id: ism-0726 class: ISM-control title: "Control: ism-0726" props: - name: sort-id value: "catalog[1].group[03].group[2].group[03].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Oct-20 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0726_smt name: statement prose: The CISO coordinates security risk management activities between cyber security and business teams. - title: Reporting on cyber security props: - name: sort-id value: "catalog[1].group[03].group[2].group[04]" parts: - name: overview prose: |- The CISO is responsible for reporting cyber security matters to their organisation’s board of directors or executive committee, as well as their organisation’s audit, risk and compliance committee (or equivalent). In doing so, it is important that reporting is done directly by the CISO rather than via other senior executives within their organisation. This ensures reporting remains accurate and free of any conflicts of interest. Reporting should cover: - the organisation’s security risk profile - the status of key systems and any outstanding security risks - any planned cyber security uplift activities - any recent cyber security incidents - expected returns on cyber security investments. Reporting on cyber security matters should be structured by business functions, regions or legal entities and support a consolidated view of an organisation’s security risks. It is important that the CISO can translate security risks into operational risks for their organisation, including financial and legal risks, to enable more holistic conversations about their organisation’s risks. controls: - id: ism-0718 class: ISM-control title: "Control: ism-0718" props: - name: sort-id value: "catalog[1].group[03].group[2].group[04].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0718_smt name: statement prose: The CISO regularly reports directly to their organisation’s board of directors or executive committee on cyber security matters. - id: ism-1918 class: ISM-control title: "Control: ism-1918" props: - name: sort-id value: "catalog[1].group[03].group[2].group[04].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1918_smt name: statement prose: "The CISO regularly reports directly to their organisation’s audit, risk and compliance committee (or equivalent) on cyber security matters." - title: Overseeing cyber security incident response activities props: - name: sort-id value: "catalog[1].group[03].group[2].group[05]" parts: - name: overview prose: |- To ensure the CISO can accurately report to their organisation’s board of directors or executive committee on cyber security matters, it is important they are fully aware of all cyber security incidents within their organisation. The CISO is also responsible for overseeing their organisation’s response to cyber security incidents, including how internal teams respond and communicate with each other during cyber security incidents. In the event of a major cyber security incident, the CISO should be prepared to step into a crisis management role. They should understand how to bring clarity to the situation and communicate effectively with internal and external stakeholders. controls: - id: ism-0733 class: ISM-control title: "Control: ism-0733" props: - name: sort-id value: "catalog[1].group[03].group[2].group[05].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Oct-20 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0733_smt name: statement prose: The CISO is fully aware of all cyber security incidents within their organisation. - id: ism-1618 class: ISM-control title: "Control: ism-1618" props: - name: sort-id value: "catalog[1].group[03].group[2].group[05].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Oct-20 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1618_smt name: statement prose: The CISO oversees their organisation’s response to cyber security incidents. - title: Contributing to business continuity and disaster recovery planning props: - name: sort-id value: "catalog[1].group[03].group[2].group[06]" parts: - name: overview prose: "The CISO is responsible for contributing to the development, implementation and maintenance of their organisation’s business continuity and disaster recovery plans, with the aim to improve business resilience and ensure the continued operation of critical business processes." controls: - id: ism-0734 class: ISM-control title: "Control: ism-0734" props: - name: sort-id value: "catalog[1].group[03].group[2].group[06].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0734_smt name: statement prose: "The CISO contributes to the development, implementation and maintenance of business continuity and disaster recovery plans for their organisation to ensure that business-critical services are supported appropriately in the event of a disaster." - title: Communicating a cyber security vision and strategy props: - name: sort-id value: "catalog[1].group[03].group[2].group[07]" parts: - name: overview prose: "To assist in facilitating cyber security cultural change and awareness within their organisation, across their organisation’s cyber supply chain and among their organisation’s customers, the CISO should act as a cyber security leader and regularly communicate the cyber security vision and strategy for their organisation. In doing so, a cyber security communications strategy can be helpful in achieving this outcome. As part of this, communication styles and content should be tailored to different target audiences." controls: - id: ism-0720 class: ISM-control title: "Control: ism-0720" props: - name: sort-id value: "catalog[1].group[03].group[2].group[07].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0720_smt name: statement prose: "The CISO oversees the development, implementation and maintenance of a cyber security communications strategy to assist in communicating the cyber security vision and strategy for their organisation." - title: Working with suppliers props: - name: sort-id value: "catalog[1].group[03].group[2].group[08]" parts: - name: overview prose: "The CISO is responsible for ensuring that consistent vendor management processes are applied across their organisation, from discovery through to management. As supplier relationships come with additional security risks, the CISO should assist personnel with assessing cyber supply chain risks and understanding the security impacts of entering into contracts with suppliers." controls: - id: ism-0731 class: ISM-control title: "Control: ism-0731" props: - name: sort-id value: "catalog[1].group[03].group[2].group[08].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Oct-20 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0731_smt name: statement prose: The CISO oversees cyber supply chain risk management activities for their organisation. - title: Receiving and managing a dedicated cyber security budget props: - name: sort-id value: "catalog[1].group[03].group[2].group[09]" parts: - name: overview prose: "Receiving and managing a dedicated cyber security budget will ensure the CISO has sufficient access to funding to support their cyber security program, including cyber security uplift activities and responding to cyber security incidents." controls: - id: ism-0732 class: ISM-control title: "Control: ism-0732" props: - name: sort-id value: "catalog[1].group[03].group[2].group[09].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Oct-20 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0732_smt name: statement prose: The CISO receives and manages a dedicated cyber security budget for their organisation. - title: Overseeing cyber security personnel props: - name: sort-id value: "catalog[1].group[03].group[2].group[10]" parts: - name: overview prose: "The CISO is responsible for the cyber security workforce within their organisation, including plans to attract, train and retain cyber security personnel. The CISO should also delegate relevant tasks to cyber security managers and other personnel as required to support cyber security activities within their organisation and provide them with adequate authority and resources to perform their duties." controls: - id: ism-0717 class: ISM-control title: "Control: ism-0717" props: - name: sort-id value: "catalog[1].group[03].group[2].group[10].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Oct-20 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0717_smt name: statement prose: The CISO oversees the management of cyber security personnel within their organisation. - id: ism-2020 class: ISM-control title: "Control: ism-2020" props: - name: sort-id value: "catalog[1].group[03].group[2].group[10].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2020_smt name: statement prose: "The CISO ensures sufficient cyber security personnel, with the right skills and experience, are acquired to support cyber security activities within their organisation." - title: Overseeing cyber security awareness training props: - name: sort-id value: "catalog[1].group[03].group[2].group[11]" parts: - name: overview prose: "To ensure personnel are actively contributing to the security culture of their organisation, a cyber security awareness training program should be developed, implemented and maintained. As the CISO is responsible for cyber security within their organisation, they should oversee the development, implementation and maintenance of the cyber security awareness training program." controls: - id: ism-0735 class: ISM-control title: "Control: ism-0735" props: - name: sort-id value: "catalog[1].group[03].group[2].group[11].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0735_smt name: statement prose: "The CISO oversees the development, implementation and maintenance of their organisation’s cyber security awareness training program." - title: System owners props: - name: sort-id value: "catalog[1].group[03].group[3]" parts: - name: overview prose: |- # Further information Further information on using the [Information security manual](#e7ce6e23-4bbb-45c1-a657-7e563c0837ed)’s six-step risk management framework can be found in the ‘Applying a risk-based approach to cyber security’ section of [Using the cyber security framework](#2e11877b-2dcb-46d1-814f-c516290175d3). Further information on [the purpose of IRAP](#84d3cbab-ab84-4981-a4f7-2bd469c8deaf) is available from ASD. Further information on conducting security assessment activities as part of continuously monitoring the security of systems can be found in the ‘Security assessments’ section of the [Guidelines for security assurance](#ef60c0e4-acfb-4a8b-b5ed-25675c6e117c). groups: - title: System ownership and oversight props: - name: sort-id value: "catalog[1].group[03].group[3].group[1]" parts: - name: overview prose: "System owners are responsible for ensuring the secure operation of their systems. However, system owners may delegate the day-to-day management and operation of their systems to system managers. It is recommended that system owners collaborate with their organisation’s internal cyber security teams or engage external cyber security specialists to assist them with their cyber security responsibilities." controls: - id: ism-1071 class: ISM-control title: "Control: ism-1071" props: - name: sort-id value: "catalog[1].group[03].group[3].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1071_smt name: statement prose: Each system has a designated system owner. - id: ism-1525 class: ISM-control title: "Control: ism-1525" props: - name: sort-id value: "catalog[1].group[03].group[3].group[1].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jan-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1525_smt name: statement prose: System owners register each system with its authorising officer. - title: Protecting systems and their resources props: - name: sort-id value: "catalog[1].group[03].group[3].group[2]" parts: - name: overview prose: "Broadly, the risk management framework defined by the [Information security manual](#e7ce6e23-4bbb-45c1-a657-7e563c0837ed) has six steps: define the system, select security controls, implement security controls, assess security controls, authorise the system and monitor the system. System owners are responsible for the implementation of this six-step risk management framework for each of their systems." controls: - id: ism-1633 class: ISM-control title: "Control: ism-1633" props: - name: sort-id value: "catalog[1].group[03].group[3].group[2].control[01]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1633_smt name: statement prose: "System owners, in consultation with each system’s authorising officer, determine the system boundary, business criticality, and security and resilience objectives for each system based on an assessment of the impact if it were to be compromised or attacked." - id: ism-1203 class: ISM-control title: "Control: ism-1203" props: - name: sort-id value: "catalog[1].group[03].group[3].group[2].control[02]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1203_smt name: statement prose: "System owners, in consultation with each system’s authorising officer, conduct a threat and risk assessment for each system." - id: ism-1634 class: ISM-control title: "Control: ism-1634" props: - name: sort-id value: "catalog[1].group[03].group[3].group[2].control[03]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1634_smt name: statement prose: "System owners, in consultation with each system’s authorising officer, select security controls for each system and tailor them to achieve desired security and resilience objectives." - id: ism-0009 class: ISM-control title: "Control: ism-0009" props: - name: sort-id value: "catalog[1].group[03].group[3].group[2].control[04]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0009_smt name: statement prose: "System owners, in consultation with each system’s authorising officer, identify any supplementary security controls required based upon the unique nature of each system, its operating environment and the organisation’s risk tolerances." - id: ism-1635 class: ISM-control title: "Control: ism-1635" props: - name: sort-id value: "catalog[1].group[03].group[3].group[2].control[05]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1635_smt name: statement prose: System owners implement security controls for each system and its operating environment. - id: ism-1636 class: ISM-control title: "Control: ism-1636" props: - name: sort-id value: "catalog[1].group[03].group[3].group[2].control[06]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S parts: - id: ism-1636_smt name: statement prose: "System owners, in consultation with each system’s authorising officer, ensure security controls for each non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET system and its operating environment undergo a security control assessment by their organisation’s own assessors or Infosec Registered Assessor Program (IRAP) assessors to determine if they have been implemented correctly and are operating as intended." - id: ism-1967 class: ISM-control title: "Control: ism-1967" props: - name: sort-id value: "catalog[1].group[03].group[3].group[2].control[07]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1967_smt name: statement prose: "System owners, in consultation with each system’s authorising officer, ensure security controls for each TOP SECRET system and its operating environment, including each sensitive compartmented information system and its operating environment, undergo a security control assessment by ASD assessors (or their delegates) to determine if they have been implemented correctly and are operating as intended." - id: ism-0027 class: ISM-control title: "Control: ism-0027" props: - name: sort-id value: "catalog[1].group[03].group[3].group[2].control[08]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S parts: - id: ism-0027_smt name: statement prose: "System owners obtain an authorisation to operate for each non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET system from its authorising officer." - id: ism-1968 class: ISM-control title: "Control: ism-1968" props: - name: sort-id value: "catalog[1].group[03].group[3].group[2].control[09]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1968_smt name: statement prose: "System owners obtain an authorisation to operate for each TOP SECRET system, including for each sensitive compartmented information system, from Director-General ASD (or their delegate)." - id: ism-1526 class: ISM-control title: "Control: ism-1526" props: - name: sort-id value: "catalog[1].group[03].group[3].group[2].control[10]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1526_smt name: statement prose: "System owners continuously monitor the security of each system, and manage associated cyber threats, security risks and security controls." - id: ism-2021 class: ISM-control title: "Control: ism-2021" props: - name: sort-id value: "catalog[1].group[03].group[3].group[2].control[11]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2021_smt name: statement prose: System owners implement and maintain data minimisation practices for each of their systems. - title: Annual reporting of system security status props: - name: sort-id value: "catalog[1].group[03].group[3].group[3]" parts: - name: overview prose: Annual reporting by system owners on the security status of their systems to their authorising officer can assist the authorising officer in maintaining awareness of the security posture of systems within their organisation. controls: - id: ism-1587 class: ISM-control title: "Control: ism-1587" props: - name: sort-id value: "catalog[1].group[03].group[3].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Aug-20 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1587_smt name: statement prose: System owners report the security status of each system to its authorising officer at least annually. - title: Guidelines for cyber security incidents props: - name: sort-id value: "catalog[1].group[04]" groups: - title: Managing cyber security incidents props: - name: sort-id value: "catalog[1].group[04].group[1]" parts: - name: overview prose: |- # Further information Further information on event logging can be found in the ‘Security monitoring’ section of the [Guidelines for security assurance](#ef60c0e4-acfb-4a8b-b5ed-25675c6e117c). Further information on cyber security incident response plans can be found in the ‘System-specific cyber security documentation’ section of the [Guidelines for cyber security documentation](#578d0434-6b3f-46f3-aad8-c7ac75c2ebcc). Further information on preparing for and responding to cyber security incidents can be found in ASD’s [Cyber security incident response planning: Executive guidance](#403f72c6-3e85-4185-8df3-130b2a6b25b3) and [Cyber security incident response planning: Practitioner guidance](#041bce05-55ad-4a2a-93e3-c582d39fce94) publications. Further information on understanding, identifying and preventing the insider threat can be found in the Attorney-General’s Department’s [Countering the Insider Threat: A guide for Australian Government](#fb60e251-ed4c-4781-96db-58a0225bca89) publication. Further information on understanding, identifying and preventing the insider threat can also be found in the Australian Security Intelligence Organisation’s [Countering the insider threat](#fb60e251-ed4c-4781-96db-58a0225bca89) brochure and [Countering the insider threat: A security manager’s guide](#f6813648-fe24-4d45-9e45-c97b4021506e) publication. Further information on understanding, identifying and preventing the insider threat can also be found on the United Kingdom’s National Protective Security Authority’s [Insider Risk Guidance](#c2a2f934-c5d6-46a7-86db-7fec1565058e) website. Further information on developing, implementing and maintaining an insider threat mitigation program can be found in the United States’ Cybersecurity \& Infrastructure Security Agency’s [Insider Threat Mitigation Guide](#c322926a-13b3-4efe-8573-06624418e8f5). Further information on developing, implementing and maintaining an insider threat mitigation program can also be found in Carnegie Mellon University’s Software Engineering Institute’s [Common Sense Guide to Mitigating Insider Threats, Seventh Edition](#cad720b4-e47a-437d-b272-6958e738131d) publication. Further information on reporting of cyber security incidents by service providers can be found in the ‘Managed services and cloud services’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on [reporting cybercrime incidents](#188466f6-be12-49ce-b99a-981e54b1663e) and [reporting cyber security incidents](#626d3582-3caf-49d6-89d5-4b8fdbbf1f31), including ASD’s [limited use obligation](#cae0ac6b-e69b-4359-bfd7-5ee5eff1049d), is available from ASD. groups: - title: Cyber security incident management policy props: - name: sort-id value: "catalog[1].group[04].group[1].group[1]" parts: - name: overview prose: |- Establishing a cyber security incident management policy can increase the likelihood of successfully planning for, detecting and responding to malicious activity on networks and hosts, such as cyber security events and cyber security incidents. In doing so, a cyber security incident management policy will likely cover the following: - responsibilities for planning for, detecting and responding to cyber security incidents - resources assigned to cyber security incident planning, detection and response activities - guidelines for triaging and responding to cyber security events and cyber security incidents. Furthermore, as part of maintaining the cyber security incident management policy, it is important that it, along with its associated cyber security incident response plan, is exercised at least annually to ensure it remains fit for purpose. controls: - id: ism-0576 class: ISM-control title: "Control: ism-0576" props: - name: sort-id value: "catalog[1].group[04].group[1].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "10" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0576_smt name: statement prose: "A cyber security incident management policy, and associated cyber security incident response plan, is developed, implemented and maintained." - id: ism-1784 class: ISM-control title: "Control: ism-1784" props: - name: sort-id value: "catalog[1].group[04].group[1].group[1].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1784_smt name: statement prose: "The cyber security incident management policy, including the associated cyber security incident response plan, is exercised at least annually." - title: Cyber security incident register props: - name: sort-id value: "catalog[1].group[04].group[1].group[2]" parts: - name: overview prose: "Developing, implementing and maintaining a cyber security incident register can assist in ensuring that appropriate remediation activities are undertaken in response to cyber security incidents. In addition, the types and frequency of cyber security incidents, along with the costs of any remediation activities, can be used as input to future risk assessment activities." controls: - id: ism-0125 class: ISM-control title: "Control: ism-0125" props: - name: sort-id value: "catalog[1].group[04].group[1].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0125_smt name: statement prose: "A cyber security incident register is developed, implemented and maintained." - id: ism-1803 class: ISM-control title: "Control: ism-1803" props: - name: sort-id value: "catalog[1].group[04].group[1].group[2].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1803_smt name: statement prose: |- A cyber security incident register contains the following for each cyber security incident: - the date the cyber security incident occurred - the date the cyber security incident was discovered - a description of the cyber security incident - any actions taken in response to the cyber security incident - to whom the cyber security incident was reported. - title: Insider threat mitigation program props: - name: sort-id value: "catalog[1].group[04].group[1].group[3]" parts: - name: overview prose: |- As an insider’s authorised access to systems and their resources may make them harder to detect when intentionally performing malicious activities, establishing and maintaining an insider threat mitigation program can assist an organisation to detect and respond to indicators of potential insider threats before they occur, or limit damage if they do occur. In doing so, an organisation will likely obtain the most benefit by logging and analysing the following activities: - excessive copying or modification of data - unauthorised or excessive use of removable media - connecting devices capable of data storage to systems - unusual system usage outside of normal business hours - excessive data access or printing compared to their peers - data transfers to unauthorised cloud services or webmail - use of unauthorised virtual private networks, file transfer applications or anonymity networks. controls: - id: ism-1625 class: ISM-control title: "Control: ism-1625" props: - name: sort-id value: "catalog[1].group[04].group[1].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1625_smt name: statement prose: "An insider threat mitigation program is developed, implemented and maintained." - id: ism-1626 class: ISM-control title: "Control: ism-1626" props: - name: sort-id value: "catalog[1].group[04].group[1].group[3].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1626_smt name: statement prose: Legal advice is sought regarding the development and implementation of an insider threat mitigation program. - title: Reporting cyber security incidents props: - name: sort-id value: "catalog[1].group[04].group[1].group[4]" parts: - name: overview prose: "Reporting cyber security incidents to the chief information security officer, or one of their delegates, as soon as possible after they occur or are discovered provides senior management with the opportunity to assess the impact to their organisation and to oversee any cyber security incident response activities. In addition, an organisation should be cognisant of any legislative obligations regarding the reporting of cyber security incidents to authorities." controls: - id: ism-0123 class: ISM-control title: "Control: ism-0123" props: - name: sort-id value: "catalog[1].group[04].group[1].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-0123_smt name: statement prose: "Cyber security incidents are reported to the chief information security officer, or one of their delegates, as soon as possible after they occur or are discovered." - title: Reporting cyber security incidents to ASD props: - name: sort-id value: "catalog[1].group[04].group[1].group[5]" parts: - name: overview prose: |- The Australian Signals Directorate (ASD) uses the cyber security incident reports it receives as the basis for assisting organisations. In addition, cyber security incident reports are used to identify trends and maintain an accurate threat environment picture. Finally, ASD utilises this understanding to assist in the development of new and updated cyber security advice, capabilities and techniques to better prevent and respond to evolving cyber threats. Under ASD’s limited use obligation, any information voluntarily provided to ASD about cyber security incidents, or potential cyber security incidents, cannot be used for regulatory purposes. An organisation is recommended to coordinate their reporting of cyber security incidents to ASD. In doing so, the organisation should be cognisant of any legislative obligations regarding the reporting of cyber security incidents to ASD. The types of cyber security incidents that should be reported to ASD include: - suspicious privileged user account lockouts - suspicious remote access authentication events - service accounts suspiciously communicating with internet-based infrastructure - compromise of sensitive or classified data - unauthorised access or attempts to access a system - emails with suspicious attachments or links - denial-of-service attacks - ransomware attacks - suspected tampering of electronic devices. controls: - id: ism-0140 class: ISM-control title: "Control: ism-0140" props: - name: sort-id value: "catalog[1].group[04].group[1].group[5].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-0140_smt name: statement prose: Cyber security incidents are reported to ASD as soon as possible after they occur or are discovered. - title: Reporting cyber security incidents to customers and the public props: - name: sort-id value: "catalog[1].group[04].group[1].group[6]" parts: - name: overview prose: "Reporting cyber security incidents to customers and the public in a timely manner after they occur or are discovered is one way that an organisation can demonstrate their commitment to transparency. In addition, an organisation should be cognisant of any legislative obligations regarding the reporting of cyber security incidents to customers and the public." controls: - id: ism-1880 class: ISM-control title: "Control: ism-1880" props: - name: sort-id value: "catalog[1].group[04].group[1].group[6].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1880_smt name: statement prose: Cyber security incidents that involve customer data are reported to customers and the public in a timely manner after they occur or are discovered. - id: ism-1881 class: ISM-control title: "Control: ism-1881" props: - name: sort-id value: "catalog[1].group[04].group[1].group[6].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1881_smt name: statement prose: Cyber security incidents that do not involve customer data are reported to customers and the public in a timely manner after they occur or are discovered. - title: Responding to cyber security incidents props: - name: sort-id value: "catalog[1].group[04].group[2]" parts: - name: overview prose: |- # Further information Further information on cyber security incident response plans can be found in the ‘System-specific cyber security documentation’ section of the [Guidelines for cyber security documentation](#578d0434-6b3f-46f3-aad8-c7ac75c2ebcc). Further information on handling malicious code infections can be found in National Institute of Standards and Technology Special Publication 800-61 Rev. 3, [Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile](#f48c0d05-5173-4c8e-8748-e5591518c1fb). groups: - title: Enacting cyber security incident response plans props: - name: sort-id value: "catalog[1].group[04].group[2].group[1]" parts: - name: overview prose: "Following a cyber security incident being identified, an organisation’s cyber security incident response plan should be enacted." controls: - id: ism-1819 class: ISM-control title: "Control: ism-1819" props: - name: sort-id value: "catalog[1].group[04].group[2].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1819_smt name: statement prose: "Following the identification of a cyber security incident, the cyber security incident response plan is enacted." - title: Handling and containing data spills props: - name: sort-id value: "catalog[1].group[04].group[2].group[2]" parts: - name: overview prose: "When a data spill occurs, an organisation should inform data owners and restrict access to the data. In doing so, affected systems can be powered off, have their network connectivity removed or have additional access controls applied to the data. However, powering off systems could destroy data that would be useful for forensic investigations. Furthermore, human users should be made aware of appropriate actions to take in the event of a data spill, such as not deleting, copying, printing or emailing the data." controls: - id: ism-0133 class: ISM-control title: "Control: ism-0133" props: - name: sort-id value: "catalog[1].group[04].group[2].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0133_smt name: statement prose: "When a data spill occurs, data owners are advised and access to the data is restricted." - title: Handling and containing malicious code infections props: - name: sort-id value: "catalog[1].group[04].group[2].group[3]" parts: - name: overview prose: "Taking immediate remediation steps after the discovery of malicious code can minimise the time and cost spent eradicating and recovering from the infection. As a priority, all infected systems and media should be isolated to prevent the infection from spreading. Once isolated, infected systems and media can be scanned by antivirus applications to potentially remove the infection or recover data. It is important to note though, a complete system restoration from a known good backup or rebuild may be the only reliable way to ensure that malicious code can be truly eradicated." controls: - id: ism-0917 class: ISM-control title: "Control: ism-0917" props: - name: sort-id value: "catalog[1].group[04].group[2].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0917_smt name: statement prose: |- When malicious code is detected, the following steps are taken to handle the infection: - the infected systems are isolated - all previously connected media used in the period leading up to the infection are scanned for signs of infection and isolated if necessary - antivirus applications are used to remove the infection from infected systems and media - if the infection cannot be reliably removed, systems are restored from a known good backup or rebuilt. - id: ism-1969 class: ISM-control title: "Control: ism-1969" props: - name: sort-id value: "catalog[1].group[04].group[2].group[3].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1969_smt name: statement prose: "Malicious code, when stored or communicated, is treated beforehand to prevent accidental execution." - id: ism-1970 class: ISM-control title: "Control: ism-1970" props: - name: sort-id value: "catalog[1].group[04].group[2].group[3].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1970_smt name: statement prose: Malicious code processing for cyber security incident response or research purposes is conducted in a dedicated analysis environment segregated from other systems. - title: Handling and containing intrusions props: - name: sort-id value: "catalog[1].group[04].group[2].group[4]" parts: - name: overview prose: |- When an intrusion is detected on a system, an organisation may, in limited circumstances, choose to allow the intrusion to continue for a short period to better understand the extent of the compromise or to assist with planning intrusion remediation activities. However, an organisation allowing an intrusion to continue in order to collect data or evidence should first establish with their legal advisors whether such activities would breach the [Telecommunications (Interception and Access) Act 1979](#e4c07309-9ca8-40b7-9571-4f6c032180a1). To increase the likelihood of eradicating malicious actors from a system, an organisation can take preventative measures to ensure malicious actors have limited awareness of planned intrusion remediation activities. Specifically, using trusted systems separate from a compromised system to plan and coordinate intrusion remediation activities prevents alerting malicious actors if they have already compromised communication or collaboration services. In addition, coordinating and sequencing intrusion remediation activities can reduce opportunities for re-compromise of the system while balancing operational risk and business continuity requirements. Finally, following intrusion remediation activities, an organisation should determine whether malicious actors have been eradicated from the system and have not re-established access. Enhanced monitoring should be conducted until there is sufficient evidence-based confidence that this has been achieved. In determining whether sufficient evidence-based confidence has been achieved, an organisation should consider the scope and quality of its digital forensic investigations, including whether: - the initial access vector and full extent of the compromise have been identified - persistence mechanisms, malicious infrastructure and unauthorised access paths have been identified and remediated - the affected system has been rebuilt, restored from known-good backups or otherwise verified as trustworthy - compromised accounts, credentials, certificates, keys and trust relationships have been remediated - threat hunting has identified no continuing or renewed indicators of malicious activity. controls: - id: ism-0137 class: ISM-control title: "Control: ism-0137" props: - name: sort-id value: "catalog[1].group[04].group[2].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0137_smt name: statement prose: Legal advice is sought before allowing intrusion activity to continue on a system for the purpose of collecting further data or evidence. - id: ism-1609 class: ISM-control title: "Control: ism-1609" props: - name: sort-id value: "catalog[1].group[04].group[2].group[4].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1609_smt name: statement prose: System owners are consulted before allowing intrusion activity to continue on a system for the purpose of collecting further data or evidence. - id: ism-1731 class: ISM-control title: "Control: ism-1731" props: - name: sort-id value: "catalog[1].group[04].group[2].group[4].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1731_smt name: statement prose: Planning and coordination of intrusion remediation activities are conducted using trusted systems separate from a compromised system. - id: ism-1732 class: ISM-control title: "Control: ism-1732" props: - name: sort-id value: "catalog[1].group[04].group[2].group[4].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1732_smt name: statement prose: Intrusion remediation activities are coordinated and sequenced to minimise opportunities for re-compromise of a system while balancing operational risk and business continuity requirements. - id: ism-1213 class: ISM-control title: "Control: ism-1213" props: - name: sort-id value: "catalog[1].group[04].group[2].group[4].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1213_smt name: statement prose: "Following intrusion remediation activities, enhanced monitoring is conducted until there is sufficient evidence-based confidence that malicious actors have been eradicated from a system and have not re-established access." - title: Maintaining the integrity of evidence props: - name: sort-id value: "catalog[1].group[04].group[2].group[5]" parts: - name: overview prose: "When gathering evidence following a cyber security incident, it is important that it is gathered in an appropriate manner and that its integrity is maintained. In addition, if ASD is requested to assist with investigations, no actions that could affect the integrity of evidence should be carried out before ASD becomes involved." controls: - id: ism-0138 class: ISM-control title: "Control: ism-0138" props: - name: sort-id value: "catalog[1].group[04].group[2].group[5].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0138_smt name: statement prose: |- The integrity of evidence gathered during an investigation is maintained by investigators: - recording all their actions - maintaining a proper chain of custody - following all instructions provided by relevant law enforcement agencies. - title: Guidelines for procurement and outsourcing props: - name: sort-id value: "catalog[1].group[05]" groups: - title: Cyber supply chain risk management props: - name: sort-id value: "catalog[1].group[05].group[1]" parts: - name: overview prose: |- # Further information Further information on cyber supply chain risk management can be found in the following Australian Signals Directorate (ASD) publications: - [Choosing secure and verifiable technologies: Executive guidance](#f41c5403-9070-41ab-968e-cf69ac8bf34a) - [Choosing secure and verifiable technologies](#adc62d2d-87b9-43a0-ae76-6e6828ff3bbb) - [Cyber supply chain risk management](#37f65b5b-ce8c-4137-9c84-41678af1e70e) - [Identifying cyber supply chain risks](#85ee803a-b711-443b-98bf-b279de8fbed0). Further information on cyber supply chain risk management can also be found in the following publications: - Canada’s Canadian Centre for Cyber Security’s [Cyber supply chain: An approach to assessing risk](#971c6452-6e97-4b4f-b5e4-64e457cb8320) - New Zealand’s National Cyber Security Centre’s [Supply Chain Cyber Security: In Safe Hands](#8a0daed2-8840-443f-a83e-68252d2dcdc5) - United Kingdom’s National Cyber Security Centre’s [Supply chain security guidance](#19947ae5-678c-4dc0-a35e-283e4af1284c) - United States’ Cybersecurity \& Infrastructure Security Agency’s [Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products](#ab5852b2-0004-4565-8e81-e769ca47ea81). Further information on cyber supply chain risk management can also be found on the United States’ Cybersecurity \& Infrastructure Security Agency’s [ICT Supply Chain Resource Library](#014064b7-5b77-4a79-af6c-79a16f4d0cb2) website. Further information on cyber supply chain integrity can be found in National Institute of Standards and Technology Special Publication 800-161 Rev. 1, [Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations](#0d7243fc-65f0-4b4e-9358-bf4f6e0e34d7). Further information on outsourced products and services can be found in the Department of Home Affairs’ [Protective Security Policy Framework](#92679127-f61d-486a-a93e-df2a26dfb07a). Further information on the procurement and use of evaluated operating systems, applications and IT equipment can be found in the ‘Evaluated product procurement’ and ‘Evaluated product use’ sections of the [Guidelines for evaluated products](#a699a3aa-828d-479b-b50b-98127bb19437). Further information on suppliers that have made a pledge to implement Secure by Design and Secure by Default principles and practices can be found on the United States’ Cybersecurity \& Infrastructure Security Agency’s [Secure by Design Pledge](#4974639a-f41a-4280-ae06-33d1f13d6083) website. groups: - title: Cyber supply chain risk management activities props: - name: sort-id value: "catalog[1].group[05].group[1].group[1]" parts: - name: overview prose: |- Cyber supply chain risk management activities should be conducted during the procurement of operating systems, applications, information technology (IT) equipment, operational technology (OT) equipment and services. This includes considering security risks as systems and their components are being designed, built, stored, delivered, installed, operated, maintained and decommissioned. Furthermore, this also includes identifying and managing jurisdictional, governance, privacy and security risks associated with the use of suppliers, such as software developers, IT equipment manufacturers, OT equipment manufacturers, service providers and other organisations involved in distribution channels. For example, managed services or outsourced cloud services may be located offshore and subject to lawful and covert data collection without their customers’ knowledge. Additionally, use of offshore services introduces jurisdictional risks as foreign countries’ laws could change with little warning. Finally, foreign-owned suppliers operating in Australia may be subject to a foreign government’s lawful access to data belonging to their customers. When procuring operating systems, applications, IT equipment, OT equipment and services, it is important for an organisation to choose vendors that have demonstrated a commitment to the security of their products and services. This will assist in not only reducing the potential number of vulnerabilities, but also increasing the likelihood that timely patches, updates or vendor mitigations will be released to remediate any vulnerabilities that are found. Furthermore, it is important for an organisation to choose suppliers that have demonstrated a commitment to transparency and that have a strong track record of maintaining the security of their own systems. In support of this, suppliers should openly provide evidence of their implementation of such commitments, especially when requested by their customers. Finally, a shared responsibility model that clearly defines the responsibilities of suppliers and their customers can be highly beneficial and should be created and shared between both parties. controls: - id: ism-1631 class: ISM-control title: "Control: ism-1631" props: - name: sort-id value: "catalog[1].group[05].group[1].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1631_smt name: statement prose: "Suppliers of operating systems, applications, IT equipment, OT equipment and services associated with systems are identified." - id: ism-1452 class: ISM-control title: "Control: ism-1452" props: - name: sort-id value: "catalog[1].group[05].group[1].group[1].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1452_smt name: statement prose: "A supply chain risk assessment is performed for suppliers of operating systems, applications, IT equipment, OT equipment and services to assess the impact to a system’s security risk profile." - id: ism-1567 class: ISM-control title: "Control: ism-1567" props: - name: sort-id value: "catalog[1].group[05].group[1].group[1].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1567_smt name: statement prose: Suppliers identified as high risk by a cyber supply chain risk assessment are not used. - id: ism-1568 class: ISM-control title: "Control: ism-1568" props: - name: sort-id value: "catalog[1].group[05].group[1].group[1].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1568_smt name: statement prose: "Operating systems, applications, IT equipment, OT equipment and services are procured from suppliers that have demonstrated a commitment to the security of their products and services." - id: ism-1882 class: ISM-control title: "Control: ism-1882" props: - name: sort-id value: "catalog[1].group[05].group[1].group[1].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1882_smt name: statement prose: "Operating systems, applications, IT equipment, OT equipment and services are procured from suppliers that have demonstrated a commitment to transparency for their products and services." - id: ism-1632 class: ISM-control title: "Control: ism-1632" props: - name: sort-id value: "catalog[1].group[05].group[1].group[1].control[6]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1632_smt name: statement prose: "Operating systems, applications, IT equipment, OT equipment and services are procured from suppliers that have a strong track record of maintaining the security of their own systems." - id: ism-1569 class: ISM-control title: "Control: ism-1569" props: - name: sort-id value: "catalog[1].group[05].group[1].group[1].control[7]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1569_smt name: statement prose: "A shared responsibility model is created, documented and shared between suppliers and their customers to articulate the security responsibilities of each party." - title: Supplier relationship management props: - name: sort-id value: "catalog[1].group[05].group[1].group[2]" parts: - name: overview prose: "Developing, implementing and maintaining a supplier relationship management policy can assist an organisation in identifying, prioritising and maintaining strong relationships with suppliers that have demonstrated a commitment to the security of their products and services. In doing so, these suppliers should be documented on an approved supplier list." controls: - id: ism-1785 class: ISM-control title: "Control: ism-1785" props: - name: sort-id value: "catalog[1].group[05].group[1].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1785_smt name: statement prose: "A supplier relationship management policy is developed, implemented and maintained." - id: ism-1786 class: ISM-control title: "Control: ism-1786" props: - name: sort-id value: "catalog[1].group[05].group[1].group[2].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1786_smt name: statement prose: "An approved supplier list is developed, implemented and maintained." - title: "Sourcing operating systems, applications, IT equipment, OT equipment and services" props: - name: sort-id value: "catalog[1].group[05].group[1].group[3]" parts: - name: overview prose: |- In sourcing operating systems, applications, IT equipment, OT equipment and services, an organisation should use trustworthy suppliers as part of cyber supply chain risk management assessments and subsequently documented on their approved supplier list. Furthermore, to support system availability, an organisation should aim to identify multiple potential suppliers for critical operating systems, applications, IT equipment, OT equipment and services. This coupled with keeping sufficient spares of critical IT equipment and OT equipment in reserve, can assist in mitigating the impact of cyber supply chain disruptions. controls: - id: ism-1787 class: ISM-control title: "Control: ism-1787" props: - name: sort-id value: "catalog[1].group[05].group[1].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1787_smt name: statement prose: "Operating systems, applications, IT equipment, OT equipment and services are sourced from approved suppliers." - id: ism-1788 class: ISM-control title: "Control: ism-1788" props: - name: sort-id value: "catalog[1].group[05].group[1].group[3].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1788_smt name: statement prose: "Multiple potential suppliers are identified for sourcing critical operating systems, applications, IT equipment, OT equipment and services." - id: ism-1789 class: ISM-control title: "Control: ism-1789" props: - name: sort-id value: "catalog[1].group[05].group[1].group[3].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1789_smt name: statement prose: Sufficient spares of critical IT equipment and OT equipment are sourced and kept in reserve. - title: "Delivery of operating systems, applications, IT equipment, OT equipment and services" props: - name: sort-id value: "catalog[1].group[05].group[1].group[4]" parts: - name: overview prose: |- As part of the delivery of operating systems, applications, IT equipment, OT equipment and services, measures should be implemented to protect their integrity, with these measures differing depending on whether delivery relates to digital or physical distribution channels. For example, operating systems and applications may benefit from delivery via encrypted communication channels while IT equipment and OT equipment may benefit from tracking and tamper-evident packaging. In doing so, such measures are only beneficial if they are assessed as part of acceptance of products and services. In all cases, suppliers should be consulted on how best to confirm the integrity of their products and services. While ensuring the integrity of operating systems, applications, IT equipment, OT equipment and services is important, so is ensuring their authenticity. For example, a counterfeit product or service securely delivered is still a counterfeit product or service that may not operate as intended or pose a risk to the security of a system. To assist in identifying counterfeit products and services, suppliers should be consulted on how best to confirm the authenticity of their products and services. controls: - id: ism-1790 class: ISM-control title: "Control: ism-1790" props: - name: sort-id value: "catalog[1].group[05].group[1].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1790_smt name: statement prose: "Operating systems, applications, IT equipment, OT equipment and services are delivered in a manner that maintains their integrity." - id: ism-1791 class: ISM-control title: "Control: ism-1791" props: - name: sort-id value: "catalog[1].group[05].group[1].group[4].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1791_smt name: statement prose: "The integrity of operating systems, applications, IT equipment, OT equipment and services are assessed as part of acceptance of products and services." - id: ism-1792 class: ISM-control title: "Control: ism-1792" props: - name: sort-id value: "catalog[1].group[05].group[1].group[4].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1792_smt name: statement prose: "The authenticity of operating systems, applications, IT equipment, OT equipment and services are assessed as part of acceptance of products and services." - title: Managed services and cloud services props: - name: sort-id value: "catalog[1].group[05].group[2]" parts: - name: overview prose: |- # Context # An outsourced cloud service may also constitute a managed service. In such cases, security controls for outsourced cloud services should be applied in place of equivalent security controls for managed services. An artificial intelligence (AI) application or service may constitute a managed service, an outsourced cloud service, both or neither, depending on how it is deployed and who manages it, regardless of whether it uses a closed source, open source or open weight AI model. # Further information Further information on the use of outsourced cloud services can be found in the ‘Service continuity for online services’ section of the [Guidelines for networking](#f145ff5b-d396-4248-8f48-621349d6f0ed). Further information on the use of outsourced gateway services can be found in the ‘Gateways’ section of the [Guidelines for gateways](#e8bde527-526c-4a6a-b66f-05228f09dd7b). Further information on managed service providers can be found in ASD’s [How to manage your security when engaging a managed service provider](#45899752-c83f-4976-bc99-03f6824a0793) and [Questions to ask managed service providers](#76068c96-8d89-4c37-9eef-03488d5e1b1d) publications. Further information on the definition of cloud computing can be found in National Institute of Standards and Technology Special Publication 800-145, [The NIST Definition of Cloud Computing](#c17600e6-8b13-4d6e-a380-035b51a71b73). Further information on securing cloud services can be found in the following ASD publications: - [Cloud computing security for cloud service providers](#347eee88-cb61-44b9-81ce-ab97dd08387c) - [Cloud computing security for executives](#c8ee37e4-fb81-4fa7-8f14-132c850974bc) - [Cloud computing security for tenants](#b959caf4-8b60-4b82-9552-963754841bb7). Further information on conducting security control assessments of cloud service providers can be found in ASD’s [Cloud assessment and authorisation](#b6479d9a-43c9-41f2-9dbc-2bb689c8e6d8) and [Cloud assessment and authorisation FAQ](#dda788b6-183b-4e89-8254-8c4b5d0540a0) publications. Further information on shared responsibility models for cloud services can be found in ASD’s [Cloud shared responsibility model: Executive guidance](#2d78eb83-ba21-4fe3-8466-e6d1cd8ee6dc) publication. Further information on [the purpose of IRAP](#84d3cbab-ab84-4981-a4f7-2bd469c8deaf) is available from ASD. Further information on unprivileged user accounts, privileged user accounts and least privilege access can be found in the ‘Identity and access management’ section of the [Guidelines for system access](#76d68682-44dd-4e97-98c8-66db2cce1fda). Further information on multi-factor authentication can be found in the ‘Identity and access management’ section of the [Guidelines for system access](#76d68682-44dd-4e97-98c8-66db2cce1fda). Further information on privileged operating environments and secure administrative infrastructure can be found in the ‘System administration’ section of the [Guidelines for system management](#c6ca6620-ccd5-4c5d-b97c-9d92f1162948). Further information on event logging and monitoring can be found in the ‘Security monitoring’ section of the [Guidelines for security assurance](#ef60c0e4-acfb-4a8b-b5ed-25675c6e117c). Further information on reporting cyber security incidents can be found in the ‘Reporting cyber security incidents’ section of the [Guidelines for cyber security incidents](#fe0138db-e83b-4a23-85d3-d84e1c22816f). groups: - title: Managed services props: - name: sort-id value: "catalog[1].group[05].group[2].group[1]" parts: - name: overview prose: "Managed service providers manage the services of an organisation on their behalf. This may include application services, authentication services, backup services, desktop services, enterprise mobility services, gateway services, hosting services, network services, procurement services, security services, support services, and many other business-related services. In doing so, managed service providers may manage services from their customers’ premises or their own premises. In considering security risks associated with managed services, an organisation should consider all managed service providers that have access to their facilities, systems or data." controls: - id: ism-1736 class: ISM-control title: "Control: ism-1736" props: - name: sort-id value: "catalog[1].group[05].group[2].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1736_smt name: statement prose: "A managed service register is developed, implemented, maintained and regularly verified." - id: ism-1737 class: ISM-control title: "Control: ism-1737" props: - name: sort-id value: "catalog[1].group[05].group[2].group[1].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1737_smt name: statement prose: |- A managed service register contains the following for each managed service: - managed service provider’s name - managed service’s name - purpose for using the managed service - sensitivity or classification of data involved - due date for the next security control assessment of the managed service - contractual arrangements for the managed service - organisational point of contact for the managed service - 24/7 contact details for the managed service provider. - title: Assessment of managed service providers props: - name: sort-id value: "catalog[1].group[05].group[2].group[2]" parts: - name: overview prose: "Managed service providers will need to undergo regular security control assessments against the requirements of the [Information security manual](#e7ce6e23-4bbb-45c1-a657-7e563c0837ed) (ISM) to determine their security posture and security risks associated with their use. Following an initial security control assessment, subsequent security control assessments should focus on any new services that are being offered as well as any ISM or security-related system changes that have occurred since the previous security control assessment." controls: - id: ism-1793 class: ISM-control title: "Control: ism-1793" props: - name: sort-id value: "catalog[1].group[05].group[2].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S parts: - id: ism-1793_smt name: statement prose: "Managed service providers and their non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET managed services undergo an Infosec Registered Assessor Program (IRAP) assessment, using the latest release of the ISM available prior to the beginning of the IRAP assessment (or a subsequent release), at least every 24 months." - id: ism-1971 class: ISM-control title: "Control: ism-1971" props: - name: sort-id value: "catalog[1].group[05].group[2].group[2].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1971_smt name: statement prose: "Managed service providers and their TOP SECRET managed services, including sensitive compartmented information managed services, undergo a security control assessment by ASD assessors (or their delegates), using the latest release of the ISM available prior to the beginning of the security control assessment (or a subsequent release), at least every 24 months." - title: Outsourced cloud services props: - name: sort-id value: "catalog[1].group[05].group[2].group[3]" parts: - name: overview prose: "Outsourcing can be a cost-effective option for providing cloud services, as well as potentially delivering a superior service. However, outsourcing can affect an organisation’s security risk profile. Ultimately, an organisation will still need to decide whether a particular outsourced cloud service represents an acceptable security risk and, if appropriate to do so, authorise it for their own use." controls: - id: ism-1637 class: ISM-control title: "Control: ism-1637" props: - name: sort-id value: "catalog[1].group[05].group[2].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1637_smt name: statement prose: "An outsourced cloud service register is developed, implemented, maintained and regularly verified." - id: ism-1638 class: ISM-control title: "Control: ism-1638" props: - name: sort-id value: "catalog[1].group[05].group[2].group[3].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1638_smt name: statement prose: |- An outsourced cloud service register contains the following for each outsourced cloud service: - cloud service provider’s name - cloud service’s name - purpose for using the cloud service - sensitivity or classification of data involved - due date for the next security control assessment of the cloud service - contractual arrangements for the cloud service - organisational point of contact for the cloud service - 24/7 contact details for the cloud service provider. - id: ism-1529 class: ISM-control title: "Control: ism-1529" props: - name: sort-id value: "catalog[1].group[05].group[2].group[3].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1529_smt name: statement prose: Only community or private clouds are used for outsourced SECRET and TOP SECRET cloud services. - title: Assessment of outsourced cloud service providers props: - name: sort-id value: "catalog[1].group[05].group[2].group[4]" parts: - name: overview prose: "Outsourced cloud service providers and their cloud services will need to undergo regular security control assessments against the requirements of the ISM to determine their security posture and security risks associated with their use. Following an initial security control assessment, subsequent security control assessments should focus on any new cloud services that are being offered as well as any ISM or security-related system changes that have occurred since the previous security control assessment." controls: - id: ism-1570 class: ISM-control title: "Control: ism-1570" props: - name: sort-id value: "catalog[1].group[05].group[2].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S parts: - id: ism-1570_smt name: statement prose: "Outsourced cloud service providers and their non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET cloud services undergo an IRAP assessment, using the latest release of the ISM available prior to the beginning of the IRAP assessment (or a subsequent release), at least every 24 months." - id: ism-1972 class: ISM-control title: "Control: ism-1972" props: - name: sort-id value: "catalog[1].group[05].group[2].group[4].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1972_smt name: statement prose: "Outsourced cloud service providers and their TOP SECRET cloud services, including sensitive compartmented information cloud services, undergo a security control assessment by ASD assessors (or their delegates), using the latest release of the ISM available prior to the beginning of the security control assessment (or a subsequent release), at least every 24 months." - title: Contractual security requirements with service providers props: - name: sort-id value: "catalog[1].group[05].group[2].group[5]" parts: - name: overview prose: |- Obligations for protecting data are no different when using a managed service or cloud service than when using an in-house service. As such, contractual arrangements with service providers should address how data entrusted to them, including to any of their subcontractors, will be protected during contractual arrangements and following the completion or termination of such contractual arrangements. However, in some cases an organisation may require managed services or cloud services to be used before all security requirements have been implemented by a service provider. In such cases, contractual arrangements with service providers should include appropriate timeframes for the implementation of security requirements and break clauses if these are not achieved. In addition, although data ownership resides with service providers’ customers, this can become less clear in some circumstances, such as when a service provider is legally required to provide access to, or data from, their assets. To mitigate the likelihood of data being unavailable or compromised, an organisation can document the types of data and its ownership in contractual arrangements with service providers. Furthermore, an organisation may make the decision to move from their current service provider for strategic, operational or governance reasons. This may involve changing to another service provider, moving to a different service with the same service provider or moving back to an on-premises solution. In many cases, transferring data and functionality between old and new services or systems will be desired. Service providers can assist their customers by ensuring data is as portable as possible and that as much data can be exported as possible. As such, data should be stored in a documented format, preferably an open standard, as undocumented or proprietary formats may make it more difficult for an organisation to perform backup, service migration or service decommissioning activities. Finally, to ensure that an organisation is given sufficient time to download their data or move to another service provider should a service provider cease offering a particular service, a one-month notification period should be documented in contractual arrangements with service providers. controls: - id: ism-1395 class: ISM-control title: "Control: ism-1395" props: - name: sort-id value: "catalog[1].group[05].group[2].group[5].control[01]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1395_smt name: statement prose: "Service providers, including any subcontractors, provide an appropriate level of protection for any data entrusted to them or their services." - id: ism-0072 class: ISM-control title: "Control: ism-0072" props: - name: sort-id value: "catalog[1].group[05].group[2].group[5].control[02]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "10" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0072_smt name: statement prose: "Security requirements associated with the confidentiality, integrity and availability of data are documented in contractual arrangements with service providers and regularly reviewed to ensure they remain fit for purpose." - id: ism-1571 class: ISM-control title: "Control: ism-1571" props: - name: sort-id value: "catalog[1].group[05].group[2].group[5].control[03]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1571_smt name: statement prose: The right to verify compliance with security requirements is documented in contractual arrangements with service providers. - id: ism-1738 class: ISM-control title: "Control: ism-1738" props: - name: sort-id value: "catalog[1].group[05].group[2].group[5].control[04]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1738_smt name: statement prose: The right to verify compliance with security requirements documented in contractual arrangements with service providers is regularly exercised. - id: ism-1804 class: ISM-control title: "Control: ism-1804" props: - name: sort-id value: "catalog[1].group[05].group[2].group[5].control[05]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1804_smt name: statement prose: Break clauses associated with failure to meet security requirements are documented in contractual arrangements with service providers. - id: ism-0141 class: ISM-control title: "Control: ism-0141" props: - name: sort-id value: "catalog[1].group[05].group[2].group[5].control[06]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0141_smt name: statement prose: The requirement for service providers to report cyber security incidents to a designated point of contact as soon as possible after they occur or are discovered is documented in contractual arrangements with service providers. - id: ism-1794 class: ISM-control title: "Control: ism-1794" props: - name: sort-id value: "catalog[1].group[05].group[2].group[5].control[07]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1794_smt name: statement prose: A minimum notification period of one month by service providers for significant changes to their own service provider arrangements is documented in contractual arrangements with service providers. - id: ism-1451 class: ISM-control title: "Control: ism-1451" props: - name: sort-id value: "catalog[1].group[05].group[2].group[5].control[08]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1451_smt name: statement prose: Types of data and its ownership is documented in contractual arrangements with service providers. - id: ism-1572 class: ISM-control title: "Control: ism-1572" props: - name: sort-id value: "catalog[1].group[05].group[2].group[5].control[09]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1572_smt name: statement prose: "The regions or availability zones where data will be processed, stored and communicated, as well as a minimum notification period for any configuration changes, is documented in contractual arrangements with service providers." - id: ism-1573 class: ISM-control title: "Control: ism-1573" props: - name: sort-id value: "catalog[1].group[05].group[2].group[5].control[10]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1573_smt name: statement prose: Access to all logs relating to an organisation’s data and services is documented in contractual arrangements with service providers. - id: ism-1574 class: ISM-control title: "Control: ism-1574" props: - name: sort-id value: "catalog[1].group[05].group[2].group[5].control[11]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1574_smt name: statement prose: "The storage of data in a portable manner that enables backups, service migration and service decommissioning without any loss of data is documented in contractual arrangements with service providers." - id: ism-1575 class: ISM-control title: "Control: ism-1575" props: - name: sort-id value: "catalog[1].group[05].group[2].group[5].control[12]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1575_smt name: statement prose: A minimum notification period of one month for the cessation of any services by a service provider is documented in contractual arrangements with service providers. - title: Access to systems by service providers props: - name: sort-id value: "catalog[1].group[05].group[2].group[6]" parts: - name: overview prose: |- To perform their contracted duties, service providers may need to access their customers’ systems. However, without appropriate measures in place, such access could leave systems vulnerable, especially when access originates outside Australia or involves privileged administrative activities. As such, service provider access should be subject to all measures otherwise applicable to unprivileged users, privileged users, remote access and administrative activities. Depending on the nature of the access, this may include the use of individually attributable accounts, least privilege access, multi-factor authentication, separate privileged operating environments and secure administrative infrastructure. Service provider-specific restrictions, such as remote management tools, source network addresses and time windows approved by the customer, should be applied as additional safeguards rather than as substitutes for these measures. An organisation should also ensure that its systems are not accessed or administered by service providers unless such requirements, and the measures used to control them, are documented in contractual arrangements. Service provider access should also be independently logged and analysed by the organisation in a timely manner to detect any anomalous, unexpected or unauthorised activity. Records of approved remote management tools, source network addresses and time windows should be maintained and made available to personnel responsible for monitoring service provider access. If unauthorised access occurs, such as customer support representatives or platform engineers accessing encryption keys without authorisation, the service provider should immediately report the cyber security incident to its customer and make available all logs pertaining to the unauthorised access. controls: - id: ism-1073 class: ISM-control title: "Control: ism-1073" props: - name: sort-id value: "catalog[1].group[05].group[2].group[6].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1073_smt name: statement prose: An organisation’s systems are not accessed or administered by a service provider unless a contractual arrangement exists between the organisation and the service provider to do so. - id: ism-2124 class: ISM-control title: "Control: ism-2124" props: - name: sort-id value: "catalog[1].group[05].group[2].group[6].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2124_smt name: statement prose: "Access by a service provider to an organisation’s systems is restricted to remote management tools, source network addresses and time windows explicitly approved by the organisation." - id: ism-1576 class: ISM-control title: "Control: ism-1576" props: - name: sort-id value: "catalog[1].group[05].group[2].group[6].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1576_smt name: statement prose: "If an organisation’s systems are accessed or administered by a service provider in an unauthorised manner, it is treated as a cyber security incident and the organisation is immediately notified." - id: ism-2125 class: ISM-control title: "Control: ism-2125" props: - name: sort-id value: "catalog[1].group[05].group[2].group[6].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2125_smt name: statement prose: "All access to an organisation’s systems by a service provider is independently logged by the organisation in a manner that the service provider cannot modify or delete, and analysed in a timely manner to detect any anomalous, unexpected or unauthorised activity." - title: Guidelines for cyber security documentation props: - name: sort-id value: "catalog[1].group[06]" groups: - title: Development and maintenance of cyber security documentation props: - name: sort-id value: "catalog[1].group[06].group[1]" parts: - name: overview prose: |- # Further information Further information on system-specific cyber security documentation, such as a system security plan, cyber security incident response plan, change and configuration management plan, continuous monitoring plan, security assessment report and plan of action and milestones, can be found in the ‘System-specific cyber security documentation’ section of these guidelines. Further information on system registers can be found in the ‘Chief information security officer’ section of the [Guidelines for cyber security roles](#626dab35-81ab-45fe-8c12-0faff1c23c07). Further information on business continuity and disaster recovery plans can be found in the ‘Chief information security officer’ section of the [Guidelines for cyber security roles](#626dab35-81ab-45fe-8c12-0faff1c23c07). Further information on cyber security communication strategies can be found in the ‘Chief information security officer’ section of the [Guidelines for cyber security roles](#626dab35-81ab-45fe-8c12-0faff1c23c07). Further information on cyber security incident management policy can be found in the ‘Managing cyber security incidents’ section of the [Guidelines for cyber security incidents](#fe0138db-e83b-4a23-85d3-d84e1c22816f). Further information on cyber security incident registers can be found in the ‘Managing cyber security incidents’ section of the [Guidelines for cyber security incidents](#fe0138db-e83b-4a23-85d3-d84e1c22816f). Further information on supplier relationship management policy can be found in the ‘Cyber supply chain risk management’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on approved supplier lists can be found in the ‘Cyber supply chain risk management’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on managed service registers can be found in the ‘Managed services and cloud services’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on outsourced cloud service registers can be found in the ‘Managed services and cloud services’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on authorised radio frequency and infrared device registers can be found in the ‘Facilities and systems’ section of the [Guidelines for physical security](#4deea7ea-18a2-4fd7-8b25-0b3603215df2). Further information on authorised medical device registers can be found in the ‘Facilities and systems’ section of the [Guidelines for physical security](#4deea7ea-18a2-4fd7-8b25-0b3603215df2). Further information on cyber security awareness training registers can be found in the ‘Cyber security awareness training’ section of the [Guidelines for personnel security](#7d16ae67-87a7-4861-b939-e13ec279b5a2). Further information on general-purpose artificial intelligence usage policy can be found in the ‘Cyber security awareness training’ section of the [Guidelines for personnel security](#7d16ae67-87a7-4861-b939-e13ec279b5a2). Further information on web usage policy can be found in the ‘Cyber security awareness training’ section of the [Guidelines for personnel security](#7d16ae67-87a7-4861-b939-e13ec279b5a2). Further information on cable registers can be found in the ‘Cabling infrastructure’ section of the [Guidelines for communications infrastructure](#4defa9a8-c5f5-4b39-8b0a-537f14d9d14d). Further information on floor plan diagrams can be found in the ‘Cabling infrastructure’ section of the [Guidelines for communications infrastructure](#4defa9a8-c5f5-4b39-8b0a-537f14d9d14d). Further information on cable labelling processes and procedures can be found in the ‘Cabling infrastructure’ section of the [Guidelines for communications infrastructure](#4defa9a8-c5f5-4b39-8b0a-537f14d9d14d). Further information on telephone system usage policy can be found in the ‘Telephone systems’ section of the [Guidelines for communications systems](#3a7b903b-ed0d-450d-9123-60f6f8fd5dd2). Further information on denial of service response plans for video conferencing and Internet Protocol telephony services can be found in the ‘Video conferencing and Internet Protocol telephony’ section of the [Guidelines for communications systems](#3a7b903b-ed0d-450d-9123-60f6f8fd5dd2). Further information on multifunction device usage policy can be found in the ‘Multifunction devices’ section of the [Guidelines for communications systems](#3a7b903b-ed0d-450d-9123-60f6f8fd5dd2). Further information on mobile device management policy can be found in the ‘Mobile device management’ section of the [Guidelines for enterprise mobility](#9a8f5a63-bcd5-45a8-9f9c-974fc796ac95). Further information on mobile device usage policy can be found in the ‘Mobile device usage’ section of the [Guidelines for enterprise mobility](#9a8f5a63-bcd5-45a8-9f9c-974fc796ac95). Further information on mobile device emergency sanitisation processes and procedures can be found in the ‘Mobile device usage’ section of the [Guidelines for enterprise mobility](#9a8f5a63-bcd5-45a8-9f9c-974fc796ac95). Further information on information technology (IT) equipment management policy can be found in the ‘IT equipment usage’ section of the [Guidelines for information technology equipment](#db2e237c-2dbc-4a1f-bae7-9cb63a1f1dc3). Further information on networked and non-networked IT equipment registers can be found in the ‘IT equipment usage’ section of the [Guidelines for information technology equipment](#db2e237c-2dbc-4a1f-bae7-9cb63a1f1dc3). Further information on IT equipment sanitisation processes and procedures can be found in the ‘IT equipment sanitisation and destruction’ section of the [Guidelines for information technology equipment](#db2e237c-2dbc-4a1f-bae7-9cb63a1f1dc3). Further information on IT equipment destruction processes and procedures can be found in the ‘IT equipment sanitisation and destruction’ section of the [Guidelines for information technology equipment](#db2e237c-2dbc-4a1f-bae7-9cb63a1f1dc3). Further information on IT equipment disposal processes and procedures can be found in the ‘IT equipment disposal’ section of the [Guidelines for information technology equipment](#db2e237c-2dbc-4a1f-bae7-9cb63a1f1dc3). Further information on media management policy can be found in the ‘Media usage’ section of the [Guidelines for media](#b594c9c0-b42f-4f06-b643-38023275a5c7). Further information on removable media usage policy can be found in the ‘Media usage’ section of the [Guidelines for media](#b594c9c0-b42f-4f06-b643-38023275a5c7). Further information on removable media registers can be found in the ‘Media usage’ section of the [Guidelines for media](#b594c9c0-b42f-4f06-b643-38023275a5c7). Further information on media sanitisation processes and procedures can be found in the ‘Media sanitisation’ section of the [Guidelines for media](#b594c9c0-b42f-4f06-b643-38023275a5c7). Further information on media destruction processes and procedures can be found in the ‘Media destruction’ section of the [Guidelines for media](#b594c9c0-b42f-4f06-b643-38023275a5c7). Further information on media disposal processes and procedures can be found in the ‘Media disposal’ section of the [Guidelines for media](#b594c9c0-b42f-4f06-b643-38023275a5c7). Further information on system usage policy can be found in the ‘Identity and access management’ section of the [Guidelines for system access](#76d68682-44dd-4e97-98c8-66db2cce1fda). Further information on artificial intelligence agent registers can be found in the ‘Identity and access management’ section of the [Guidelines for system access](#76d68682-44dd-4e97-98c8-66db2cce1fda). Further information on system administration processes and procedures can be found in the ‘System administration’ section of the [Guidelines for system management](#c6ca6620-ccd5-4c5d-b97c-9d92f1162948). Further information on patch management processes and procedures can be found in the ‘System maintenance’ section of the [Guidelines for system management](#c6ca6620-ccd5-4c5d-b97c-9d92f1162948). Further information on software registers can be found in the ‘System maintenance’ section of the [Guidelines for system management](#c6ca6620-ccd5-4c5d-b97c-9d92f1162948). Further information on digital preservation policy can be found in the ‘Data backup and restoration’ section of the [Guidelines for system management](#c6ca6620-ccd5-4c5d-b97c-9d92f1162948). Further information on data backup processes and procedures can be found in the ‘Data backup and restoration’ section of the [Guidelines for system management](#c6ca6620-ccd5-4c5d-b97c-9d92f1162948). Further information on data restoration processes and procedures can be found in the ‘Data backup and restoration’ section of the [Guidelines for system management](#c6ca6620-ccd5-4c5d-b97c-9d92f1162948). Further information on security monitoring policy can be found in the ‘Security monitoring’ section of the [Guidelines for security assurance](#ef60c0e4-acfb-4a8b-b5ed-25675c6e117c). Further information on secure software development policy can be found in the ‘Software development fundamentals’ section of the [Guidelines for software development](#506198a8-7ae8-4c95-8b7b-2a4833cfab4b). Further information on software developer cyber security knowledge and skills registers can be found in the ‘Software development fundamentals’ section of the [Guidelines for software development](#506198a8-7ae8-4c95-8b7b-2a4833cfab4b). Further information on vulnerability disclosure policy can be found in the ‘Software development fundamentals’ section of the [Guidelines for software development](#506198a8-7ae8-4c95-8b7b-2a4833cfab4b). Further information on vulnerability disclosure processes and procedures can be found in the ‘Software development fundamentals’ section of the [Guidelines for software development](#506198a8-7ae8-4c95-8b7b-2a4833cfab4b). Further information on database registers can be found in the ‘Databases’ section of the [Guidelines for database systems](#3f349d16-11a1-459a-a299-c9446aea7597). Further information on email usage policy can be found in the ‘Email usage’ section of the [Guidelines for email](#ab73fa95-f213-4041-915e-a8ccbdf74331). Further information on network diagrams can be found in the ‘Network design and configuration’ section of the [Guidelines for networking](#f145ff5b-d396-4248-8f48-621349d6f0ed). Further information on cryptographic key management processes and procedures can be found in the ‘Cryptographic fundamentals’ section of the [Guidelines for cryptography](#195abe87-bb1e-4006-8b42-eaecca4d51f1). Further information on data transfer processes and procedures can be found in the ‘Data transfers’ section of the [Guidelines for data transfers](#1eefdaf7-3991-4ba2-9439-79565f508c44). groups: - title: Cyber security strategy props: - name: sort-id value: "catalog[1].group[06].group[1].group[1]" parts: - name: overview prose: "A cyber security strategy articulates an organisation’s vision, guiding principles, objectives and priorities for cyber security, typically over a five-year period. In addition, a cyber security strategy may also cover an organisation’s threat environment, cyber security initiatives or investments the organisation plans to make as part of its cyber security program. Without a cyber security strategy, an organisation risks failing to adequately plan for and manage security and business risks within their organisation." controls: - id: ism-0039 class: ISM-control title: "Control: ism-0039" props: - name: sort-id value: "catalog[1].group[06].group[1].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0039_smt name: statement prose: "A cyber security strategy is developed, implemented and maintained." - title: Approval of cyber security documentation props: - name: sort-id value: "catalog[1].group[06].group[1].group[2]" parts: - name: overview prose: "If cyber security documentation is not reviewed and approved by an appropriate authority, system owners risk failing in their duty to ensure that appropriate security controls have been identified and implemented for systems and their operating environments. In doing so, it is important that a system’s security architecture, as outlined within the system security plan and supported by the cyber security incident response plan, change and configuration management plan, and continuous monitoring plan, is approved by the system’s authorising officer prior to the development of the system." controls: - id: ism-0047 class: ISM-control title: "Control: ism-0047" props: - name: sort-id value: "catalog[1].group[06].group[1].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0047_smt name: statement prose: Organisational-level cyber security documentation is approved by the chief information security officer while system-specific cyber security documentation is approved by the system’s authorising officer. - id: ism-1739 class: ISM-control title: "Control: ism-1739" props: - name: sort-id value: "catalog[1].group[06].group[1].group[2].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1739_smt name: statement prose: A system’s security architecture is approved prior to the development of the system. - title: Maintenance of cyber security documentation props: - name: sort-id value: "catalog[1].group[06].group[1].group[3]" parts: - name: overview prose: "Threat environments are dynamic. If cyber security documentation is not kept up to date to reflect the current threat environment, policies, processes and procedures may cease to be effective. In such situations, resources could be devoted to cyber security initiatives or investments that are less effective or no longer relevant." controls: - id: ism-0888 class: ISM-control title: "Control: ism-0888" props: - name: sort-id value: "catalog[1].group[06].group[1].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0888_smt name: statement prose: "Cyber security documentation is reviewed at least annually and includes a ‘current as at \\[date\\]’ or equivalent statement." - title: Communication of cyber security documentation props: - name: sort-id value: "catalog[1].group[06].group[1].group[4]" parts: - name: overview prose: "It is important that once cyber security documentation has been approved, it is published and communicated to all stakeholders. If cyber security documentation is not communicated to stakeholders, they will be unaware of what policies and procedures have been implemented for systems." controls: - id: ism-1602 class: ISM-control title: "Control: ism-1602" props: - name: sort-id value: "catalog[1].group[06].group[1].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1602_smt name: statement prose: "Cyber security documentation, including notification of subsequent changes, is communicated to all stakeholders." - title: System-specific cyber security documentation props: - name: sort-id value: "catalog[1].group[06].group[2]" parts: - name: overview prose: |- # Context System-specific cyber security documentation, such as a system security plan, cyber security incident response plan, change and configuration management plan, continuous monitoring plan, security assessment report, and plan of action and milestones, supports the accurate and consistent application of policies, processes and procedures for systems. As such, it is important that they are developed by personnel with a good understanding of business requirements, technologies being used and cyber security matters. System-specific cyber security documentation may be presented in multiple formats, including in wikis or other forms of document repositories. Furthermore, depending on the documentation framework used, details common to multiple systems could be consolidated into higher-level cyber security documentation. # Further information To assist with the development of system-specific cyber security documentation, a system security plan annex template can be found on the Australian Signals Directorate’s [Information security manual](#e7ce6e23-4bbb-45c1-a657-7e563c0837ed) webpage. Further information on cyber security incident response activities can be found in the ‘Managing cyber security incidents’ and ‘Responding to cyber security incidents’ sections of the [Guidelines for cyber security incidents](#fe0138db-e83b-4a23-85d3-d84e1c22816f). Further information on conducting security assessment activities as part of continuously monitoring the security of systems can be found in the ‘Security assessments’ section of the [Guidelines for security assurance](#ef60c0e4-acfb-4a8b-b5ed-25675c6e117c). groups: - title: System security plan props: - name: sort-id value: "catalog[1].group[06].group[2].group[1]" parts: - name: overview prose: |- The system security plan provides an overview of the system, covering the system’s purpose, the system boundary and how the system is managed, as well as an annex that describes the security controls that have been identified and implemented for the system. There can be many stakeholders involved in developing and maintaining a system security plan. This can include representatives from the following groups: - cyber security teams - project teams who deliver the capability (including contractors) - support teams who operate and support the capability - data owners for data processed, stored or communicated by the system - users for whom the capability is being developed. controls: - id: ism-0041 class: ISM-control title: "Control: ism-0041" props: - name: sort-id value: "catalog[1].group[06].group[2].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0041_smt name: statement prose: "Systems have a system security plan that includes an overview of the system (covering the system’s purpose, the system boundary and how the system is managed) as well as an annex that covers applicable security controls from this document and any additional security controls that have been identified and implemented." - title: Cyber security incident response plan props: - name: sort-id value: "catalog[1].group[06].group[2].group[2]" parts: - name: overview prose: "Having a cyber security incident response plan ensures that when a cyber security incident occurs, a plan is in place to respond appropriately to the situation. In most situations, the aim of the response will be to prevent the cyber security incident from escalating, restore any impacted system or data, and preserve any evidence." controls: - id: ism-0043 class: ISM-control title: "Control: ism-0043" props: - name: sort-id value: "catalog[1].group[06].group[2].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0043_smt name: statement prose: |- Systems have a cyber security incident response plan that covers the following: - guidelines on what constitutes a cyber security incident - the types of cyber security incidents likely to be encountered and the expected response to each type - how to report cyber security incidents, internally to an organisation and externally to relevant authorities - other parties that need to be informed in the event of a cyber security incident - the authority, or authorities, responsible for investigating and responding to cyber security incidents - the criteria by which an investigation of a cyber security incident would be requested from a law enforcement agency, the Australian Signals Directorate or other relevant authority - the steps necessary to ensure the integrity of evidence relating to a cyber security incident - system contingency measures or a reference to such details if they are in a separate document. - title: Change and configuration management plan props: - name: sort-id value: "catalog[1].group[06].group[2].group[3]" parts: - name: overview prose: "Having a change and configuration management plan ensures that changes to the configuration of systems can be made in an accountable manner, with appropriate consultation, consideration and approvals, to maintain the security of such systems. Furthermore, change management and configuration management processes and procedures provide an opportunity for the security impact of changes to configuration of systems to be considered and, if necessary, additional risk management activities to be undertaken." controls: - id: ism-0912 class: ISM-control title: "Control: ism-0912" props: - name: sort-id value: "catalog[1].group[06].group[2].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0912_smt name: statement prose: |- Systems have a change and configuration management plan that includes: - the establishment and maintenance of authorised baseline configurations for systems - what constitutes routine and urgent changes to the configuration of systems - how changes to the configuration of systems will be requested, tracked and documented - who needs to be consulted prior to routine and urgent changes to the configuration of systems - who needs to approve routine and urgent changes to the configuration of systems - who needs to be notified of routine and urgent changes to the configuration of systems - what additional change management and configuration management processes and procedures need to be followed before, during and after routine and urgent changes to the configuration of systems. - title: Continuous monitoring plan props: - name: sort-id value: "catalog[1].group[06].group[2].group[4]" parts: - name: overview prose: |- A continuous monitoring plan can assist an organisation in proactively identifying, prioritising and responding to vulnerabilities in systems. Furthermore, undertaking security assessment activities as part of continuous monitoring is important as cyber threats and the effectiveness of security controls change over time. Three types of security assessment activities that support continuously monitoring the security of systems are vulnerability scans, vulnerability assessments and penetration tests. A vulnerability scan involves using tools to conduct automated checks for known vulnerabilities whereas a vulnerability assessment typically consists of a review of a system’s architecture or an in-depth hands-on assessment. In each case, the goal is to identify as many vulnerabilities as possible. A penetration test however is designed to exercise real-world scenarios to achieve a specific goal, such as compromising critical systems or data. controls: - id: ism-1163 class: ISM-control title: "Control: ism-1163" props: - name: sort-id value: "catalog[1].group[06].group[2].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "11" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1163_smt name: statement prose: |- Systems have a continuous monitoring plan that includes: - conducting security assessment activities to identify vulnerabilities - analysing identified vulnerabilities to determine their potential impact - implementing mitigations based on risk, effectiveness and cost. - title: Security assessment report props: - name: sort-id value: "catalog[1].group[06].group[2].group[5]" parts: - name: overview prose: "At the conclusion of a security control assessment for a system, a security assessment report should be produced by the assessor. This will assist the system owner in performing any initial remediation actions as well as guiding the development of the system’s plan of action and milestones." controls: - id: ism-1563 class: ISM-control title: "Control: ism-1563" props: - name: sort-id value: "catalog[1].group[06].group[2].group[5].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1563_smt name: statement prose: |- At the conclusion of a security control assessment for a system, a security assessment report is produced by the assessor and covers: - the scope of the security control assessment - the system’s strengths and weaknesses - security risks associated with the operation of the system - the effectiveness of the implementation of security controls - any recommended remediation actions. - title: Plan of action and milestones props: - name: sort-id value: "catalog[1].group[06].group[2].group[6]" parts: - name: overview prose: "At the conclusion of a security control assessment for a system, and after the production of a security assessment report by the assessor, a plan of action and milestones should be produced by the system owner. This will assist in tracking any of the system’s identified weaknesses and recommended remediation actions identified during the security control assessment." controls: - id: ism-1564 class: ISM-control title: "Control: ism-1564" props: - name: sort-id value: "catalog[1].group[06].group[2].group[6].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1564_smt name: statement prose: "At the conclusion of a security control assessment for a system, a plan of action and milestones is produced by the system owner." - title: Guidelines for physical security props: - name: sort-id value: "catalog[1].group[07]" groups: - title: Facilities and systems props: - name: sort-id value: "catalog[1].group[07].group[1]" parts: - name: overview prose: |- # Further information Further information on the certification and accreditation authorities for physical security can be found in the Department of Home Affairs’ [Protective Security Policy Framework](#92679127-f61d-486a-a93e-df2a26dfb07a). Further information on the physical security requirements for specific security zones can be found in the Department of Home Affairs’ [Protective Security Policy Framework](#92679127-f61d-486a-a93e-df2a26dfb07a). Further information on selecting security zones and security containers for the protection of information technology (IT) equipment can be found in the Department of Home Affairs’ [Protective Security Policy Framework](#92679127-f61d-486a-a93e-df2a26dfb07a). Further information on emanation security considerations associated with usage of RF devices in SECRET and TOP SECRET areas can be found in the ‘Emanation security’ section of the [Guidelines for communications infrastructure](#4defa9a8-c5f5-4b39-8b0a-537f14d9d14d). Further information on medical devices approved by the Therapeutic Goods Administration for diagnostic or therapeutic purposes can be found on the [Australian Register of Therapeutic Goods](#8edb7798-5d97-4811-a8ba-add3d5a123cf). groups: - title: Physical access to systems props: - name: sort-id value: "catalog[1].group[07].group[1].group[1]" parts: - name: overview prose: |- The application of the defence-in-depth principle to the protection of systems is enhanced through successive layers of physical security. The first layer of physical security for facilities that contain systems is generally the use of a security zone. Deployable platforms should also meet physical security requirements. In some cases, physical security certification authorities may have specific requirements for deployable platforms that supersede the security controls in these guidelines. This may include perimeter controls, building standards and staffing levels. As such, an organisation implementing deployable platforms should contact their physical security certification authority to seek additional guidance. controls: - id: ism-1973 class: ISM-control title: "Control: ism-1973" props: - name: sort-id value: "catalog[1].group[07].group[1].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC parts: - id: ism-1973_smt name: statement prose: Non-classified systems are secured in suitably secure facilities. - id: ism-0810 class: ISM-control title: "Control: ism-0810" props: - name: sort-id value: "catalog[1].group[07].group[1].group[1].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0810_smt name: statement prose: Classified systems are secured in facilities that meet the requirements for a security zone suitable for their classification. - title: "Physical access to servers, network devices and cryptographic equipment" props: - name: sort-id value: "catalog[1].group[07].group[1].group[2]" parts: - name: overview prose: "The second layer of physical security is the use of an additional security zone for a server room or communications room. This is then further supplemented by security containers for the protection of servers, network devices and cryptographic equipment." controls: - id: ism-1974 class: ISM-control title: "Control: ism-1974" props: - name: sort-id value: "catalog[1].group[07].group[1].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC parts: - id: ism-1974_smt name: statement prose: "Non-classified servers, network devices and cryptographic equipment are secured in suitably secure server rooms or communications rooms." - id: ism-1053 class: ISM-control title: "Control: ism-1053" props: - name: sort-id value: "catalog[1].group[07].group[1].group[2].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1053_smt name: statement prose: "Classified servers, network devices and cryptographic equipment are secured in server rooms or communications rooms that meet the requirements for a security zone suitable for their classification." - id: ism-1975 class: ISM-control title: "Control: ism-1975" props: - name: sort-id value: "catalog[1].group[07].group[1].group[2].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC parts: - id: ism-1975_smt name: statement prose: "Non-classified servers, network devices and cryptographic equipment are secured in suitably secure security containers." - id: ism-1530 class: ISM-control title: "Control: ism-1530" props: - name: sort-id value: "catalog[1].group[07].group[1].group[2].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1530_smt name: statement prose: "Classified servers, network devices and cryptographic equipment are secured in security containers suitable for their classification taking into account the combination of security zones they reside in." - id: ism-0813 class: ISM-control title: "Control: ism-0813" props: - name: sort-id value: "catalog[1].group[07].group[1].group[2].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0813_smt name: statement prose: "Server rooms, communications rooms and security containers are not left in unsecured states." - id: ism-1074 class: ISM-control title: "Control: ism-1074" props: - name: sort-id value: "catalog[1].group[07].group[1].group[2].control[6]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1074_smt name: statement prose: "Keys or equivalent access mechanisms to server rooms, communications rooms and security containers are appropriately controlled." - title: Physical access to network devices in public areas props: - name: sort-id value: "catalog[1].group[07].group[1].group[3]" parts: - name: overview prose: |- Unprotected network devices in public areas could lead to accidental or deliberate physical damage resulting in an interruption of services. Alternatively, unauthorised access to network devices may allow malicious actors to reset them to factory default settings or connect directly to them to bypass network access controls. Even if access to network devices is not gained by resetting them to factory default settings, it is highly likely that it will cause an interruption of services. Physical access to network devices can be restricted through the implementation of physical security, such as using enclosures that prevent access to their console ports and factory reset buttons, mounting them on ceilings or behind walls, or securing them in security containers. controls: - id: ism-1296 class: ISM-control title: "Control: ism-1296" props: - name: sort-id value: "catalog[1].group[07].group[1].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1296_smt name: statement prose: Physical security is implemented to protect network devices in public areas from physical damage or unauthorised access. - title: Bringing radio frequency and infrared devices into facilities props: - name: sort-id value: "catalog[1].group[07].group[1].group[4]" parts: - name: overview prose: |- Radio frequency (RF) devices, such as mobile devices, wireless keyboards and Bluetooth devices, as well as infrared (IR) devices, can pose a security risk to an organisation, especially when they can record or transmit audio or data. In SECRET and TOP SECRET areas, it is important that an organisation understands the security risks associated with the introduction of RF and IR devices and develop, implement, maintain and regularly verify a register of those that have been authorised for use in such environments. In deciding which RF or IR devices to authorise to be brought into SECRET and TOP SECRET areas, an organisation should consider any mitigating measures already in place. These include whether IR communications would be prevented from travelling outside secured spaces, whether systems of different sensitivities or classifications are used in the same spaces, and if any temporary or permanent method of blocking RF or IR transmissions has been applied to the facility. controls: - id: ism-1543 class: ISM-control title: "Control: ism-1543" props: - name: sort-id value: "catalog[1].group[07].group[1].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1543_smt name: statement prose: "An authorised RF and IR device register for SECRET and TOP SECRET areas is developed, implemented, maintained and regularly verified." - id: ism-0225 class: ISM-control title: "Control: ism-0225" props: - name: sort-id value: "catalog[1].group[07].group[1].group[4].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0225_smt name: statement prose: Unauthorised RF and IR devices are not brought into SECRET and TOP SECRET areas. - id: ism-0829 class: ISM-control title: "Control: ism-0829" props: - name: sort-id value: "catalog[1].group[07].group[1].group[4].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-19 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0829_smt name: statement prose: Security measures are used to detect and respond to unauthorised RF devices in SECRET and TOP SECRET areas. - title: Bringing photographic and video recording devices into facilities props: - name: sort-id value: "catalog[1].group[07].group[1].group[5]" parts: - name: overview prose: "Photographic and video recording devices, such as cameras, video cameras and smart glasses, can pose a security risk to an organisation, especially when they can record photographs or videos in an inconspicuous manner. In SECRET and TOP SECRET areas, it is important that an organisation understands the security risks associated with the introduction of photographic and video recording devices and develop, implement, maintain and regularly verify a register of those that have been authorised for use in such environments." controls: - id: ism-2069 class: ISM-control title: "Control: ism-2069" props: - name: sort-id value: "catalog[1].group[07].group[1].group[5].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2069_smt name: statement prose: "An authorised photographic and video recording device register for SECRET and TOP SECRET areas is developed, implemented, maintained and regularly verified." - id: ism-2070 class: ISM-control title: "Control: ism-2070" props: - name: sort-id value: "catalog[1].group[07].group[1].group[5].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2070_smt name: statement prose: Unauthorised photographic and video recording devices are not brought into SECRET and TOP SECRET areas. - title: Bringing medical devices into facilities props: - name: sort-id value: "catalog[1].group[07].group[1].group[6]" parts: - name: overview prose: "Medical devices are devices approved by the Therapeutic Goods Administration under the [Therapeutic Goods (Medical Devices) Regulations 2002](#55852ef6-7f16-4559-8235-5014c3c3fa14) for diagnostic or therapeutic purposes. The use of medical devices in SECRET and TOP SECRET areas requires active management, similar to RF devices, as they may contain communications functionality that could compromise the security of SECRET or TOP SECRET areas or systems within such areas." controls: - id: ism-2007 class: ISM-control title: "Control: ism-2007" props: - name: sort-id value: "catalog[1].group[07].group[1].group[6].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2007_smt name: statement prose: "An authorised medical device register for SECRET and TOP SECRET areas is developed, implemented, maintained and regularly verified." - id: ism-2008 class: ISM-control title: "Control: ism-2008" props: - name: sort-id value: "catalog[1].group[07].group[1].group[6].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2008_smt name: statement prose: |- Medical devices authorised to be brought into SECRET and TOP SECRET areas meet, at a minimum, the following criteria: - are listed on the Australian Register of Therapeutic Goods - have been prescribed by a legally qualified medical practitioner - have been commercially purchased within Australia - do not have inbuilt cellular connectivity - can operate independently of mobile devices - where possible, have Wi-Fi, Bluetooth and other forms of wireless connectivity disabled when operating within SECRET and TOP SECRET areas. - id: ism-2009 class: ISM-control title: "Control: ism-2009" props: - name: sort-id value: "catalog[1].group[07].group[1].group[6].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2009_smt name: statement prose: Unauthorised medical devices are not brought into SECRET and TOP SECRET areas. - title: Preventing observation by unauthorised people props: - name: sort-id value: "catalog[1].group[07].group[1].group[7]" parts: - name: overview prose: "Without sufficient perimeter security, the inside of a facility is often observable by unauthorised people, such as via direct observation or by using equipment with a telephoto lens. Ensuring systems, in particular workstation displays and keyboards, are not visible through windows, such as via the use of blinds, curtains, privacy films or workstation positioning, will assist in reducing this security risk." controls: - id: ism-0164 class: ISM-control title: "Control: ism-0164" props: - name: sort-id value: "catalog[1].group[07].group[1].group[7].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0164_smt name: statement prose: "Unauthorised people are prevented from observing systems, in particular workstation displays and keyboards, within facilities." - title: IT equipment and media props: - name: sort-id value: "catalog[1].group[07].group[2]" parts: - name: overview prose: |- # Further information Further information on the handling of IT equipment can be found in the ‘IT equipment usage’ section of the [Guidelines for information technology equipment](#db2e237c-2dbc-4a1f-bae7-9cb63a1f1dc3). Further information on the handling of media can be found in the ‘Media usage’ section of the [Guidelines for media](#b594c9c0-b42f-4f06-b643-38023275a5c7). Further information on encrypting media can be found in the ‘Cryptographic fundamentals’ section of the [Guidelines for cryptography](#195abe87-bb1e-4006-8b42-eaecca4d51f1). Further information on selecting security zones and security containers for the protection of IT equipment can be found in the Department of Home Affairs’ [Protective Security Policy Framework](#92679127-f61d-486a-a93e-df2a26dfb07a). groups: - title: Securing IT equipment and media props: - name: sort-id value: "catalog[1].group[07].group[2].group[1]" parts: - name: overview prose: |- IT equipment and media need to be secured when not in use. This can be achieved by implementing one of the following approaches: - securing IT equipment and media in an appropriate security container - using IT equipment without hard drives and sanitising memory at shut down - encrypting hard drives of IT equipment and sanitising memory at shut down - sanitising memory of IT equipment at shut down and removing and securing any hard drives. If none of the above approaches are feasible, an organisation may wish to minimise the potential impact of not securing IT equipment when not in use. This can be achieved by preventing sensitive or classified data from being stored on hard drives, storing user profiles and documents on network shares, removing temporary user data at logoff, scrubbing virtual memory at shut down, and sanitising memory at shut down. However, there is no guarantee such measures will always work effectively or will not be bypassed due to unexpected circumstances, such as the loss of power. Therefore, hard drives in such cases will retain their sensitivity or classification for the purposes of reuse, reclassification, declassification, sanitisation, destruction and disposal. controls: - id: ism-0161 class: ISM-control title: "Control: ism-0161" props: - name: sort-id value: "catalog[1].group[07].group[2].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0161_smt name: statement prose: IT equipment and media are secured when not in use. - title: Guidelines for personnel security props: - name: sort-id value: "catalog[1].group[08]" groups: - title: Cyber security awareness training props: - name: sort-id value: "catalog[1].group[08].group[1]" parts: - name: overview prose: |- # Further information Further information on telephone system usage can be found in the ‘Telephone systems’ section of the [Guidelines for communications systems](#3a7b903b-ed0d-450d-9123-60f6f8fd5dd2). Further information on multifunction device usage can be found in the ‘Multifunction devices’ section of the [Guidelines for communications systems](#3a7b903b-ed0d-450d-9123-60f6f8fd5dd2). Further information on mobile device usage can be found in the ‘Mobile device usage’ section of the [Guidelines for enterprise mobility](#9a8f5a63-bcd5-45a8-9f9c-974fc796ac95). Further information on removable media usage can be found in the ‘Media usage’ section of the [Guidelines for media](#b594c9c0-b42f-4f06-b643-38023275a5c7). Further information on email usage can be found in the ‘Email usage’ section of the [Guidelines for email](#ab73fa95-f213-4041-915e-a8ccbdf74331). Further information on web usage can be found in the ‘Web proxies’ section of the [Guidelines for gateways](#e8bde527-526c-4a6a-b66f-05228f09dd7b). Further information and training resources on privileged user training can be found on the Australian Signals Directorate’s (ASD) [Privileged User Training](#45889c11-aad2-4eef-a8fb-81e12b5ee7fe) webpage. Further information on business email compromise can be found in ASD’s [Protecting against business email compromise](#98951624-a06e-4d9a-96a3-f89ac944bcaa) publication. Further information on detecting socially engineered messages can be found in ASD’s [Detecting socially engineered messages](#efddc783-51dc-48ac-a53e-a5dd56c17fd0) publication. Further information on the use of social media can be found in ASD’s [Security tips for social media and messaging services](#63e87a07-3ac7-4cd7-a712-bb2a8150ec58) publication. Further information on [reporting cybercrime incidents](#188466f6-be12-49ce-b99a-981e54b1663e) and [reporting cyber security incidents](#626d3582-3caf-49d6-89d5-4b8fdbbf1f31), including ASD’s [limited use obligation](#cae0ac6b-e69b-4359-bfd7-5ee5eff1049d), is available from ASD. groups: - title: Providing cyber security awareness training props: - name: sort-id value: "catalog[1].group[08].group[1].group[01]" parts: - name: overview prose: "An organisation should ensure that cyber security awareness training is provided to all personnel to assist them in understanding their security responsibilities and the cyber threats they may be exposed to in the course of their duties. Furthermore, the content of cyber security awareness training should be tailored to the needs of specific groups of personnel, such as general personnel and different classes of high-risk personnel. Finally, personnel with privileged access to systems and their resources, such as application administrators, system administrators and network administrators, will require tailored privileged user training." controls: - id: ism-0252 class: ISM-control title: "Control: ism-0252" props: - name: sort-id value: "catalog[1].group[08].group[1].group[01].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0252_smt name: statement prose: |- Cyber security awareness training is undertaken annually by all personnel and covers: - the purpose of the cyber security awareness training - security appointments and contacts - authorised use of systems and their resources - protection of systems and their resources - reporting of cyber security incidents and suspected compromises of systems and their resources. - id: ism-1565 class: ISM-control title: "Control: ism-1565" props: - name: sort-id value: "catalog[1].group[08].group[1].group[01].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1565_smt name: statement prose: Tailored privileged user training is undertaken annually by all personnel with privileged access to systems and their resources. - id: ism-2022 class: ISM-control title: "Control: ism-2022" props: - name: sort-id value: "catalog[1].group[08].group[1].group[01].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2022_smt name: statement prose: "A cyber security awareness training register is developed, implemented and maintained." - title: General-purpose artificial intelligence usage policy props: - name: sort-id value: "catalog[1].group[08].group[1].group[02]" parts: - name: overview prose: "As there are security risks associated with the use of general-purpose AI applications, it is important that an organisation develops, implements and maintains a general-purpose AI usage policy governing the use of such applications by personnel." controls: - id: ism-2074 class: ISM-control title: "Control: ism-2074" props: - name: sort-id value: "catalog[1].group[08].group[1].group[02].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2074_smt name: statement prose: "A general-purpose AI usage policy is developed, implemented and maintained." - title: Web usage policy props: - name: sort-id value: "catalog[1].group[08].group[1].group[03]" parts: - name: overview prose: "As there are security risks associated with the use of web services, it is important that an organisation develops, implements and maintains a web usage policy governing its use by personnel." controls: - id: ism-0258 class: ISM-control title: "Control: ism-0258" props: - name: sort-id value: "catalog[1].group[08].group[1].group[03].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0258_smt name: statement prose: "A web usage policy is developed, implemented and maintained." - title: Managing requests to change banking details or transfer funds props: - name: sort-id value: "catalog[1].group[08].group[1].group[04]" parts: - name: overview prose: |- Business email compromise, a form of financial fraud, is when malicious actors attempt to defraud an organisation of money or assets with the assistance of a compromised email account. Malicious actors will typically attempt to achieve this via invoice fraud, employee impersonation or company impersonation. With invoice fraud, malicious actors will compromise a vendor’s email account and through it have access to legitimate invoices. Malicious actors will then amend invoices and send them to customers with the compromised email account. Customers will then pay the invoices, thinking that they are paying the vendor, but instead be sending money to malicious actors’ bank accounts. With employee impersonation, malicious actors will compromise an organisation’s email account and impersonate an employee via email. This is then used to commit financial fraud in several ways. One common method is to impersonate a person in a position of authority, such as a chief executive officer or chief financial officer, and have a false invoice raised. Another method is to request a change to an employee’s banking details. The funds from the false invoice or the employee’s salary are then sent to malicious actors’ bank accounts. With company impersonation, malicious actors register a domain with a name similar to another organisation. Malicious actors then impersonate that organisation in an email to a vendor and requests a quote for a quantity of expensive assets, such as laptop computers, and subsequently negotiate for the assets to be delivered to them prior to payment. The assets are then delivered to a location specified by malicious actors, with the invoice being sent to the legitimate organisation who never ordered or received the assets. To mitigate business email compromise, personnel should be educated to look for the following warning signs: - an unexpected request for a change of banking details - an urgent payment request, or threats of serious consequences if payment is not made - unexpected payment requests from a person in a position of authority, particularly if payment requests are unusual from this person - an email received from a suspicious email address, such as an email address not matching an organisation’s name. In dealing with such situations, personnel should have clear guidance to verify bank account details; think critically before actioning unusual payment requests; and have a process to report threatening demands for immediate action, pressure for secrecy, or requests to circumvent normal business processes and procedures. controls: - id: ism-1740 class: ISM-control title: "Control: ism-1740" props: - name: sort-id value: "catalog[1].group[08].group[1].group[04].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1740_smt name: statement prose: Personnel dealing with banking details and payment requests are advised of what business email compromise is and how to manage and report it. - title: Managing requests to modify user accounts props: - name: sort-id value: "catalog[1].group[08].group[1].group[05]" parts: - name: overview prose: |- Requests to modify user accounts, such as resetting a password, changing a mobile phone number or email address, temporarily disabling multi-factor authentication, or re-enrolling for multi-factor authentication, could indicate a malicious actor attempting to conduct a help desk attack. In dealing with such situations, personnel should have clear guidance to think critically before actioning unusual requests as well as a process to report threatening demands for immediate action, pressure for secrecy or requests to circumvent normal business processes and procedures. controls: - id: ism-2071 class: ISM-control title: "Control: ism-2071" props: - name: sort-id value: "catalog[1].group[08].group[1].group[05].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2071_smt name: statement prose: "Personnel dealing with user account details are advised of what social engineering attacks are, how to manage such situations and how to report them." - title: Synthetic impersonation props: - name: sort-id value: "catalog[1].group[08].group[1].group[06]" parts: - name: overview prose: "Advances in artificial intelligence (AI) now allow malicious actors to convincingly impersonate executives, employees and customers using synthetic voice and video. As such, personnel dealing with user account details, banking details or financial transactions should not rely on voice or video alone to authenticate requests to modify user account details, modify banking details or conduct financial transactions. Instead, individuals should first be positively identified using a pre-established authentication method or independent trusted communications channel. Such mechanisms may include digitally signed approvals or in-built system approval mechanisms protected by phishing-resistant multi-factor authentication." controls: - id: ism-2126 class: ISM-control title: "Control: ism-2126" props: - name: sort-id value: "catalog[1].group[08].group[1].group[06].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2126_smt name: statement prose: "Personnel positively identify requestors using a pre-established authentication method or independent trusted communication channel before actioning requests to modify user account details, modify banking details or conduct financial transactions." - title: Reporting suspicious contact via online services props: - name: sort-id value: "catalog[1].group[08].group[1].group[07]" parts: - name: overview prose: "Online services, such as email, internet forums, messaging apps and direct messaging on social media, can be used by malicious actors to elicit sensitive or classified information from personnel. As such, personnel should be advised of what suspicious contact via online services is and how to report it." controls: - id: ism-0817 class: ISM-control title: "Control: ism-0817" props: - name: sort-id value: "catalog[1].group[08].group[1].group[07].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jan-20 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0817_smt name: statement prose: Personnel are advised of what suspicious contact via online services is and how to report it. - title: Posting work-related information on online services props: - name: sort-id value: "catalog[1].group[08].group[1].group[08]" parts: - name: overview prose: "Personnel should be advised to take particular care not to post work-related information on online services unless authorised to do so, especially for chat services, internet forums, social media and AI tools. Even information that appears to be benign in isolation could, along with other information, have a considerable security impact or lead to increased targeting by malicious actors." controls: - id: ism-0820 class: ISM-control title: "Control: ism-0820" props: - name: sort-id value: "catalog[1].group[08].group[1].group[08].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0820_smt name: statement prose: "Personnel are advised not to post work-related information on unauthorised online services, and to report cases where such information is posted." - id: ism-2104 class: ISM-control title: "Control: ism-2104" props: - name: sort-id value: "catalog[1].group[08].group[1].group[08].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2104_smt name: statement prose: "Personnel are advised not to post information about their security clearance and briefings on unauthorised online services, and to report cases where such information is posted." - id: ism-2105 class: ISM-control title: "Control: ism-2105" props: - name: sort-id value: "catalog[1].group[08].group[1].group[08].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2105_smt name: statement prose: "Personnel are advised to limit posting information about their work-related duties on unauthorised online services, and to report cases where such information is posted." - id: ism-2106 class: ISM-control title: "Control: ism-2106" props: - name: sort-id value: "catalog[1].group[08].group[1].group[08].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2106_smt name: statement prose: "Personnel are advised to limit posting information about their work-related skills and experience on unauthorised online services, and to report cases where such information is posted." - title: Posting personal information on online services props: - name: sort-id value: "catalog[1].group[08].group[1].group[09]" parts: - name: overview prose: |- Personnel should be advised that any personal information they post on online services, such as social media, could be used by malicious actors to develop a detailed understanding of their lifestyle and interests. In turn, this information could be used to build trust to elicit sensitive or classified information from them, or influence them to undertake specific actions, such as opening malicious email attachments or visiting malicious websites. In addition, personnel posting information on their movements and activities could allow malicious actors to time attempted financial fraud to align with when their target, if in a position of authority, would be uncontactable, such as attending meetings or travelling. Furthermore, to ensure that personal opinions are not misinterpreted as the official position of an organisation they work for, personnel should maintain separate personal user accounts from any work user accounts they use for online services, especially for social media. Finally, encouraging personnel to use any available privacy settings for online services can reduce security risks by restricting who can view their personal information, as well as their interactions with online services. controls: - id: ism-0821 class: ISM-control title: "Control: ism-0821" props: - name: sort-id value: "catalog[1].group[08].group[1].group[09].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0821_smt name: statement prose: Personnel are advised of security risks associated with posting personal information on online services. - id: ism-1146 class: ISM-control title: "Control: ism-1146" props: - name: sort-id value: "catalog[1].group[08].group[1].group[09].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1146_smt name: statement prose: Personnel are advised to maintain separate personal user accounts from any work user accounts they use for online services. - id: ism-2107 class: ISM-control title: "Control: ism-2107" props: - name: sort-id value: "catalog[1].group[08].group[1].group[09].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2107_smt name: statement prose: Personnel are encouraged to use any available privacy settings to restrict who can view personal information they post on online services. - title: Sending and receiving files via online services props: - name: sort-id value: "catalog[1].group[08].group[1].group[10]" parts: - name: overview prose: "When personnel send and receive files via unauthorised online services, such as messaging apps and social media, they often bypass security controls put in place to detect and quarantine malicious code. Advising personnel to send and receive files via authorised online services instead will ensure files are appropriately protected and scanned for malicious code." controls: - id: ism-0824 class: ISM-control title: "Control: ism-0824" props: - name: sort-id value: "catalog[1].group[08].group[1].group[10].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0824_smt name: statement prose: Personnel are advised not to send or receive files via unauthorised online services. - title: Guidelines for communications infrastructure props: - name: sort-id value: "catalog[1].group[09]" groups: - title: Cabling infrastructure props: - name: sort-id value: "catalog[1].group[09].group[1]" parts: - name: overview prose: |- # Context This section applies only to facilities located within Australia. In doing so, it covers common security controls for both single-tenant and shared facilities, and specific security controls for only shared facilities, such as a single floor or part of a floor within a multi-tenanted building. For the purposes of this section, a cable is defined as any fibre optic or copper material housed within a protective sheath for the purposes of transmitting data or control signals from one point in a facility to another. Each cable will form part of a structured cabling system and will need to comply with the Australian Standards associated with that system. In addition to network communications and data systems, some common building management structured cabling systems found within facilities include: - fire control and sensor systems - security control and surveillance systems - lighting control systems - access control systems - voice and emergency telephony systems - emergency control alert systems. Finally, protective sheaths for cables are not considered a conduit and the same cable connector types can be used for all systems within a facility regardless of their sensitivity or classification. # Further information [Australian cabling standards](#85c9b592-8734-4860-8243-ac0821f78854) can be obtained from the Australian Communications and Media Authority. Further information on SCEC-approved tamper-evident seals can be found on the SCEC’s [Security Equipment Evaluated Products List](#f7e13f7b-eb48-4294-bd01-9c22c756d96b). Further information on audio secure rooms can be found in the Department of Home Affairs’ [Protective Security Policy Framework](#92679127-f61d-486a-a93e-df2a26dfb07a). groups: - title: Cabling infrastructure standards props: - name: sort-id value: "catalog[1].group[09].group[1].group[01]" parts: - name: overview prose: Cabling infrastructure should be installed by an endorsed cable installer to the relevant Australian Standards to ensure personnel safety and system availability. controls: - id: ism-0181 class: ISM-control title: "Control: ism-0181" props: - name: sort-id value: "catalog[1].group[09].group[1].group[01].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0181_smt name: statement prose: "Cabling infrastructure is installed in accordance with relevant Australian Standards, as directed by the Australian Communications and Media Authority." - title: Use of fibre-optic cables props: - name: sort-id value: "catalog[1].group[09].group[1].group[02]" parts: - name: overview prose: "Fibre-optic cables do not produce electromagnetic emanations and are not influenced by them. As a result, they offer the highest degree of protection from electromagnetic emanation effects." controls: - id: ism-1111 class: ISM-control title: "Control: ism-1111" props: - name: sort-id value: "catalog[1].group[09].group[1].group[02].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1111_smt name: statement prose: Fibre-optic cables are used for cabling infrastructure instead of copper cables. - title: Cable register props: - name: sort-id value: "catalog[1].group[09].group[1].group[03]" parts: - name: overview prose: "Developing, implementing, maintaining and regularly verifying cable registers assists installers and inspectors, with the help of floor plan diagrams, to trace cables for malicious or accidental changes or damage. In doing so, cable registers should track all cabling changes throughout the life of a system." controls: - id: ism-0211 class: ISM-control title: "Control: ism-0211" props: - name: sort-id value: "catalog[1].group[09].group[1].group[03].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0211_smt name: statement prose: "A cable register is developed, implemented, maintained and regularly verified." - id: ism-0208 class: ISM-control title: "Control: ism-0208" props: - name: sort-id value: "catalog[1].group[09].group[1].group[03].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0208_smt name: statement prose: |- A cable register contains the following for each cable: - cable identifier - cable colour - sensitivity/classification - source - destination - location - seal numbers (if applicable). - title: Floor plan diagrams props: - name: sort-id value: "catalog[1].group[09].group[1].group[04]" parts: - name: overview prose: "Floor plan diagrams that are developed using computer-aided design and drafting applications, and use alphanumeric grid referencing, can provide an accurate scaled view for each floor and are critical to ensuring that cabling infrastructure components can be easily located by installers and inspectors. In doing so, floor plan diagrams should track all cabling infrastructure changes throughout the life of a system." controls: - id: ism-1645 class: ISM-control title: "Control: ism-1645" props: - name: sort-id value: "catalog[1].group[09].group[1].group[04].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1645_smt name: statement prose: "Floor plan diagrams are developed, implemented, maintained and regularly verified." - id: ism-1646 class: ISM-control title: "Control: ism-1646" props: - name: sort-id value: "catalog[1].group[09].group[1].group[04].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1646_smt name: statement prose: |- Floor plan diagrams contain the following: - cable paths (including ingress and egress points between floors) - cable reticulation system and conduit paths - floor concentration boxes - wall outlet boxes - network cabinets. - title: Cable labelling processes and procedures props: - name: sort-id value: "catalog[1].group[09].group[1].group[05]" parts: - name: overview prose: Well-documented cable labelling processes and procedures can make cable verification and fault finding easier. controls: - id: ism-0206 class: ISM-control title: "Control: ism-0206" props: - name: sort-id value: "catalog[1].group[09].group[1].group[05].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0206_smt name: statement prose: "Cable labelling processes, and supporting cable labelling procedures, are developed, implemented and maintained." - title: Labelling cables props: - name: sort-id value: "catalog[1].group[09].group[1].group[06]" parts: - name: overview prose: Labelling cables with the correct source and destination details minimises the likelihood of cross-patching and aids in fault finding and configuration management. controls: - id: ism-1096 class: ISM-control title: "Control: ism-1096" props: - name: sort-id value: "catalog[1].group[09].group[1].group[06].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Oct-19 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1096_smt name: statement prose: Cables are labelled at each end with sufficient source and destination details to enable the physical identification and inspection of the cable. - title: Labelling building management cables props: - name: sort-id value: "catalog[1].group[09].group[1].group[07]" parts: - name: overview prose: "All facilities will contain structured cabling systems to support building management and control functions. As Australian Standards require some structured cabling systems to use specified colours, such as red for fire control systems, it is important that all building management cables are appropriately labelled." controls: - id: ism-1639 class: ISM-control title: "Control: ism-1639" props: - name: sort-id value: "catalog[1].group[09].group[1].group[07].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1639_smt name: statement prose: "Building management cables are labelled with their purpose in black writing on a yellow background, with a minimum size of 2.5 cm x 1 cm, and attached at five-metre intervals." - title: Labelling cables for foreign systems in Australian facilities props: - name: sort-id value: "catalog[1].group[09].group[1].group[08]" parts: - name: overview prose: Labelling cables for foreign systems in Australian facilities helps prevent unintended cross-patching of Australian and foreign systems. controls: - id: ism-1640 class: ISM-control title: "Control: ism-1640" props: - name: sort-id value: "catalog[1].group[09].group[1].group[08].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1640_smt name: statement prose: Cables for foreign systems installed in Australian facilities are labelled at inspection points. - title: Cable colours props: - name: sort-id value: "catalog[1].group[09].group[1].group[09]" parts: - name: overview prose: "To avoid confusion, it is important that, regardless of the type of cabling involved, a consistent cable colour is used. Furthermore, the use of designated cable colours can provide an easy way to distinguish cables for SECRET and TOP SECRET systems from cables for other systems. For example, while SECRET and TOP SECRET cables have designated cable colours, cables for other systems may be any colour except for those reserved for SECRET and TOP SECRET systems. In addition, cable colours for other systems, such as non-classified, OFFICIAL: Sensitive and PROTECTED systems, may use the same colour, such as blue." controls: - id: ism-1820 class: ISM-control title: "Control: ism-1820" props: - name: sort-id value: "catalog[1].group[09].group[1].group[09].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1820_smt name: statement prose: Cables for individual systems use a consistent colour. - id: ism-0926 class: ISM-control title: "Control: ism-0926" props: - name: sort-id value: "catalog[1].group[09].group[1].group[09].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "11" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P parts: - id: ism-0926_smt name: statement prose: "Non-classified, OFFICIAL: Sensitive and PROTECTED cables are coloured neither salmon pink nor red." - id: ism-1718 class: ISM-control title: "Control: ism-1718" props: - name: sort-id value: "catalog[1].group[09].group[1].group[09].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S parts: - id: ism-1718_smt name: statement prose: SECRET cables are coloured salmon pink. - id: ism-1719 class: ISM-control title: "Control: ism-1719" props: - name: sort-id value: "catalog[1].group[09].group[1].group[09].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1719_smt name: statement prose: TOP SECRET cables are coloured red. - title: Cable colour non-conformance props: - name: sort-id value: "catalog[1].group[09].group[1].group[10]" parts: - name: overview prose: "In certain circumstances, it may not be possible to use the correct colour for SECRET or TOP SECRET cables. In such cases, an organisation should band such cables with the appropriate colour and ensure that the cable bands are easily visible at inspection points. In doing so, it is important that cable bands are robust enough to stand the test of time. Examples of appropriate cable bands include stick-on coloured labels, colour heat shrink, coloured ferrules or short lengths of banded conduit." controls: - id: ism-1216 class: ISM-control title: "Control: ism-1216" props: - name: sort-id value: "catalog[1].group[09].group[1].group[10].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1216_smt name: statement prose: SECRET and TOP SECRET cables with non-conformant cable colouring are banded with the appropriate colour and labelled at inspection points. - title: Cable inspectability props: - name: sort-id value: "catalog[1].group[09].group[1].group[11]" parts: - name: overview prose: "The ability to inspect cabling infrastructure is necessary to detect illicit tampering or degradation. This does not mean that cables need to be fully visible all the time. Rather, cable inspectability can be achieved if cables can be viewed and inspected through the easy removal of ceiling, floor or wall panels or manholes." controls: - id: ism-1112 class: ISM-control title: "Control: ism-1112" props: - name: sort-id value: "catalog[1].group[09].group[1].group[11].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S parts: - id: ism-1112_smt name: statement prose: Cables in non-TOP SECRET areas are inspectable every five metres or less. - id: ism-1119 class: ISM-control title: "Control: ism-1119" props: - name: sort-id value: "catalog[1].group[09].group[1].group[11].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1119_smt name: statement prose: Cables in TOP SECRET areas are fully inspectable for their entire length. - title: Common cable bundles and conduits props: - name: sort-id value: "catalog[1].group[09].group[1].group[12]" parts: - name: overview prose: "In some circumstances, cables for different systems can be bundled together or run in a common conduit to reduce costs, such as cables for OFFICIAL: Sensitive and PROTECTED systems." controls: - id: ism-0187 class: ISM-control title: "Control: ism-0187" props: - name: sort-id value: "catalog[1].group[09].group[1].group[12].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S parts: - id: ism-0187_smt name: statement prose: "SECRET cables, when bundled together or run in conduit, are run exclusively in their own individual cable bundle or conduit." - id: ism-1821 class: ISM-control title: "Control: ism-1821" props: - name: sort-id value: "catalog[1].group[09].group[1].group[12].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1821_smt name: statement prose: "TOP SECRET cables, when bundled together or run in conduit, are run exclusively in their own individual cable bundle or conduit." - title: Common cable reticulation systems props: - name: sort-id value: "catalog[1].group[09].group[1].group[13]" parts: - name: overview prose: "When cable reticulation systems are used for more than one cable bundle or conduit, it is important that there is a dividing partition or visible gap between cable bundles and conduits to facilitate easier cable inspection." controls: - id: ism-1114 class: ISM-control title: "Control: ism-1114" props: - name: sort-id value: "catalog[1].group[09].group[1].group[13].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1114_smt name: statement prose: Cable bundles or conduits sharing a common cable reticulation system have a dividing partition or visible gap between each cable bundle and conduit. - title: Enclosed cable reticulation systems props: - name: sort-id value: "catalog[1].group[09].group[1].group[14]" parts: - name: overview prose: "In shared facilities, cables should be enclosed in a sealed cable reticulation system to prevent access and enhance cable management." controls: - id: ism-1130 class: ISM-control title: "Control: ism-1130" props: - name: sort-id value: "catalog[1].group[09].group[1].group[14].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1130_smt name: statement prose: "In shared facilities, cables are run in an enclosed cable reticulation system." - title: Covers for enclosed cable reticulation systems props: - name: sort-id value: "catalog[1].group[09].group[1].group[15]" parts: - name: overview prose: "In shared facilities, clear covers on enclosed cable reticulation systems are a convenient method of maintaining inspection requirements. Having clear covers that face inwards increases their inspectability." controls: - id: ism-1164 class: ISM-control title: "Control: ism-1164" props: - name: sort-id value: "catalog[1].group[09].group[1].group[15].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1164_smt name: statement prose: "In shared facilities, conduits or the front covers of ducts, cable trays in floors and ceilings, and associated fittings are clear plastic." - title: Sealing cable reticulation systems and conduits props: - name: sort-id value: "catalog[1].group[09].group[1].group[16]" parts: - name: overview prose: "In shared facilities, uniquely identifiable Security Construction and Equipment Committee (SCEC)-approved tamper-evident seals should be used to provide evidence of any tampering or illicit access to TOP SECRET cable reticulation systems. In addition, TOP SECRET conduits should be sealed with a visible smear of conduit glue to prevent access." controls: - id: ism-0195 class: ISM-control title: "Control: ism-0195" props: - name: sort-id value: "catalog[1].group[09].group[1].group[16].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0195_smt name: statement prose: "In shared facilities, uniquely identifiable SCEC-approved tamper-evident seals are used to seal all removable covers on TOP SECRET cable reticulation systems." - id: ism-0194 class: ISM-control title: "Control: ism-0194" props: - name: sort-id value: "catalog[1].group[09].group[1].group[16].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0194_smt name: statement prose: "In shared facilities, a visible smear of conduit glue is used to seal all plastic conduit joints and TOP SECRET conduits connected by threaded lock nuts." - title: Labelling conduits props: - name: sort-id value: "catalog[1].group[09].group[1].group[17]" parts: - name: overview prose: Labels for TOP SECRET conduits should be of sufficient size and colour to enable easy identification. controls: - id: ism-0201 class: ISM-control title: "Control: ism-0201" props: - name: sort-id value: "catalog[1].group[09].group[1].group[17].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0201_smt name: statement prose: "Labels for TOP SECRET conduits are a minimum size of 2.5 cm x 1 cm, attached at five-metre intervals and marked as ‘TS RUN’." - title: Cables in walls props: - name: sort-id value: "catalog[1].group[09].group[1].group[18]" parts: - name: overview prose: Cables run correctly in walls enable neater installations while maintaining separation and inspection requirements. controls: - id: ism-1115 class: ISM-control title: "Control: ism-1115" props: - name: sort-id value: "catalog[1].group[09].group[1].group[18].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-19 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1115_smt name: statement prose: Cables from cable trays to wall outlet boxes are run in flexible or plastic conduit. - title: Cables in party walls props: - name: sort-id value: "catalog[1].group[09].group[1].group[19]" parts: - name: overview prose: "In shared facilities, TOP SECRET cables are not run in party walls. However, an inner wall can be used to run TOP SECRET cables where sufficient space exists for their inspection." controls: - id: ism-1133 class: ISM-control title: "Control: ism-1133" props: - name: sort-id value: "catalog[1].group[09].group[1].group[19].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1133_smt name: statement prose: "In shared facilities, TOP SECRET cables are not run in party walls." - title: Wall penetrations props: - name: sort-id value: "catalog[1].group[09].group[1].group[20]" parts: - name: overview prose: "Penetrating a wall between a TOP SECRET area and a lower classified area requires the integrity of the TOP SECRET area to be maintained. In such scenarios, TOP SECRET cables should be encased in conduit with all gaps between the TOP SECRET conduit and the wall filled with an appropriate sealing compound." controls: - id: ism-1122 class: ISM-control title: "Control: ism-1122" props: - name: sort-id value: "catalog[1].group[09].group[1].group[20].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1122_smt name: statement prose: "Where wall penetrations exit a TOP SECRET area into a lower classified area, TOP SECRET cables are encased in conduit with all gaps between the TOP SECRET conduit and the wall filled with an appropriate sealing compound." - title: Wall outlet boxes props: - name: sort-id value: "catalog[1].group[09].group[1].group[21]" parts: - name: overview prose: Wall outlet boxes are the main method of connecting cabling infrastructure to workstations. They enable the management of cables and the types of connectors allocated to various systems. controls: - id: ism-1105 class: ISM-control title: "Control: ism-1105" props: - name: sort-id value: "catalog[1].group[09].group[1].group[21].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1105_smt name: statement prose: SECRET and TOP SECRET wall outlet boxes contain exclusively SECRET or TOP SECRET cables. - title: Labelling wall outlet boxes props: - name: sort-id value: "catalog[1].group[09].group[1].group[22]" parts: - name: overview prose: "Clear labelling of wall outlet boxes diminishes the possibility of incorrectly attaching information technology (IT) equipment to the wrong wall outlet box. In cases where a wall outlet box contains cables for different systems, each connector should be individually labelled." controls: - id: ism-1095 class: ISM-control title: "Control: ism-1095" props: - name: sort-id value: "catalog[1].group[09].group[1].group[22].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1095_smt name: statement prose: "Wall outlet boxes denote the systems, cable identifiers and wall outlet box identifier." - title: Wall outlet box colours props: - name: sort-id value: "catalog[1].group[09].group[1].group[23]" parts: - name: overview prose: "The use of designated wall outlet box colours can provide an easy way to distinguish wall outlet boxes for SECRET and TOP SECRET systems from wall outlet boxes for other systems. For example, while SECRET and TOP SECRET wall outlet boxes have designated wall outlet box colours, wall outlet boxes for other systems may be any colour except for those reserved for SECRET and TOP SECRET systems. In addition, wall outlet box colours for other systems, such as non-classified, OFFICIAL: Sensitive and PROTECTED systems, may use the same colour, such as blue. Ideally, wall outlet boxes should be the same colour that is used for associated cabling." controls: - id: ism-1822 class: ISM-control title: "Control: ism-1822" props: - name: sort-id value: "catalog[1].group[09].group[1].group[23].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1822_smt name: statement prose: Wall outlet boxes for individual systems use a consistent colour. - id: ism-1107 class: ISM-control title: "Control: ism-1107" props: - name: sort-id value: "catalog[1].group[09].group[1].group[23].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P parts: - id: ism-1107_smt name: statement prose: "Non-classified, OFFICIAL: Sensitive and PROTECTED wall outlet boxes are coloured neither salmon pink nor red." - id: ism-1720 class: ISM-control title: "Control: ism-1720" props: - name: sort-id value: "catalog[1].group[09].group[1].group[23].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S parts: - id: ism-1720_smt name: statement prose: SECRET wall outlet boxes are coloured salmon pink. - id: ism-1721 class: ISM-control title: "Control: ism-1721" props: - name: sort-id value: "catalog[1].group[09].group[1].group[23].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1721_smt name: statement prose: TOP SECRET wall outlet boxes are coloured red. - title: Wall outlet box covers props: - name: sort-id value: "catalog[1].group[09].group[1].group[24]" parts: - name: overview prose: Transparent wall outlet box covers enable the identification of cable cross-patching and signs of tampering. controls: - id: ism-1109 class: ISM-control title: "Control: ism-1109" props: - name: sort-id value: "catalog[1].group[09].group[1].group[24].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-19 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1109_smt name: statement prose: Wall outlet box covers are clear plastic. - title: Fly lead installation props: - name: sort-id value: "catalog[1].group[09].group[1].group[25]" parts: - name: overview prose: "Keeping the lengths of TOP SECRET fibre-optic fly leads to a minimum prevents clutter around desks, prevents damage, and reduces the chance of cross-patching and tampering. If lengths become excessive, TOP SECRET fibre-optic fly leads should be treated as cabling infrastructure and run in TOP SECRET conduit or fixed infrastructure, such as desk partitioning." controls: - id: ism-0218 class: ISM-control title: "Control: ism-0218" props: - name: sort-id value: "catalog[1].group[09].group[1].group[25].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0218_smt name: statement prose: "If TOP SECRET fibre-optic fly leads exceeding five metres in length are used to connect wall outlet boxes to IT equipment, they are run in a protective and easily inspected pathway that is clearly labelled at the IT equipment end with the wall outlet box’s identifier." - title: Connecting cable reticulation systems to cabinets props: - name: sort-id value: "catalog[1].group[09].group[1].group[26]" parts: - name: overview prose: Controlling the routing from cable reticulation systems to cabinets can assist in preventing unauthorised modifications and tampering while also providing easy inspection of cables. controls: - id: ism-1102 class: ISM-control title: "Control: ism-1102" props: - name: sort-id value: "catalog[1].group[09].group[1].group[26].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1102_smt name: statement prose: Cable reticulation systems leading into cabinets are terminated as close as possible to the cabinet. - id: ism-1101 class: ISM-control title: "Control: ism-1101" props: - name: sort-id value: "catalog[1].group[09].group[1].group[26].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1101_smt name: statement prose: "In TOP SECRET areas, cable reticulation systems leading into cabinets in server rooms or communications rooms are terminated as close as possible to the cabinet." - id: ism-1103 class: ISM-control title: "Control: ism-1103" props: - name: sort-id value: "catalog[1].group[09].group[1].group[26].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1103_smt name: statement prose: "In TOP SECRET areas, cable reticulation systems leading into cabinets not in server rooms or communications rooms are terminated at the boundary of the cabinet." - title: Terminating cables in cabinets props: - name: sort-id value: "catalog[1].group[09].group[1].group[27]" parts: - name: overview prose: Having individual or divided cabinets can assist in preventing accidental or deliberate cross-patching and makes inspection of cables easier. controls: - id: ism-1098 class: ISM-control title: "Control: ism-1098" props: - name: sort-id value: "catalog[1].group[09].group[1].group[27].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S parts: - id: ism-1098_smt name: statement prose: "SECRET cables are terminated in an individual cabinet; or for small systems, a cabinet with a division plate between any SECRET cables and non-SECRET cables." - id: ism-1100 class: ISM-control title: "Control: ism-1100" props: - name: sort-id value: "catalog[1].group[09].group[1].group[27].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1100_smt name: statement prose: TOP SECRET cables are terminated in an individual TOP SECRET cabinet. - title: Terminating cables on patch panels props: - name: sort-id value: "catalog[1].group[09].group[1].group[28]" parts: - name: overview prose: Terminating SECRET and TOP SECRET cables on different patch panels in cabinets can assist in preventing accidental or deliberate cross-patching and makes inspection of cables easier. controls: - id: ism-0213 class: ISM-control title: "Control: ism-0213" props: - name: sort-id value: "catalog[1].group[09].group[1].group[28].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0213_smt name: statement prose: SECRET and TOP SECRET cables are terminated on their own individual patch panels. - title: Physical separation of cabinets and patch panels props: - name: sort-id value: "catalog[1].group[09].group[1].group[29]" parts: - name: overview prose: Physical separation between TOP SECRET systems and non-TOP SECRET systems reduces the chance of cross-patching. This reduces the possibility of unauthorised personnel gaining access to TOP SECRET systems. controls: - id: ism-0216 class: ISM-control title: "Control: ism-0216" props: - name: sort-id value: "catalog[1].group[09].group[1].group[29].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0216_smt name: statement prose: TOP SECRET patch panels are installed in individual TOP SECRET cabinets. - id: ism-0217 class: ISM-control title: "Control: ism-0217" props: - name: sort-id value: "catalog[1].group[09].group[1].group[29].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0217_smt name: statement prose: |- Where spatial constraints demand non-TOP SECRET patch panels be installed in the same cabinet as a TOP SECRET patch panel: - a physical barrier in the cabinet is provided to separate patch panels - only personnel holding a Positive Vetting security clearance have access to the cabinet - approval from the TOP SECRET system’s authorising officer is obtained prior to installation. - id: ism-1116 class: ISM-control title: "Control: ism-1116" props: - name: sort-id value: "catalog[1].group[09].group[1].group[29].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1116_smt name: statement prose: A visible gap exists between TOP SECRET cabinets and non-TOP SECRET cabinets. - title: Audio secure rooms props: - name: sort-id value: "catalog[1].group[09].group[1].group[30]" parts: - name: overview prose: Audio secure rooms are designed to prevent audio conversations from being overheard. The Australian Security Intelligence Organisation should be consulted before any modifications are made to TOP SECRET audio secure rooms. controls: - id: ism-0198 class: ISM-control title: "Control: ism-0198" props: - name: sort-id value: "catalog[1].group[09].group[1].group[30].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0198_smt name: statement prose: "When penetrating a TOP SECRET audio secure room, the Australian Security Intelligence Organisation is consulted and all directions provided are complied with." - title: Power reticulation props: - name: sort-id value: "catalog[1].group[09].group[1].group[31]" parts: - name: overview prose: It is important that TOP SECRET systems have control over the power system to prevent denial of service by deliberate or accidental means. controls: - id: ism-1123 class: ISM-control title: "Control: ism-1123" props: - name: sort-id value: "catalog[1].group[09].group[1].group[31].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1123_smt name: statement prose: A power distribution board with a feed from an Uninterruptible Power Supply is used to power all TOP SECRET IT equipment. - title: Emanation security props: - name: sort-id value: "catalog[1].group[09].group[2]" groups: - title: Electromagnetic interference/electromagnetic compatibility standards props: - name: sort-id value: "catalog[1].group[09].group[2].group[1]" parts: - name: overview prose: All IT equipment used by systems will need to meet industry and government standards relating to electromagnetic interference/electromagnetic compatibility. controls: - id: ism-0250 class: ISM-control title: "Control: ism-0250" props: - name: sort-id value: "catalog[1].group[09].group[2].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0250_smt name: statement prose: IT equipment meets industry and government standards relating to electromagnetic interference/electromagnetic compatibility. - title: Emanation security doctrine props: - name: sort-id value: "catalog[1].group[09].group[2].group[2]" parts: - name: overview prose: "The Australian Signals Directorate (ASD) specifies emanation security requirements in its Emanation security manual and Australian Communications Security Instructions that must be complied with. Such requirements supplement these guidelines and, where conflicts occur, take precedence." controls: - id: ism-1884 class: ISM-control title: "Control: ism-1884" props: - name: sort-id value: "catalog[1].group[09].group[2].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1884_smt name: statement prose: Emanation security doctrine produced by ASD for the management of emanation security matters is complied with. - title: Emanation security risk assessments props: - name: sort-id value: "catalog[1].group[09].group[2].group[3]" parts: - name: overview prose: |- Obtaining advice from ASD on emanation security risks is vital to protecting SECRET and TOP SECRET systems, inside and outside of Australian borders. This can assist in preventing SECRET and TOP SECRET systems from emanating compromising signals, which if intercepted and analysed, could lead to serious consequences. The implementation of such advice is in addition to, and not a replacement for, industry and government standards relating to electromagnetic interference/electromagnetic compatibility. In conducting emanation security risk assessments, it is important that they are sought by system owners as early as possible in a system’s life cycle as development timeframes and costs will be much greater if changes need to be made to systems once they have been designed and implemented. On completion of emanation security risk assessments, system owners will receive emanation security mitigation advice that contains recommended actions to be taken to reduce emanation security risks. In doing so, any recommendations not implemented by system owners will need to be accepted by a system’s authorising officer. controls: - id: ism-1137 class: ISM-control title: "Control: ism-1137" props: - name: sort-id value: "catalog[1].group[09].group[2].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1137_smt name: statement prose: System owners deploying SECRET or TOP SECRET systems within fixed facilities contact ASD for an emanation security risk assessment. - id: ism-0249 class: ISM-control title: "Control: ism-0249" props: - name: sort-id value: "catalog[1].group[09].group[2].group[3].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0249_smt name: statement prose: "System owners deploying SECRET or TOP SECRET systems in mobile platforms, or as a deployable capability, contact ASD for an emanation security risk assessment." - id: ism-0246 class: ISM-control title: "Control: ism-0246" props: - name: sort-id value: "catalog[1].group[09].group[2].group[3].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0246_smt name: statement prose: "When an emanation security risk assessment is required, it is sought as early as possible in a system’s life cycle." - id: ism-1885 class: ISM-control title: "Control: ism-1885" props: - name: sort-id value: "catalog[1].group[09].group[2].group[3].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1885_smt name: statement prose: Recommended actions contained within emanation security mitigation advice issued for systems are implemented by system owners. - title: Guidelines for communications systems props: - name: sort-id value: "catalog[1].group[10]" groups: - title: Telephone systems props: - name: sort-id value: "catalog[1].group[10].group[1]" parts: - name: overview prose: |- # Further information Further information on encrypting communications can be found in the ‘Cryptographic fundamentals’ section of the [Guidelines for cryptography](#195abe87-bb1e-4006-8b42-eaecca4d51f1). groups: - title: Telephone system usage policy props: - name: sort-id value: "catalog[1].group[10].group[1].group[1]" parts: - name: overview prose: All non-secure telephone systems are subject to interception. Personnel accidentally or maliciously communicating sensitive or classified information over a public telephone network can lead to its compromise. controls: - id: ism-1078 class: ISM-control title: "Control: ism-1078" props: - name: sort-id value: "catalog[1].group[10].group[1].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1078_smt name: statement prose: "A telephone system usage policy is developed, implemented and maintained." - title: Personnel awareness props: - name: sort-id value: "catalog[1].group[10].group[1].group[2]" parts: - name: overview prose: |- As there is a potential for unintended disclosure of information when using telephone systems, personnel should be made aware of the sensitivity or classification of information that may be discussed when using them. In addition, personnel should also be made aware of the security risks associated with the use of non-secure telephone systems in areas where sensitive or classified conversations may occur. When using cryptographic equipment to enable different levels of conversation for different kinds of connections, providing a visual indication to personnel as to the sensitivity or classification of information that can be discussed over the telephone system can assist in reducing the likelihood of unintended disclosure of information. controls: - id: ism-0229 class: ISM-control title: "Control: ism-0229" props: - name: sort-id value: "catalog[1].group[10].group[1].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0229_smt name: statement prose: Personnel are advised of the permitted sensitivity or classification of information that can be discussed over internal and external telephone systems. - id: ism-0230 class: ISM-control title: "Control: ism-0230" props: - name: sort-id value: "catalog[1].group[10].group[1].group[2].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0230_smt name: statement prose: Personnel are advised of security risks posed by non-secure telephone systems in areas where sensitive or classified conversations can occur. - id: ism-0231 class: ISM-control title: "Control: ism-0231" props: - name: sort-id value: "catalog[1].group[10].group[1].group[2].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0231_smt name: statement prose: "When using cryptographic equipment to permit different levels of conversation for different kinds of connections, telephone systems give a visual indication of what kind of connection has been made." - title: Protecting conversations props: - name: sort-id value: "catalog[1].group[10].group[1].group[3]" parts: - name: overview prose: "When sensitive or classified conversations are held using telephone systems, the conversation needs to be appropriately protected by using encryption." controls: - id: ism-0232 class: ISM-control title: "Control: ism-0232" props: - name: sort-id value: "catalog[1].group[10].group[1].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0232_smt name: statement prose: Telephone systems used for sensitive or classified conversations encrypt all traffic that passes over external systems. - title: Cordless telephone systems props: - name: sort-id value: "catalog[1].group[10].group[1].group[4]" parts: - name: overview prose: "Cordless telephone handsets and headsets typically have minimal transmission security and are susceptible to interception. This may result in the disclosure of sensitive or classified conversations to malicious actors unless suitable encryption is used. As such, it is critical that Australian Signals Directorate (ASD)-approved cryptography is used." controls: - id: ism-0233 class: ISM-control title: "Control: ism-0233" props: - name: sort-id value: "catalog[1].group[10].group[1].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0233_smt name: statement prose: Cordless telephone handsets and headsets are not used for sensitive or classified conversations unless all communications are encrypted using ASD-approved cryptography. - title: Speakerphones props: - name: sort-id value: "catalog[1].group[10].group[1].group[5]" parts: - name: overview prose: "As speakerphones are designed to pick up and transmit nearby conversations, using speakerphones in TOP SECRET areas presents several security risks and they should not be used. However, if personnel reduce security risks by using an audio secure room that is secure during any conversations, they may be used." controls: - id: ism-0235 class: ISM-control title: "Control: ism-0235" props: - name: sort-id value: "catalog[1].group[10].group[1].group[5].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0235_smt name: statement prose: "Speakerphones are not used on telephone systems in TOP SECRET areas unless the telephone system is located in an audio secure room, the room is audio secure during conversations and only personnel involved in conversations are present in the room." - title: Off-hook audio protection props: - name: sort-id value: "catalog[1].group[10].group[1].group[6]" parts: - name: overview prose: "Using off-hook protection features minimises the chance of background conversations being accidentally coupled into handsets, headsets and speakerphones. Limiting the time an active microphone is open minimises this security risk." controls: - id: ism-0236 class: ISM-control title: "Control: ism-0236" props: - name: sort-id value: "catalog[1].group[10].group[1].group[6].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0236_smt name: statement prose: Off-hook audio protection features are used on telephone systems in areas where background conversations may exceed the sensitivity or classification that the telephone system is authorised for communicating. - id: ism-0931 class: ISM-control title: "Control: ism-0931" props: - name: sort-id value: "catalog[1].group[10].group[1].group[6].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0931_smt name: statement prose: "In SECRET and TOP SECRET areas, push-to-talk handsets or push-to-talk headsets are used to meet any off-hook audio protection requirements." - title: Video conferencing and Internet Protocol telephony props: - name: sort-id value: "catalog[1].group[10].group[2]" parts: - name: overview prose: |- # Context This section describes security controls applicable to Internet Protocol (IP) telephony and extends the ‘Telephone systems’ section of these guidelines. Furthermore, where a video conferencing or IP telephony network is connected to another network from a different security domain, the ‘Gateways’ section of the [Guidelines for gateways](#e8bde527-526c-4a6a-b66f-05228f09dd7b) applies. # Further information Further information on gateways can be found in the ‘Gateways’ section of the [Guidelines for gateways](#e8bde527-526c-4a6a-b66f-05228f09dd7b). Further information on firewalls can be found in the ‘Firewalls’ section of the [Guidelines for gateways](#e8bde527-526c-4a6a-b66f-05228f09dd7b). Further information on the use of web conferencing solutions can be found in ASD’s [Web conferencing security](#e19a0c40-0a68-4fba-aea1-142fdd57dc75) publication. groups: - title: Video conferencing and Internet Protocol telephony infrastructure hardening props: - name: sort-id value: "catalog[1].group[10].group[2].group[1]" parts: - name: overview prose: "Video conferencing and IP telephony infrastructure can be hardened to reduce its attack surface. For example, by ensuring that a Session Initiation Protocol server has a fully patched operating system, uses fully patched applications and only runs required services." controls: - id: ism-1562 class: ISM-control title: "Control: ism-1562" props: - name: sort-id value: "catalog[1].group[10].group[2].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-19 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1562_smt name: statement prose: Video conferencing and IP telephony infrastructure is hardened. - title: Video-aware and voice-aware firewalls and proxies props: - name: sort-id value: "catalog[1].group[10].group[2].group[2]" parts: - name: overview prose: "The use of video-aware and voice-aware firewalls and proxies provides network security while supporting video and voice traffic. As such, when implementing a firewall or proxy in a gateway, and video conferencing or IP telephony traffic passes through the gateway, a video-aware or voice-aware firewall or proxy will need to be used. However, this does not require separate firewalls or proxies to be deployed for video conferencing, IP telephony and data traffic. In such cases, an organisation is encouraged to implement one firewall or proxy that is video-aware and data-aware; voice-aware and data-aware; or video-aware, voice-aware and data-aware depending on their needs." controls: - id: ism-0546 class: ISM-control title: "Control: ism-0546" props: - name: sort-id value: "catalog[1].group[10].group[2].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "9" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0546_smt name: statement prose: "When video conferencing or IP telephony traffic passes through a gateway containing a firewall or proxy, a video-aware or voice-aware firewall or proxy is used." - title: Protecting video conferencing and Internet Protocol telephony traffic props: - name: sort-id value: "catalog[1].group[10].group[2].group[3]" parts: - name: overview prose: "Video conferencing and IP telephony traffic can be vulnerable to eavesdropping, denial-of-service, adversary-in-the-middle and call spoofing attacks. To mitigate this security risk, video conferencing and IP telephony signalling and audio/video data can be protected with the use of Transport Layer Security. This is achieved by using the Session Initiation Protocol Secure protocol and the Secure Real-time Transport Protocol." controls: - id: ism-0548 class: ISM-control title: "Control: ism-0548" props: - name: sort-id value: "catalog[1].group[10].group[2].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0548_smt name: statement prose: Video conferencing and IP telephony calls are established using a secure session initiation protocol. - id: ism-0547 class: ISM-control title: "Control: ism-0547" props: - name: sort-id value: "catalog[1].group[10].group[2].group[3].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0547_smt name: statement prose: Video conferencing and IP telephony calls are conducted using a secure real-time transport protocol. - title: Video conferencing unit and Internet Protocol phone authentication props: - name: sort-id value: "catalog[1].group[10].group[2].group[4]" parts: - name: overview prose: Blocking unauthorised or unauthenticated devices by default will reduce the likelihood of unauthorised access to a video conferencing or IP telephony network. controls: - id: ism-0554 class: ISM-control title: "Control: ism-0554" props: - name: sort-id value: "catalog[1].group[10].group[2].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0554_smt name: statement prose: An encrypted and non-replayable two-way authentication scheme is used for call authentication and authorisation. - id: ism-0553 class: ISM-control title: "Control: ism-0553" props: - name: sort-id value: "catalog[1].group[10].group[2].group[4].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0553_smt name: statement prose: "Authentication and authorisation is used for all actions on a video conferencing network, including call setup and changing settings." - id: ism-0555 class: ISM-control title: "Control: ism-0555" props: - name: sort-id value: "catalog[1].group[10].group[2].group[4].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-19 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0555_smt name: statement prose: "Authentication and authorisation is used for all actions on an IP telephony network, including registering a new IP phone, changing phone users, changing settings and accessing voicemail." - id: ism-0551 class: ISM-control title: "Control: ism-0551" props: - name: sort-id value: "catalog[1].group[10].group[2].group[4].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jan-20 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0551_smt name: statement prose: |- IP telephony is configured such that: - IP phones authenticate themselves to the call controller upon registration - auto-registration is disabled and only authorised devices are allowed to access the network - unauthorised devices are blocked by default - all unused and prohibited functionality is disabled. - id: ism-1014 class: ISM-control title: "Control: ism-1014" props: - name: sort-id value: "catalog[1].group[10].group[2].group[4].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1014_smt name: statement prose: Individual logins are implemented for IP phones used for SECRET or TOP SECRET conversations. - title: Traffic separation props: - name: sort-id value: "catalog[1].group[10].group[2].group[5]" parts: - name: overview prose: Video conferencing and IP telephony traffic should be physically or logically separated from other data traffic to ensure availability and quality of service. controls: - id: ism-0549 class: ISM-control title: "Control: ism-0549" props: - name: sort-id value: "catalog[1].group[10].group[2].group[5].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0549_smt name: statement prose: Video conferencing and IP telephony traffic is physically or logically separated from other data traffic. - id: ism-0556 class: ISM-control title: "Control: ism-0556" props: - name: sort-id value: "catalog[1].group[10].group[2].group[5].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Oct-19 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0556_smt name: statement prose: "Workstations are not connected to video conferencing units or IP phones unless the workstation or the device uses virtual local area networks or similar mechanisms to maintain separation between video conferencing, IP telephony and other data traffic." - title: Internet Protocol phones in public areas props: - name: sort-id value: "catalog[1].group[10].group[2].group[6]" parts: - name: overview prose: "IP phones in public areas may give malicious actors the opportunity to access data networks or poorly protected voicemail and directory services. As such, any services accessible to IP phones in public areas should be restricted." controls: - id: ism-0558 class: ISM-control title: "Control: ism-0558" props: - name: sort-id value: "catalog[1].group[10].group[2].group[6].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0558_smt name: statement prose: "IP phones used in public areas do not have the ability to access data networks, voicemail and directory services." - title: Microphones and webcams props: - name: sort-id value: "catalog[1].group[10].group[2].group[7]" parts: - name: overview prose: "Microphones (including headsets and Universal Serial Bus \\[USB\\] handsets) and webcams can pose a security risk in SECRET and TOP SECRET areas. Specifically, malicious actors can email or host malicious code on a compromised website and use social engineering techniques to convince human users into executing the malicious code on their workstation. Such malicious code may then activate microphones or webcams that are attached to the workstation to act as remote listening and recording devices." controls: - id: ism-0559 class: ISM-control title: "Control: ism-0559" props: - name: sort-id value: "catalog[1].group[10].group[2].group[7].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P parts: - id: ism-0559_smt name: statement prose: Microphones (including headsets and USB handsets) and webcams are not used with non-SECRET workstations in SECRET areas. - id: ism-1450 class: ISM-control title: "Control: ism-1450" props: - name: sort-id value: "catalog[1].group[10].group[2].group[7].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S parts: - id: ism-1450_smt name: statement prose: Microphones (including headsets and USB handsets) and webcams are not used with non-TOP SECRET workstations in TOP SECRET areas. - title: Denial of service response plan props: - name: sort-id value: "catalog[1].group[10].group[2].group[8]" parts: - name: overview prose: "Video conferencing and IP telephony services may be a critical service for an organisation. In such cases, a denial of service response plan will assist in responding to denial-of-service attacks against these services." controls: - id: ism-1019 class: ISM-control title: "Control: ism-1019" props: - name: sort-id value: "catalog[1].group[10].group[2].group[8].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "9" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1019_smt name: statement prose: "A denial of service response plan for video conferencing and IP telephony services is developed, implemented and maintained." - id: ism-1805 class: ISM-control title: "Control: ism-1805" props: - name: sort-id value: "catalog[1].group[10].group[2].group[8].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1805_smt name: statement prose: |- A denial of service response plan for video conferencing and IP telephony services contains the following: - how to identify signs of a denial-of-service attack - how to identify the source of a denial-of-service attack - how capabilities can be maintained during a denial-of-service attack - what actions can be taken to respond to a denial-of-service attack. - title: Multifunction devices props: - name: sort-id value: "catalog[1].group[10].group[3]" parts: - name: overview prose: |- # Further information Further information on event logging can be found in the ‘Security monitoring’ section of the [Guidelines for security assurance](#ef60c0e4-acfb-4a8b-b5ed-25675c6e117c). groups: - title: Multifunction device usage policy props: - name: sort-id value: "catalog[1].group[10].group[3].group[1]" parts: - name: overview prose: "As multifunction devices (MFDs) are a potential source of cyber security incidents, it is important that an organisation develops, implements and maintains a policy governing their use." controls: - id: ism-0588 class: ISM-control title: "Control: ism-0588" props: - name: sort-id value: "catalog[1].group[10].group[3].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0588_smt name: statement prose: "An MFD usage policy is developed, implemented and maintained." - title: Connecting multifunction devices to digital telephone systems props: - name: sort-id value: "catalog[1].group[10].group[3].group[2]" parts: - name: overview prose: "When MFDs are connected to both a network and a digital telephone system, they can act as a bridge between the two. As such, and to avoid potential data spills, MFDs should not be connected to digital telephone systems." controls: - id: ism-0245 class: ISM-control title: "Control: ism-0245" props: - name: sort-id value: "catalog[1].group[10].group[3].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0245_smt name: statement prose: MFDs are not connected to digital telephone systems. - title: Authenticating to multifunction devices props: - name: sort-id value: "catalog[1].group[10].group[3].group[3]" parts: - name: overview prose: "To prevent human users from printing sensitive or classified documents and forgetting to collect them, as well as assisting with the collection of sufficiently detailed event logs, MFDs should implement authentication measures that are of the same strength as used for other devices on the same network they are connected to, such as workstations. For example, if access to workstations on a network requires multi-factor authentication, so should access to MFDs before they can be used to print, scan or copy documents." controls: - id: ism-1854 class: ISM-control title: "Control: ism-1854" props: - name: sort-id value: "catalog[1].group[10].group[3].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1854_smt name: statement prose: "Human users authenticate to MFDs before they can print, scan or copy documents." - id: ism-0590 class: ISM-control title: "Control: ism-0590" props: - name: sort-id value: "catalog[1].group[10].group[3].group[3].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0590_smt name: statement prose: Authentication measures for MFDs are the same strength as those used for workstations on networks they are connected to. - title: Scanning and copying documents on multifunction devices props: - name: sort-id value: "catalog[1].group[10].group[3].group[4]" parts: - name: overview prose: "As MFDs residing on networks are often capable of sending scanned documents across networks they are connected to, personnel should be aware that if they scan documents at a level higher than the sensitivity or classification of the network it will cause a data spill. In addition, MFDs used to copy documents above the sensitivity or classification of the network may cause a localised data spill if copies are retained on non-volatile memory within the devices." controls: - id: ism-0589 class: ISM-control title: "Control: ism-0589" props: - name: sort-id value: "catalog[1].group[10].group[3].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0589_smt name: statement prose: MFDs are not used to scan or copy documents above the sensitivity or classification of networks they are connected to. - title: Logging multifunction device use props: - name: sort-id value: "catalog[1].group[10].group[3].group[5]" parts: - name: overview prose: "Centrally logging and analysing MFD events, including metadata and shadow copies of documents printed, scanned or copied, can assist in monitoring the security posture of systems, detecting malicious behaviour and supporting investigations following cyber security incidents." controls: - id: ism-1855 class: ISM-control title: "Control: ism-1855" props: - name: sort-id value: "catalog[1].group[10].group[3].group[5].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1855_smt name: statement prose: "Use of MFDs for printing, scanning and copying purposes, including the capture of shadow copies of documents, are centrally logged." - title: Observing multifunction device use props: - name: sort-id value: "catalog[1].group[10].group[3].group[6]" parts: - name: overview prose: Placing MFDs in public areas can help reduce the likelihood of any suspicious use going unnoticed. controls: - id: ism-1036 class: ISM-control title: "Control: ism-1036" props: - name: sort-id value: "catalog[1].group[10].group[3].group[6].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1036_smt name: statement prose: MFDs are placed in areas where their use can be observed. - title: Fax machines and services props: - name: sort-id value: "catalog[1].group[10].group[4]" groups: - title: Sending and receiving fax messages props: - name: sort-id value: "catalog[1].group[10].group[4].group[1]" parts: - name: overview prose: "As fax machines, and associated communications protocols, are legacy information technology, they should not be used for sending or receiving fax messages. Instead, more secure communications methods, such as scanning documents and attaching them to emails, should be used." controls: - id: ism-2075 class: ISM-control title: "Control: ism-2075" props: - name: sort-id value: "catalog[1].group[10].group[4].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2075_smt name: statement prose: "Fax machines, and online fax services, are not used for sending or receiving fax messages." - title: Guidelines for enterprise mobility props: - name: sort-id value: "catalog[1].group[11]" groups: - title: Enterprise mobility props: - name: sort-id value: "catalog[1].group[11].group[1]" parts: - name: overview prose: |- # Context Enterprise mobility generally refers to situations in which personnel work in a mobile manner, such as part of office hot-desking arrangements, when working from home, when travelling or simply when outside the office environment during normal business hours. While enterprise mobility has traditionally been used to refer to the use of mobile devices, such as smartphones, tablets and laptop computers, it is increasingly being applied to the use of desktop computers as part of working from home arrangements. This section applies to privately owned and organisation-owned mobile devices and desktop computers that use either a mobile operating system or a desktop operating system. # Further information Further information on allowing the use of privately owned mobile devices and desktop computers by personnel to access their organisation’s systems or data can be found in the Australian Signals Directorate’s (ASD) [Bring Your Own Device for executives](#0e982561-93dc-4cf7-9a98-e91411e99ca6) publication. Further information and specific guidance on enterprise mobility can be found in ASD’s [Risk management of enterprise mobility (including Bring Your Own Device)](#e8ec7a1f-775d-4b79-a164-0752278177fa) publication. Further information on cyber supply chain risk management can be found in the ‘Cyber supply chain risk management’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on the procurement and use of online services can be found in the ‘Managed services and cloud services’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). groups: - title: Privately owned mobile devices and desktop computers props: - name: sort-id value: "catalog[1].group[11].group[1].group[1]" parts: - name: overview prose: "Allowing privately owned mobile devices and desktop computers to access an organisation’s systems or data can increase liability risk. As such, an organisation should seek legal advice to ascertain whether this scenario affects compliance with relevant legislation, such as the [Privacy Act 1988](#6fac5a84-b86e-405f-b2b3-8c13ecee4a02) and the [Archives Act 1983](#e0d3b5ea-6a5a-400c-8daa-8a8059816a06). Furthermore, if an organisation chooses to allow personnel to use privately owned mobile devices or desktop computers to access their organisation’s classified systems or data, they should ensure that it does not present an unacceptable security risk. This can be achieved in part through the enforced separation of classified data and personal data, preventing the storage of classified data on privately owned mobile devices and desktop computers, and disallowing the use of unapproved artificial intelligence agents." controls: - id: ism-1297 class: ISM-control title: "Control: ism-1297" props: - name: sort-id value: "catalog[1].group[11].group[1].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1297_smt name: statement prose: Legal advice is sought prior to allowing privately owned mobile devices and desktop computers to access systems or data. - id: ism-1400 class: ISM-control title: "Control: ism-1400" props: - name: sort-id value: "catalog[1].group[11].group[1].group[1].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "11" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P parts: - id: ism-1400_smt name: statement prose: "Personnel using privately owned mobile devices or desktop computers to access OFFICIAL: Sensitive or PROTECTED systems or data have enforced separation of classified data and personal data." - id: ism-1866 class: ISM-control title: "Control: ism-1866" props: - name: sort-id value: "catalog[1].group[11].group[1].group[1].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P parts: - id: ism-1866_smt name: statement prose: "Personnel using privately owned mobile devices or desktop computers to access OFFICIAL: Sensitive or PROTECTED systems or data are prevented from storing classified data on their privately owned mobile devices and desktop computers." - id: ism-2095 class: ISM-control title: "Control: ism-2095" props: - name: sort-id value: "catalog[1].group[11].group[1].group[1].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P parts: - id: ism-2095_smt name: statement prose: "Personnel using privately owned mobile devices or desktop computers to access OFFICIAL: Sensitive or PROTECTED systems or data are disallowed from granting access to unapproved artificial intelligence agents." - id: ism-0694 class: ISM-control title: "Control: ism-0694" props: - name: sort-id value: "catalog[1].group[11].group[1].group[1].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "9" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0694_smt name: statement prose: Privately owned mobile devices and desktop computers do not access SECRET and TOP SECRET systems or data. - title: Organisation-owned mobile devices and desktop computers props: - name: sort-id value: "catalog[1].group[11].group[1].group[2]" parts: - name: overview prose: "If an organisation chooses to issue personnel with organisation-owned mobile devices or desktop computers to access their organisation’s classified systems or data, they should ensure that it does not present an unacceptable security risk. This can be achieved in part by enforcing the separation of classified data and personal data." controls: - id: ism-1482 class: ISM-control title: "Control: ism-1482" props: - name: sort-id value: "catalog[1].group[11].group[1].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "9" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1482_smt name: statement prose: Personnel using organisation-owned mobile devices or desktop computers to access classified systems or data have enforced separation of classified data and personal data. - title: Mobile devices and desktop computers accessing the internet props: - name: sort-id value: "catalog[1].group[11].group[1].group[3]" parts: - name: overview prose: |- When mobile devices and desktop computers access the internet, doing so via an organisation’s internet gateway rather than directly can enable the provision of additional security functionality, such as web content filtering and protective Domain Name System services. However, in some cases, an organisation may instead accept the security risks associated with allowing direct connections to specific online services, such as web conferencing services and collaboration tools, for performance reasons. When connecting mobile devices and desktop computers to an organisation’s internet gateway via a virtual private network (VPN) connection, a split tunnel VPN can enable indirect access into the organisation’s network from other networks, such as the internet. As such, if split tunnelling is not disabled, there is an increased security risk that the VPN connection could be used as an intrusion vector by malicious actors. controls: - id: ism-0874 class: ISM-control title: "Control: ism-0874" props: - name: sort-id value: "catalog[1].group[11].group[1].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0874_smt name: statement prose: Mobile devices and desktop computers access the internet via an organisation’s internet gateway rather than via a direct connection to the internet. - id: ism-0705 class: ISM-control title: "Control: ism-0705" props: - name: sort-id value: "catalog[1].group[11].group[1].group[3].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0705_smt name: statement prose: "When accessing an organisation’s network via a VPN connection, split tunnelling is disabled." - title: Mobile device management props: - name: sort-id value: "catalog[1].group[11].group[2]" parts: - name: overview prose: |- # Context This section describes the hardening of privately owned and organisation-owned mobile devices, such as smartphones and tablets that use a mobile operating system. Alternatively, guidance for privately owned and organisation-owned mobile devices that use a desktop operating system is available in the ‘Operating system hardening’ section of the [Guidelines for system hardening](#de7525f3-a466-40a5-abdd-3ae24a6d1b44). # Further information Further information on cyber supply chain risk management can be found in the ‘Cyber supply chain risk management’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on evaluated products can be found in the ‘Evaluated product procurement’ section of the [Guidelines for evaluated products](#a699a3aa-828d-479b-b50b-98127bb19437). Further information on Common Criteria Protection Profiles for mobile devices can be found in the following United States’ National Information Assurance Partnership publications: - [Protection Profile for Mobile Device Management Version 4.0](#ed6aa6ab-545d-48eb-92bc-9ad763d4b868) - [Protection Profile for Mobile Device Fundamentals Version 3.3](#f160b04e-1a32-4dd5-816e-1cba8c97982c). Further information on hardening mobile platforms can be found in the following ASD publications: - [Security configuration guide: Apple iOS 14 devices](#d2910e61-da88-4d29-b860-83c25161fd18) - [Security configuration guide: Samsung Galaxy S10, S20 and Note 20 devices](#616fce77-495b-472a-a552-7593ab64f188) - [Security configuration guide: Viasat Mobile Dynamic Defense](#daae37ef-262f-4b20-bfb7-a27901f3c2db). Further information on encrypting mobile devices and their communications can be found in the ‘Cryptographic fundamentals’ section of the [Guidelines for cryptography](#195abe87-bb1e-4006-8b42-eaecca4d51f1). groups: - title: Mobile device management policy props: - name: sort-id value: "catalog[1].group[11].group[2].group[1]" parts: - name: overview prose: "Since mobile devices routinely leave the office environment, and the protection it affords, it is important that a mobile device management policy is developed, implemented and maintained to ensure that mobile devices are sufficiently hardened. In doing so, it is important that Mobile Device Management solutions that have completed a Common Criteria evaluation against the Protection Profile for Mobile Device Management, version 4.0 or later, are used to enforce mobile device management policy." controls: - id: ism-1533 class: ISM-control title: "Control: ism-1533" props: - name: sort-id value: "catalog[1].group[11].group[2].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1533_smt name: statement prose: "A mobile device management policy is developed, implemented and maintained." - id: ism-1195 class: ISM-control title: "Control: ism-1195" props: - name: sort-id value: "catalog[1].group[11].group[2].group[1].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1195_smt name: statement prose: "Mobile Device Management solutions that have completed a Common Criteria evaluation against the Protection Profile for Mobile Device Management, version 4.0 or later, are used to enforce mobile device management policy." - title: Approved mobile platforms props: - name: sort-id value: "catalog[1].group[11].group[2].group[2]" parts: - name: overview prose: "To ensure an appropriate level of security, mobile devices that access OFFICIAL: Sensitive or PROTECTED systems or data should use mobile platforms that have completed a Common Criteria evaluation against the Protection Profile for Mobile Device Fundamentals, version 3.3 or later, and are operated in accordance with the latest version of their associated ASD security configuration guide. Furthermore, to ensure interoperability and maintain trust, mobile devices that access SECRET or TOP SECRET systems or data must use mobile platforms that have been issued an Approval for Use by ASD and are operated in accordance with the latest version of their associated Australian Communications Security Instruction." controls: - id: ism-1867 class: ISM-control title: "Control: ism-1867" props: - name: sort-id value: "catalog[1].group[11].group[2].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P parts: - id: ism-1867_smt name: statement prose: "Mobile devices that access OFFICIAL: Sensitive or PROTECTED systems or data use mobile platforms that have completed a Common Criteria evaluation against the Protection Profile for Mobile Device Fundamentals, version 3.3 or later, and are operated in accordance with the latest version of their associated ASD security configuration guide." - id: ism-0687 class: ISM-control title: "Control: ism-0687" props: - name: sort-id value: "catalog[1].group[11].group[2].group[2].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "10" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0687_smt name: statement prose: Mobile devices that access SECRET or TOP SECRET systems or data use mobile platforms that have been issued an Approval for Use by ASD and are operated in accordance with the latest version of their associated Australian Communications Security Instruction. - title: Encrypted storage props: - name: sort-id value: "catalog[1].group[11].group[2].group[3]" parts: - name: overview prose: "Suitably encrypting the internal storage, and any removable media, for mobile devices will help prevent malicious actors from gaining easy access to any sensitive or classified data stored on them if they are lost or stolen. As such, it is critical that ASD-approved cryptography is used." controls: - id: ism-0869 class: ISM-control title: "Control: ism-0869" props: - name: sort-id value: "catalog[1].group[11].group[2].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0869_smt name: statement prose: Mobile devices encrypt their internal storage and any removable media using ASD-approved cryptography. - id: ism-1868 class: ISM-control title: "Control: ism-1868" props: - name: sort-id value: "catalog[1].group[11].group[2].group[3].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1868_smt name: statement prose: SECRET and TOP SECRET mobile devices do not use removable media unless approved beforehand by ASD. - title: Encrypted communications props: - name: sort-id value: "catalog[1].group[11].group[2].group[4]" parts: - name: overview prose: "Failure to suitably encrypt mobile device communications, including those of mobile applications, when communicating sensitive or classified data presents an unacceptable security risk. As such, when encrypting data in transit, it is critical that ASD-approved cryptography is used." controls: - id: ism-1085 class: ISM-control title: "Control: ism-1085" props: - name: sort-id value: "catalog[1].group[11].group[2].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1085_smt name: statement prose: Mobile devices encrypt all sensitive or classified data communicated over public network infrastructure using ASD-approved cryptography. - id: ism-2108 class: ISM-control title: "Control: ism-2108" props: - name: sort-id value: "catalog[1].group[11].group[2].group[4].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2108_smt name: statement prose: Mobile applications encrypt all sensitive or classified data communicated over public network infrastructure using ASD-approved cryptography. - title: Maintaining mobile device security props: - name: sort-id value: "catalog[1].group[11].group[2].group[5]" parts: - name: overview prose: "Poorly secured mobile devices are more vulnerable to compromise and can provide malicious actors with a potential access point into any connected systems. Although an organisation may initially provide secure mobile devices, their security posture may degrade over time if personnel can install non-approved applications and disable or modify security functionality. Furthermore, it is important that security updates are applied to mobile devices as soon as they become available to maintain their security posture." controls: - id: ism-1886 class: ISM-control title: "Control: ism-1886" props: - name: sort-id value: "catalog[1].group[11].group[2].group[5].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1886_smt name: statement prose: Mobile devices are configured to operate in a supervised (or equivalent) mode. - id: ism-2096 class: ISM-control title: "Control: ism-2096" props: - name: sort-id value: "catalog[1].group[11].group[2].group[5].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2096_smt name: statement prose: Mobile devices are configured to enforce separation between organisational and personal mobile applications and data. - id: ism-2097 class: ISM-control title: "Control: ism-2097" props: - name: sort-id value: "catalog[1].group[11].group[2].group[5].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2097_smt name: statement prose: Mobile devices are configured with always on VPN functionality. - id: ism-1887 class: ISM-control title: "Control: ism-1887" props: - name: sort-id value: "catalog[1].group[11].group[2].group[5].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1887_smt name: statement prose: Mobile devices are configured with remote locate and wipe functionality. - id: ism-1888 class: ISM-control title: "Control: ism-1888" props: - name: sort-id value: "catalog[1].group[11].group[2].group[5].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1888_smt name: statement prose: Mobile devices are configured with secure password-based lock screens. - id: ism-2098 class: ISM-control title: "Control: ism-2098" props: - name: sort-id value: "catalog[1].group[11].group[2].group[5].control[6]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2098_smt name: statement prose: Mobile devices are configured to prevent data transfers over Universal Serial Bus connections. - id: ism-0863 class: ISM-control title: "Control: ism-0863" props: - name: sort-id value: "catalog[1].group[11].group[2].group[5].control[7]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0863_smt name: statement prose: Mobile devices prevent personnel from installing non-approved applications once provisioned. - id: ism-0864 class: ISM-control title: "Control: ism-0864" props: - name: sort-id value: "catalog[1].group[11].group[2].group[5].control[8]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0864_smt name: statement prose: Mobile devices prevent personnel from disabling or modifying security functionality once provisioned. - id: ism-1366 class: ISM-control title: "Control: ism-1366" props: - name: sort-id value: "catalog[1].group[11].group[2].group[5].control[9]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1366_smt name: statement prose: Security updates are applied to mobile devices as soon as they become available. - title: Mobile device usage props: - name: sort-id value: "catalog[1].group[11].group[3]" parts: - name: overview prose: |- # Context This section describes the usage of privately owned and organisation-owned mobile devices that use either a mobile operating system or a desktop operating system. # Further information Further information on Bluetooth security can be found in National Institute of Standards and Technology Special Publication 800-121 Rev. 2, [Guide to Bluetooth Security](#315744ea-3523-4c93-838d-fe2848ac4181). Further information on usage of mobile devices in SECRET and TOP SECRET areas can be found in the ‘Facilities and systems’ section of the [Guidelines for physical security](#4deea7ea-18a2-4fd7-8b25-0b3603215df2). Further information on security briefcases can be found in the Australian Security Intelligence Organisation’s Security Equipment Guide-005, Briefcases for the Carriage of Security Classified Information. This publication is available from the Protective Security Policy GovTEAMS community or the Australian Security Intelligence Organisation by email. Further information on approved multi-use satchels, pouches and transit bags can be found on the Security Construction and Equipment Committee’s [Security Equipment Evaluated Products List](#f7e13f7b-eb48-4294-bd01-9c22c756d96b). groups: - title: Mobile device usage policy props: - name: sort-id value: "catalog[1].group[11].group[3].group[01]" parts: - name: overview prose: "Since mobile devices routinely leave the office environment, and the protection it affords, it is important that an organisation develops, implements and maintains a mobile device usage policy governing their use." controls: - id: ism-1082 class: ISM-control title: "Control: ism-1082" props: - name: sort-id value: "catalog[1].group[11].group[3].group[01].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1082_smt name: statement prose: "A mobile device usage policy is developed, implemented and maintained." - title: Personnel awareness props: - name: sort-id value: "catalog[1].group[11].group[3].group[02]" parts: - name: overview prose: "As mobile devices often have voice and data communication capabilities, personnel should be made aware of the sensitivity or classification of voice and data that mobile devices have been approved to process, store and communicate. In addition, personnel should be made aware of common security practices for mobile device usage." controls: - id: ism-1083 class: ISM-control title: "Control: ism-1083" props: - name: sort-id value: "catalog[1].group[11].group[3].group[02].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1083_smt name: statement prose: Personnel are advised of the sensitivity or classification permitted for voice and data communications when using mobile devices. - id: ism-1299 class: ISM-control title: "Control: ism-1299" props: - name: sort-id value: "catalog[1].group[11].group[3].group[02].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1299_smt name: statement prose: |- Personnel are advised to take the following precautions when using mobile devices: - never leave mobile devices or removable media unattended, including by placing them in checked-in luggage or leaving them in hotel safes - never store credentials with mobile devices that they grant access to, such as in laptop computer bags - never lend mobile devices or removable media to untrusted people, even if briefly - never allow untrusted people to connect their mobile devices or removable media to your mobile devices, including for charging - never connect mobile devices to designated charging stations or wall outlet charging ports - never use gifted or unauthorised peripherals, chargers or removable media with mobile devices - never use removable media for data transfers or backups that have not been checked for malicious code beforehand - avoid reuse of removable media once used with other parties’ systems or mobile devices - avoid connecting mobile devices to open or untrusted Wi-Fi networks - consider disabling any communications capabilities of mobile devices when not in use, such as Wi-Fi, Bluetooth, Near Field Communication and ultra-wideband - consider periodically rebooting mobile devices - consider using a VPN connection to encrypt all cellular and wireless communications - consider using encrypted email or messaging apps for all communications. - title: "Using paging, message services and messaging apps" props: - name: sort-id value: "catalog[1].group[11].group[3].group[03]" parts: - name: overview prose: "As paging, messaging services and many messaging apps do not sufficiently encrypt data in transit, they cannot be relied upon for the communication of sensitive or classified data." controls: - id: ism-0240 class: ISM-control title: "Control: ism-0240" props: - name: sort-id value: "catalog[1].group[11].group[3].group[03].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0240_smt name: statement prose: "Paging, Multimedia Message Service, Short Message Service and messaging apps are not used to communicate sensitive or classified data." - title: Using Bluetooth functionality props: - name: sort-id value: "catalog[1].group[11].group[3].group[04]" parts: - name: overview prose: "To mitigate security risks associated with pairing mobile devices with other Bluetooth devices, Bluetooth version 4.1 introduced the Secure Connections functionality for Bluetooth Classic, while Bluetooth version 4.2 introduced the Secure Connections functionality for Bluetooth Low Energy. This functionality uses keys generated using Elliptic Curve Diffie-Hellman cryptography, offering greater security compared to previous key exchange protocols. However, personnel should still consider the location and way they pair non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices with other Bluetooth devices, such as by avoiding pairing devices in public locations, and remove all Bluetooth pairings when there is no longer a requirement for their use. In contrast, the Bluetooth protocol provides inadequate protection for the communication of SECRET and TOP SECRET data. As such, Bluetooth functionality is not suitable for use with SECRET and TOP SECRET mobile devices." controls: - id: ism-1196 class: ISM-control title: "Control: ism-1196" props: - name: sort-id value: "catalog[1].group[11].group[3].group[04].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P parts: - id: ism-1196_smt name: statement prose: "Non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices are configured to remain undiscoverable to other Bluetooth devices except during Bluetooth pairing." - id: ism-1200 class: ISM-control title: "Control: ism-1200" props: - name: sort-id value: "catalog[1].group[11].group[3].group[04].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P parts: - id: ism-1200_smt name: statement prose: "Bluetooth pairing for non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices is performed using Secure Connections, preferably with Numeric Comparison if supported." - id: ism-1198 class: ISM-control title: "Control: ism-1198" props: - name: sort-id value: "catalog[1].group[11].group[3].group[04].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P parts: - id: ism-1198_smt name: statement prose: "Bluetooth pairing for non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices is performed in a manner such that connections are only made between intended Bluetooth devices." - id: ism-1199 class: ISM-control title: "Control: ism-1199" props: - name: sort-id value: "catalog[1].group[11].group[3].group[04].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P parts: - id: ism-1199_smt name: statement prose: "Bluetooth pairings for non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices are removed when there is no longer a requirement for their use." - id: ism-0682 class: ISM-control title: "Control: ism-0682" props: - name: sort-id value: "catalog[1].group[11].group[3].group[04].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0682_smt name: statement prose: Bluetooth functionality is not enabled on SECRET and TOP SECRET mobile devices. - title: Connecting mobile devices to connected vehicles props: - name: sort-id value: "catalog[1].group[11].group[3].group[05]" parts: - name: overview prose: "Connected vehicles often monitor, record, aggregate and communicate data on vehicle occupants, their connected mobile devices and their surrounding environment. In many cases, this data is then sent to the vehicle manufacturer, which could then be sold to or shared with third parties." controls: - id: ism-2099 class: ISM-control title: "Control: ism-2099" props: - name: sort-id value: "catalog[1].group[11].group[3].group[05].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2099_smt name: statement prose: Mobile devices are not connected to the infotainment systems of connected vehicles. - title: Using mobile devices within or near connected vehicles props: - name: sort-id value: "catalog[1].group[11].group[3].group[06]" parts: - name: overview prose: "Personnel should be aware of the environment in which they use mobile devices to view or communicate sensitive or classified data. Including by ensuring that sensitive or classified data is not viewed or communicated within or near connected vehicles due to the potential for mobile device screens to be recorded by cameras or for conversations to be recorded, retained and communicated by connected vehicle infotainment systems or connected services." controls: - id: ism-2100 class: ISM-control title: "Control: ism-2100" props: - name: sort-id value: "catalog[1].group[11].group[3].group[06].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2100_smt name: statement prose: Sensitive or classified data is not viewed on mobile devices within or near connected vehicles. - id: ism-2101 class: ISM-control title: "Control: ism-2101" props: - name: sort-id value: "catalog[1].group[11].group[3].group[06].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2101_smt name: statement prose: Sensitive or classified phone calls and conversations are not conducted within or near connected vehicles. - title: Using mobile devices in public spaces props: - name: sort-id value: "catalog[1].group[11].group[3].group[07]" parts: - name: overview prose: |- Personnel should be aware of the environment in which they use mobile devices to view or communicate sensitive or classified data. Including by ensuring that sensitive or classified data is not observed by other parties in public areas, such as on public transport, in transit lounges and at coffee shops. In some cases, privacy filters can be applied to the screen of a mobile device to prevent onlookers from reading content off its screen. In addition, personnel should maintain awareness of the environments from which they conduct sensitive or classified phone calls and the potential for their conversations to be overheard. controls: - id: ism-0866 class: ISM-control title: "Control: ism-0866" props: - name: sort-id value: "catalog[1].group[11].group[3].group[07].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0866_smt name: statement prose: Sensitive or classified data is not viewed on mobile devices in public locations unless care is taken to reduce the chance of the screen of a mobile device being observed. - id: ism-1145 class: ISM-control title: "Control: ism-1145" props: - name: sort-id value: "catalog[1].group[11].group[3].group[07].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1145_smt name: statement prose: Privacy filters are applied to the screens of SECRET and TOP SECRET mobile devices. - id: ism-1644 class: ISM-control title: "Control: ism-1644" props: - name: sort-id value: "catalog[1].group[11].group[3].group[07].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1644_smt name: statement prose: Sensitive or classified phone calls and conversations are not conducted in public locations unless care is taken to reduce the chance of conversations being overheard. - title: Maintaining control of mobile devices props: - name: sort-id value: "catalog[1].group[11].group[3].group[08]" parts: - name: overview prose: "As mobile devices are portable in nature, and can be easily lost or stolen, personnel should maintain continual direct supervision of them when being actively used and ensure they are carried or stored in a secured state when not being actively used. While mobile devices may be encrypted, the effectiveness of encryption might be reduced if they are lost or stolen while in sleep mode or powered on with a locked screen." controls: - id: ism-0871 class: ISM-control title: "Control: ism-0871" props: - name: sort-id value: "catalog[1].group[11].group[3].group[08].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Apr-19 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0871_smt name: statement prose: Mobile devices are kept under continual direct supervision when being actively used. - id: ism-0870 class: ISM-control title: "Control: ism-0870" props: - name: sort-id value: "catalog[1].group[11].group[3].group[08].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Apr-19 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0870_smt name: statement prose: Mobile devices are carried or stored in a secured state when not being actively used. - id: ism-1084 class: ISM-control title: "Control: ism-1084" props: - name: sort-id value: "catalog[1].group[11].group[3].group[08].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1084_smt name: statement prose: "If unable to carry or store mobile devices in a secured state, they are physically transferred in a security briefcase or an approved multi-use satchel, pouch or transit bag." - title: Mobile device emergency sanitisation processes and procedures props: - name: sort-id value: "catalog[1].group[11].group[3].group[09]" parts: - name: overview prose: "The sanitisation of mobile devices in emergencies can assist in reducing the potential for compromise of data by malicious actors. This may be achieved by using a remote wipe capability, a cryptographic key zeroise or sanitisation function if present." controls: - id: ism-0701 class: ISM-control title: "Control: ism-0701" props: - name: sort-id value: "catalog[1].group[11].group[3].group[09].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0701_smt name: statement prose: "Mobile device emergency sanitisation processes, and supporting mobile device emergency sanitisation procedures, are developed, implemented and maintained." - id: ism-0702 class: ISM-control title: "Control: ism-0702" props: - name: sort-id value: "catalog[1].group[11].group[3].group[09].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0702_smt name: statement prose: "If a cryptographic zeroise or sanitise function is provided for cryptographic keys on a SECRET or TOP SECRET mobile device, the function is used as part of mobile device emergency sanitisation processes and procedures." - title: Before travelling overseas with mobile devices props: - name: sort-id value: "catalog[1].group[11].group[3].group[10]" parts: - name: overview prose: "Personnel travelling overseas with mobile devices face additional security risks compared to travelling domestically, especially when travelling to high or extreme risk countries. As such, appropriate precautions should be taken. Personnel should also be aware that when they leave Australian borders, they also leave behind any expectations of privacy." controls: - id: ism-1298 class: ISM-control title: "Control: ism-1298" props: - name: sort-id value: "catalog[1].group[11].group[3].group[10].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Oct-19 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1298_smt name: statement prose: Personnel are advised of privacy and security risks when travelling overseas with mobile devices. - id: ism-1554 class: ISM-control title: "Control: ism-1554" props: - name: sort-id value: "catalog[1].group[11].group[3].group[10].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1554_smt name: statement prose: |- If travelling overseas with mobile devices to high or extreme risk countries, personnel are: - issued with newly provisioned user accounts, mobile devices and removable media from a pool of dedicated travel devices which are used solely for work-related activities - advised on how to apply and inspect tamper seals to key areas of mobile devices - advised to avoid taking any personal mobile devices, especially if rooted or jailbroken. - id: ism-1555 class: ISM-control title: "Control: ism-1555" props: - name: sort-id value: "catalog[1].group[11].group[3].group[10].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1555_smt name: statement prose: |- Before travelling overseas with mobile devices, personnel take the following actions: - record all details of the mobile devices being taken, such as product types, serial numbers and International Mobile Equipment Identity numbers - update all operating systems and applications - remove all non-essential data, applications and user accounts - backup all remaining data, applications and settings. - title: While travelling overseas with mobile devices props: - name: sort-id value: "catalog[1].group[11].group[3].group[11]" parts: - name: overview prose: "Personnel lose control of mobile devices and removable media any time they are not on their person. In addition, allowing untrusted people to access mobile devices provides an opportunity for them to be tampered with." controls: - id: ism-1088 class: ISM-control title: "Control: ism-1088" props: - name: sort-id value: "catalog[1].group[11].group[3].group[11].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1088_smt name: statement prose: |- Personnel report the potential compromise of mobile devices, removable media or credentials to their organisation as soon as possible, especially if they: - provide credentials to foreign government officials - decrypt mobile devices for foreign government officials - have mobile devices taken out of sight by foreign government officials - have mobile devices or removable media stolen, including if later returned - lose mobile devices or removable media, including if later found - observe unusual behaviour of mobile devices. - title: After travelling overseas with mobile devices props: - name: sort-id value: "catalog[1].group[11].group[3].group[12]" parts: - name: overview prose: "Following overseas travel with mobile devices, personnel should take appropriate precautions to ensure that they do not pose an undue security risk to their organisation’s systems. In most cases, sanitising and resetting mobile devices, including all removable media, will be sufficient. However, upon returning from high or extreme risk countries, additional precautions will likely be needed." controls: - id: ism-1300 class: ISM-control title: "Control: ism-1300" props: - name: sort-id value: "catalog[1].group[11].group[3].group[12].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1300_smt name: statement prose: |- Upon returning from travelling overseas with mobile devices, personnel take the following actions: - sanitise and reset mobile devices, including all removable media - decommission any credentials that left their possession during their travel - report if significant doubt exists as to the integrity of any mobile devices or removable media. - id: ism-1556 class: ISM-control title: "Control: ism-1556" props: - name: sort-id value: "catalog[1].group[11].group[3].group[12].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1556_smt name: statement prose: |- If returning from travelling overseas with mobile devices to high or extreme risk countries, personnel take the following additional actions: - reset credentials used with mobile devices, including those used for remote access to their organisation’s systems - monitor user accounts for any indicators of compromise, such as failed logon attempts. - title: Guidelines for evaluated products props: - name: sort-id value: "catalog[1].group[12]" groups: - title: Evaluated product procurement props: - name: sort-id value: "catalog[1].group[12].group[1]" parts: - name: overview prose: |- # Context An evaluated product provides a level of assurance in its security functionality that an unevaluated product does not. Evaluation documentation can assist an organisation in assessing the suitability of products and making informed procurement and deployment decisions. The Australian Certification Authority within the Australian Signals Directorate (ASD) certifies product evaluations conducted by licensed commercial facilities, in accordance with the Common Criteria (i.e. the International Organization for Standardization/International Electrotechnical Commission 15408 series), as part of the Australian Information Security Evaluation Program (AISEP). In support of Common Criteria evaluations, a Protection Profile (PP) is a technology-specific document that defines the security functionality that must be included in a Common Criteria evaluated product to mitigate specific cyber threats. PPs can support Secure by Design principles and practices by defining security functional and assurance requirements for classes of products against which individual products can be evaluated. PPs can be published by a recognised Common Criteria Recognition Arrangement (CCRA) scheme or by the CCRA body itself. PPs published by the CCRA body are referred to as collaborative PPs. ASD recognises all collaborative PPs listed on the [Common Criteria](#231b9f0c-6f88-4ead-ac34-acd2a24a0008) website, and will consider national PPs listed on the United States’ [National Information Assurance Partnership](#15d9668e-8aa4-4f80-b6e5-05400621cfb4) website, in addition to those listed on ASD’s [AISEP](#57c58870-2ebb-4fce-b995-0c86cb64002f) webpage. Where a PP does not exist, an evaluation based on an Evaluation Assurance Level (EAL) may be accepted. Such evaluations are capped at EAL2+ as this represents the best balance between completion time and meaningful security assurance gains. In addition, some CCRA schemes leverage the [Cryptographic Algorithm Validation Program](#42e7d99d-9709-4355-a54d-98959c552aa1) for the validation of cryptographic algorithm implementations used by cryptographic modules within evaluated products. In such cases, cryptographic algorithm testing is performed by Cryptographic and Security Testing laboratories that are accredited by the United States’ National Voluntary Laboratory Accreditation Program. Finally, ASD also performs evaluations for products used to protect SECRET and TOP SECRET data via its High Assurance Evaluation Program. # Further information Further information on the [High Assurance Evaluation Program](#e4ef23da-2683-4356-93c4-a2412c9d52ee) is available from ASD. Further information on the [AISEP](#57c58870-2ebb-4fce-b995-0c86cb64002f) is available from ASD. Further information on Common Criteria evaluated products can be found on the Common Criteria’s [Certified Products List](#29b04eaf-5f57-4ea1-a453-8047826dccf5). Further information on cyber supply chain risk management can be found in the ‘Cyber supply chain risk management’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). groups: - title: Evaluated product selection props: - name: sort-id value: "catalog[1].group[12].group[1].group[1]" parts: - name: overview prose: |- A Common Criteria evaluation is traditionally conducted at a specified EAL, while evaluations against a PP exist outside of this scale. Although products evaluated against a PP will fulfil the Common Criteria EAL requirements, the EAL number will not be published. In addition, PP modules contain additional requirements that are complementary to or extend upon collaborative PPs. For example, a stateful traffic filtering PP module may apply to a firewall evaluated against a network device collaborative PP. As such, when procuring an evaluated product that has completed a PP-based evaluation, it is important to ensure that all applicable PP modules, as well as a software bill of materials assessment if applicable, were included as part of the product’s evaluation. Furthermore, in choosing evaluated products, an organisation should determine their suitability by reviewing their evaluation documentation. This includes the security target and certification report. Products that are undergoing a Common Criteria evaluation will not have this information publicly available; however, documentation can be obtained from ASD if a product is being evaluated through the AISEP. For a product that is in evaluation through a foreign scheme, the product’s vendor can be contacted directly for further information. The Common Criteria’s [Certified Products List](#29b04eaf-5f57-4ea1-a453-8047826dccf5) contains a list of products that have been evaluated, certified and mutually recognised. Where a suitable evaluated product is not available for a particular product class or use case, an organisation should consider the associated security risks and determine its security requirements when considering alternative products. Where additional product assurance is required, an organisation may also consider seeking an evaluation of a suitable product. Finally, the [Information security manual](#e7ce6e23-4bbb-45c1-a657-7e563c0837ed) identifies a number of product classes and use cases for which evaluated products are required in certain circumstances. Further information on applicable requirements can be found in the relevant sections. For cryptographic equipment, applications and libraries, an organisation should consider the assurance preferences described in the ‘Cryptographic implementation assurance’ section of the [Guidelines for cryptography](#195abe87-bb1e-4006-8b42-eaecca4d51f1) when selecting a suitable product. controls: - id: ism-0280 class: ISM-control title: "Control: ism-0280" props: - name: sort-id value: "catalog[1].group[12].group[1].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "9" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0280_smt name: statement prose: "If procuring an evaluated product, a product that has completed a PP-based evaluation, including against all applicable PP modules (as well as a software bill of materials assessment if applicable), is selected in preference to one that has completed an EAL-based evaluation." - title: Delivery of evaluated products props: - name: sort-id value: "catalog[1].group[12].group[1].group[2]" parts: - name: overview prose: |- It is important that an organisation ensures that products they source are the actual products that are delivered. In the case of evaluated products, if the product delivered differs from an evaluated version, then the assurance gained from the evaluation may not necessarily apply. Packaging and delivery practices can vary greatly from product to product. For most evaluated products, standard commercial packaging and delivery practices are likely to be sufficient. However, in some cases more secure packaging and delivery practices, including tamper-evident seals and secure transportation, may be required. In the case of the digital delivery of evaluated products, digital signatures or cryptographic checksums can often be used to ensure the integrity of the product that was delivered. controls: - id: ism-0285 class: ISM-control title: "Control: ism-0285" props: - name: sort-id value: "catalog[1].group[12].group[1].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0285_smt name: statement prose: Evaluated products are delivered in a manner consistent with any delivery procedures defined in associated evaluation documentation. - id: ism-0286 class: ISM-control title: "Control: ism-0286" props: - name: sort-id value: "catalog[1].group[12].group[1].group[2].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0286_smt name: statement prose: "When procuring high assurance information technology (IT) equipment, ASD is contacted for any equipment-specific delivery procedures." - title: Evaluated product usage props: - name: sort-id value: "catalog[1].group[12].group[2]" parts: - name: overview prose: |- # Context An evaluated product is operating in an evaluated configuration if: - functionality that it uses was in the scope of the evaluation and it is implemented in the specified manner - only product updates that have been assessed through maintenance and re-evaluation activities (known as assurance continuity) have been applied - the environment complies with assumptions or organisational security policies stated in the evaluation documentation. Conversely, an evaluated product is operating in an unevaluated configuration when it does not meet the requirements of the evaluated configuration and guidance provided in its certification report. In most cases, the latest patched version of an evaluated product will be more secure than an older unpatched version. While the application of patches will not normally place an evaluated product into an unevaluated configuration, some vendors may include new functionality that has not been evaluated with their patches. In such cases, an organisation should use their judgement to determine whether this deviation from the evaluated configuration constitutes additional security risk or not. # Further information Further information on patching or updating IT equipment can be found in the ‘System maintenance’ section of the [Guidelines for system management](#c6ca6620-ccd5-4c5d-b97c-9d92f1162948). Further information on the installation, configuration, administration and operation of Common Criteria products is available from vendors and can be found in evaluation documentation on the Common Criteria’s [Certified Products List](#29b04eaf-5f57-4ea1-a453-8047826dccf5). Further information on the installation, configuration, administration and operation of high assurance IT equipment is available from ASD. groups: - title: Using evaluated products props: - name: sort-id value: "catalog[1].group[12].group[2].group[1]" parts: - name: overview prose: "Product evaluation provides assurance that a product and its security functionality will operate as expected when used in a clearly defined configuration. The scope of the evaluation specifies how the product is to be installed, configured, administered and operated, as well as the security functionality to be used. Using an evaluated product in an unevaluated configuration could introduce security risks that were not considered as part of the product’s evaluation." controls: - id: ism-0289 class: ISM-control title: "Control: ism-0289" props: - name: sort-id value: "catalog[1].group[12].group[2].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0289_smt name: statement prose: "Evaluated products are installed, configured, administered and operated in an evaluated configuration and in accordance with vendor guidance." - id: ism-0290 class: ISM-control title: "Control: ism-0290" props: - name: sort-id value: "catalog[1].group[12].group[2].group[1].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "9" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0290_smt name: statement prose: "High assurance IT equipment is installed, configured, administered and operated in an evaluated configuration and in accordance with ASD guidance." - title: Guidelines for information technology equipment props: - name: sort-id value: "catalog[1].group[13]" groups: - title: IT equipment usage props: - name: sort-id value: "catalog[1].group[13].group[1]" parts: - name: overview prose: |- # Further information Further information on cyber supply chain risk management can be found in the ‘Cyber supply chain risk management’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on securing IT equipment when not in use can be found in the ‘IT equipment and media’ section of the [Guidelines for physical security](#4deea7ea-18a2-4fd7-8b25-0b3603215df2). Further information on encrypting media within IT equipment can be found in the ‘Cryptographic fundamentals’ section of the [Guidelines for cryptography](#195abe87-bb1e-4006-8b42-eaecca4d51f1). Further information on the protection of IT equipment can be found in the Department of Home Affairs’ [Protective Security Policy Framework](#92679127-f61d-486a-a93e-df2a26dfb07a). groups: - title: IT equipment management policy props: - name: sort-id value: "catalog[1].group[13].group[1].group[1]" parts: - name: overview prose: "Since information technology (IT) equipment can process, store or communicate sensitive or classified data, it is important that an IT equipment management policy is developed, implemented and maintained to ensure that IT equipment, and the data it processes, stores or communicates, is protected in an appropriate manner." controls: - id: ism-1551 class: ISM-control title: "Control: ism-1551" props: - name: sort-id value: "catalog[1].group[13].group[1].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1551_smt name: statement prose: "An IT equipment management policy is developed, implemented and maintained." - title: Hardening IT equipment configurations props: - name: sort-id value: "catalog[1].group[13].group[1].group[2]" parts: - name: overview prose: "When IT equipment is deployed in its default state, or with an unapproved configuration, it can lead to an insecure operating environment that may allow malicious actors to gain an initial foothold on networks. Many settings exist within IT equipment enabling them to be configured in an approved secure state to minimise this security risk. As such, the Australian Signals Directorate (ASD) and vendors often produce hardening guidance to assist in hardening the configuration of IT equipment. However, in situations where ASD and vendor hardening guidance conflicts, precedence should be given to implementing the most restrictive guidance." controls: - id: ism-1913 class: ISM-control title: "Control: ism-1913" props: - name: sort-id value: "catalog[1].group[13].group[1].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1913_smt name: statement prose: "Approved configurations for IT equipment are developed, implemented and maintained." - id: ism-1858 class: ISM-control title: "Control: ism-1858" props: - name: sort-id value: "catalog[1].group[13].group[1].group[2].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1858_smt name: statement prose: "IT equipment is hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur." - title: IT equipment registers props: - name: sort-id value: "catalog[1].group[13].group[1].group[3]" parts: - name: overview prose: "Developing, implementing, maintaining and regularly verifying registers of authorised IT equipment can assist an organisation in tracking legitimate IT equipment as well as determining whether unauthorised IT equipment, such as workstations, servers and network devices, have been introduced into their organisation. In doing so, an organisation may choose to split their IT equipment register into two by focusing on whether IT equipment is connected to their network or not." controls: - id: ism-0336 class: ISM-control title: "Control: ism-0336" props: - name: sort-id value: "catalog[1].group[13].group[1].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "10" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0336_smt name: statement prose: "A networked IT equipment register is developed, implemented, maintained and regularly verified." - id: ism-1869 class: ISM-control title: "Control: ism-1869" props: - name: sort-id value: "catalog[1].group[13].group[1].group[3].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1869_smt name: statement prose: "A non-networked IT equipment register is developed, implemented, maintained and regularly verified." - title: Labelling IT equipment props: - name: sort-id value: "catalog[1].group[13].group[1].group[4]" parts: - name: overview prose: |- Applying protective markings to IT equipment assists to reduce the likelihood that a human user will accidentally input data into it that it is not approved for processing, storing or communicating. While text-based protective markings are typically used for labelling IT equipment, there may be circumstances where colour-based protective markings or other marking schemes need to be used instead. In such cases, the marking scheme will need to be documented and personnel trained in its use. controls: - id: ism-0294 class: ISM-control title: "Control: ism-0294" props: - name: sort-id value: "catalog[1].group[13].group[1].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0294_smt name: statement prose: "IT equipment, except for high assurance IT equipment, is labelled with protective markings reflecting its sensitivity or classification." - title: Labelling high assurance IT equipment props: - name: sort-id value: "catalog[1].group[13].group[1].group[5]" parts: - name: overview prose: "High assurance IT equipment often has tamper-evident seals placed on its external surfaces. To assist human users in noticing changes to these seals, and to prevent functionality being degraded, an organisation should limit the use of labels on high assurance IT equipment." controls: - id: ism-0296 class: ISM-control title: "Control: ism-0296" props: - name: sort-id value: "catalog[1].group[13].group[1].group[5].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0296_smt name: statement prose: ASD’s approval is sought before applying labels to external surfaces of high assurance IT equipment. - title: Classifying IT equipment props: - name: sort-id value: "catalog[1].group[13].group[1].group[6]" parts: - name: overview prose: |- The purpose of classifying IT equipment is to acknowledge the sensitivity or classification of data that it is approved for processing, storing or communicating. Classifying IT equipment also assists in ensuring that the appropriate sanitisation, destruction and disposal processes are followed at the end of its life. controls: - id: ism-0293 class: ISM-control title: "Control: ism-0293" props: - name: sort-id value: "catalog[1].group[13].group[1].group[6].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0293_smt name: statement prose: "IT equipment is classified based on the highest sensitivity or classification of data that it is approved for processing, storing or communicating." - title: Handling IT equipment props: - name: sort-id value: "catalog[1].group[13].group[1].group[7]" parts: - name: overview prose: "When IT equipment displays, processes, stores or communicates sensitive or classified data, it will need to be handled as per the sensitivity or classification of that data. However, applying encryption to media within the IT equipment may change the way it needs to be handled. Any change in handling needs to be based on the original sensitivity or classification of data residing on media within the IT equipment and the level of assurance in the cryptographic equipment, applications or libraries being used to encrypt it." controls: - id: ism-1599 class: ISM-control title: "Control: ism-1599" props: - name: sort-id value: "catalog[1].group[13].group[1].group[7].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1599_smt name: statement prose: IT equipment is handled in a manner suitable for its sensitivity or classification. - title: IT equipment maintenance or repairs props: - name: sort-id value: "catalog[1].group[13].group[2]" parts: - name: overview prose: |- # Further information Further information on cyber supply chain risk management can be found in the ‘Cyber supply chain risk management’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on the sanitisation of media can be found in the ‘Media sanitisation’ section of the [Guidelines for media](#b594c9c0-b42f-4f06-b643-38023275a5c7). groups: - title: Maintenance or repairs of high assurance IT equipment props: - name: sort-id value: "catalog[1].group[13].group[2].group[1]" parts: - name: overview prose: "Due to the nature of high assurance IT equipment, it is important that ASD’s approval is sought before any maintenance or repairs are undertaken." controls: - id: ism-1079 class: ISM-control title: "Control: ism-1079" props: - name: sort-id value: "catalog[1].group[13].group[2].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1079_smt name: statement prose: ASD’s approval is sought before undertaking any maintenance or repairs to high assurance IT equipment. - title: On-site maintenance or repairs props: - name: sort-id value: "catalog[1].group[13].group[2].group[2]" parts: - name: overview prose: "Undertaking maintenance or repairs to IT equipment could impact its integrity. As such, using an appropriately cleared technician to undertake such work is considered the most secure approach. This ensures that if data is disclosed, the technician understands the requirements for its protection. Conversely, an organisation choosing to use a technician who is not appropriately cleared to undertake such work should ensure that cleared and knowledgeable personnel escort the technician while the work is undertaken." controls: - id: ism-0305 class: ISM-control title: "Control: ism-0305" props: - name: sort-id value: "catalog[1].group[13].group[2].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0305_smt name: statement prose: Maintenance or repairs of IT equipment are carried out on site by an appropriately cleared technician. - id: ism-0307 class: ISM-control title: "Control: ism-0307" props: - name: sort-id value: "catalog[1].group[13].group[2].group[2].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0307_smt name: statement prose: "If an appropriately cleared technician is not used to undertake maintenance or repairs to IT equipment, the IT equipment and associated media are sanitised before maintenance or repairs." - id: ism-0306 class: ISM-control title: "Control: ism-0306" props: - name: sort-id value: "catalog[1].group[13].group[2].group[2].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0306_smt name: statement prose: |- If an appropriately cleared technician is not used to undertake maintenance or repairs to IT equipment, the technician is escorted by someone who: - has the authority to direct the technician - is appropriately cleared and briefed - is sufficiently familiar with the IT equipment to understand the work being undertaken - takes all responsible measures to ensure the integrity of the IT equipment - takes due care to ensure that data is not disclosed. - title: Off-site maintenance or repairs props: - name: sort-id value: "catalog[1].group[13].group[2].group[3]" parts: - name: overview prose: "An organisation choosing to have IT equipment maintained or repaired off site should do so at facilities approved for handling the sensitivity or classification of the IT equipment. However, an organisation may be able to sanitise the IT equipment prior to transport, and subsequent maintenance or repairs, to change how it needs to be handled." controls: - id: ism-0310 class: ISM-control title: "Control: ism-0310" props: - name: sort-id value: "catalog[1].group[13].group[2].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "9" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0310_smt name: statement prose: IT equipment maintained or repaired off site is handled at facilities approved for handling the sensitivity or classification of the IT equipment. - title: Inspection of IT equipment following maintenance or repairs props: - name: sort-id value: "catalog[1].group[13].group[2].group[4]" parts: - name: overview prose: "Following maintenance or repairs to IT equipment, it is important that it is inspected to ensure that it retains its approved configuration and that no unauthorised modifications have been made." controls: - id: ism-1598 class: ISM-control title: "Control: ism-1598" props: - name: sort-id value: "catalog[1].group[13].group[2].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1598_smt name: statement prose: "Following maintenance or repairs to IT equipment, it is inspected to confirm that it retains its approved configuration and that no unauthorised modifications have been made." - title: IT equipment sanitisation and destruction props: - name: sort-id value: "catalog[1].group[13].group[3]" parts: - name: overview prose: |- # Further information Further information on the sanitisation of media can be found in the ‘Media sanitisation’ section of the [Guidelines for media](#b594c9c0-b42f-4f06-b643-38023275a5c7). Further information on the destruction of media can be found in the ‘Media destruction’ section of the [Guidelines for media](#b594c9c0-b42f-4f06-b643-38023275a5c7). Further information on the sanitisation of network devices is available from vendors and can be found in evaluation documentation on the Common Criteria’s [Certified Products List](#29b04eaf-5f57-4ea1-a453-8047826dccf5). groups: - title: IT equipment sanitisation processes and procedures props: - name: sort-id value: "catalog[1].group[13].group[3].group[1]" parts: - name: overview prose: "Developing, implementing and maintaining processes and procedures for IT equipment sanitisation will ensure that an organisation carries out IT equipment sanitisation in an appropriate and consistent manner." controls: - id: ism-0313 class: ISM-control title: "Control: ism-0313" props: - name: sort-id value: "catalog[1].group[13].group[3].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0313_smt name: statement prose: "IT equipment sanitisation processes, and supporting IT equipment sanitisation procedures, are developed, implemented and maintained." - title: IT equipment destruction processes and procedures props: - name: sort-id value: "catalog[1].group[13].group[3].group[2]" parts: - name: overview prose: "Developing, implementing and maintaining processes and procedures for IT equipment destruction will ensure that an organisation carries out IT equipment destruction in an appropriate and consistent manner." controls: - id: ism-1741 class: ISM-control title: "Control: ism-1741" props: - name: sort-id value: "catalog[1].group[13].group[3].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1741_smt name: statement prose: "IT equipment destruction processes, and supporting IT equipment destruction procedures, are developed, implemented and maintained." - title: Sanitising IT equipment props: - name: sort-id value: "catalog[1].group[13].group[3].group[3]" parts: - name: overview prose: |- When sanitising IT equipment, any media within the IT equipment should be removed or sanitised. Once any media has been removed or sanitised, IT equipment can be considered sanitised. However, if media cannot be removed or sanitised, the IT equipment should be destroyed as per media destruction requirements. Media typically found in IT equipment includes: - electrostatic memory devices, such as laser printer cartridges used in multifunction devices (MFDs) - non-volatile magnetic memory, such as hard disks - non-volatile semiconductor memory, such as flash cards and solid-state drives - volatile memory, such as random-access memory sticks. controls: - id: ism-0311 class: ISM-control title: "Control: ism-0311" props: - name: sort-id value: "catalog[1].group[13].group[3].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0311_smt name: statement prose: IT equipment containing media is sanitised by removing the media from the IT equipment or by sanitising the media in situ. - id: ism-1742 class: ISM-control title: "Control: ism-1742" props: - name: sort-id value: "catalog[1].group[13].group[3].group[3].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1742_smt name: statement prose: IT equipment that cannot be sanitised is destroyed. - title: Sanitising highly sensitive IT equipment props: - name: sort-id value: "catalog[1].group[13].group[3].group[4]" parts: - name: overview prose: "IT equipment located overseas that has processed, stored or communicated Australian Eyes Only (AUSTEO) or Australian Government Access Only (AGAO) data can have more severe consequences for Australian interests if not sanitised appropriately." controls: - id: ism-1218 class: ISM-control title: "Control: ism-1218" props: - name: sort-id value: "catalog[1].group[13].group[3].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1218_smt name: statement prose: "IT equipment, including associated media, that is located overseas and has processed, stored or communicated AUSTEO or AGAO data, is sanitised in situ." - id: ism-0312 class: ISM-control title: "Control: ism-0312" props: - name: sort-id value: "catalog[1].group[13].group[3].group[4].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0312_smt name: statement prose: "IT equipment, including associated media, that is located overseas and has processed, stored or communicated AUSTEO or AGAO data that cannot be sanitised in situ, is returned to Australia for destruction." - title: Destroying high assurance IT equipment props: - name: sort-id value: "catalog[1].group[13].group[3].group[5]" parts: - name: overview prose: "Due to the nature of high assurance IT equipment, and many of the protective mechanisms it employs, sanitisation alone is not sufficient prior to its disposal. As such, all high assurance IT equipment should be destroyed prior to its disposal." controls: - id: ism-0315 class: ISM-control title: "Control: ism-0315" props: - name: sort-id value: "catalog[1].group[13].group[3].group[5].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "9" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0315_smt name: statement prose: High assurance IT equipment is destroyed prior to its disposal. - title: Sanitising printers and multifunction devices props: - name: sort-id value: "catalog[1].group[13].group[3].group[6]" parts: - name: overview prose: |- When sanitising printers and MFDs, the printer cartridge or MFD print drum should be sanitised in addition to the removal or sanitisation of any media. This can be achieved by printing random text with no blank areas on each colour printer cartridge or MFD print drum. In addition, image transfer rollers and platens can become imprinted with text and images over time and should be destroyed if any text or images have been retained. Finally, any paper jammed in the paper path should be removed. When printer cartridges and MFD print drums cannot be sanitised due to a hardware failure, or when they are empty, there is no other option but to destroy them. Printer ribbons cannot be sanitised and should be destroyed. controls: - id: ism-0317 class: ISM-control title: "Control: ism-0317" props: - name: sort-id value: "catalog[1].group[13].group[3].group[6].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0317_smt name: statement prose: At least three pages of random text with no blank areas are printed on each colour printer cartridge or MFD print drum. - id: ism-1219 class: ISM-control title: "Control: ism-1219" props: - name: sort-id value: "catalog[1].group[13].group[3].group[6].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1219_smt name: statement prose: MFD print drums and image transfer rollers are inspected and destroyed if there is remnant toner that cannot be removed or a print is visible on the image transfer roller. - id: ism-1220 class: ISM-control title: "Control: ism-1220" props: - name: sort-id value: "catalog[1].group[13].group[3].group[6].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1220_smt name: statement prose: Printer and MFD platens are inspected and destroyed if any text or images are retained on the platen. - id: ism-1221 class: ISM-control title: "Control: ism-1221" props: - name: sort-id value: "catalog[1].group[13].group[3].group[6].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1221_smt name: statement prose: Printers and MFDs are checked to ensure no pages are trapped in the paper path due to a paper jam. - id: ism-0318 class: ISM-control title: "Control: ism-0318" props: - name: sort-id value: "catalog[1].group[13].group[3].group[6].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0318_smt name: statement prose: "When unable to sanitise printer cartridges or MFD print drums, they are destroyed as per electrostatic memory devices." - id: ism-1534 class: ISM-control title: "Control: ism-1534" props: - name: sort-id value: "catalog[1].group[13].group[3].group[6].control[6]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1534_smt name: statement prose: Printer ribbons in printers and MFDs are removed and destroyed. - title: Sanitising televisions and computer monitors props: - name: sort-id value: "catalog[1].group[13].group[3].group[7]" parts: - name: overview prose: |- All types of televisions and computer monitors can retain data if mitigating measures are not taken during their lifetime. Cathode Ray Tube monitors and plasma screens can be affected by burn-in while Liquid Crystal Display and Organic Light Emitting Diode screens can be affected by image persistence. Televisions and computer monitors can be visually inspected by turning up the brightness and contrast to their maximum level to determine if any data has been burnt into or persists on the screen. If burn-in or image persistence is removed by this activity, televisions and computer monitors can be considered sanitised. However, if burn-in or persistence is not removed through these measures, televisions and computer monitors cannot be sanitised and should be destroyed. If televisions or computer monitors cannot be powered on, such as due to a faulty power supply, they cannot be sanitised and should be destroyed. controls: - id: ism-1076 class: ISM-control title: "Control: ism-1076" props: - name: sort-id value: "catalog[1].group[13].group[3].group[7].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1076_smt name: statement prose: Televisions and computer monitors with minor burn-in or image persistence are sanitised by displaying a solid white image on the screen for an extended period. - id: ism-1222 class: ISM-control title: "Control: ism-1222" props: - name: sort-id value: "catalog[1].group[13].group[3].group[7].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1222_smt name: statement prose: Televisions and computer monitors that cannot be sanitised are destroyed. - title: Sanitising network devices props: - name: sort-id value: "catalog[1].group[13].group[3].group[8]" parts: - name: overview prose: "As network devices can store network configuration data or credentials in their memory, the memory should be sanitised prior to the disposal of the network devices. The correct method to sanitise network devices will depend on their configuration and the type of memory they use. As such, device-specific guidance provided in evaluation documentation, or vendor sanitisation guidance, should be consulted to determine the most appropriate method to sanitise memory in network devices." controls: - id: ism-1223 class: ISM-control title: "Control: ism-1223" props: - name: sort-id value: "catalog[1].group[13].group[3].group[8].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1223_smt name: statement prose: |- Memory in network devices is sanitised using the following processes, in order of preference: - following device-specific guidance provided in evaluation documentation - following vendor sanitisation guidance - loading a dummy configuration file, performing a factory reset and then reinstalling firmware. - title: IT equipment disposal props: - name: sort-id value: "catalog[1].group[13].group[4]" groups: - title: IT equipment disposal processes and procedures props: - name: sort-id value: "catalog[1].group[13].group[4].group[1]" parts: - name: overview prose: "Developing, implementing and maintaining processes and procedures for IT equipment disposal will ensure that an organisation carries out IT equipment disposal in an appropriate and consistent manner." controls: - id: ism-1550 class: ISM-control title: "Control: ism-1550" props: - name: sort-id value: "catalog[1].group[13].group[4].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1550_smt name: statement prose: "IT equipment disposal processes, and supporting IT equipment disposal procedures, are developed, implemented and maintained." - title: Disposal of IT equipment props: - name: sort-id value: "catalog[1].group[13].group[4].group[2]" parts: - name: overview prose: "Before IT equipment can be released into the public domain, it needs to be sanitised, destroyed or declassified. As sanitised, destroyed or declassified IT equipment still presents a security risk, albeit minor, an appropriate authority needs to formally authorise its release into the public domain. Furthermore, as part of disposal processes, removing labels and markings indicating the owner, sensitivity, classification or any other marking that can associate IT equipment with its prior use will ensure it does not draw undue attention following its disposal." controls: - id: ism-1217 class: ISM-control title: "Control: ism-1217" props: - name: sort-id value: "catalog[1].group[13].group[4].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1217_smt name: statement prose: "Labels and markings indicating the owner, sensitivity, classification or any other marking that can associate IT equipment with its prior use are removed prior to its disposal." - id: ism-0321 class: ISM-control title: "Control: ism-0321" props: - name: sort-id value: "catalog[1].group[13].group[4].group[2].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0321_smt name: statement prose: "When disposing of IT equipment that has been designed or modified to meet emanation security standards, ASD is contacted for requirements relating to its disposal." - id: ism-0316 class: ISM-control title: "Control: ism-0316" props: - name: sort-id value: "catalog[1].group[13].group[4].group[2].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0316_smt name: statement prose: "Following sanitisation, destruction or declassification, a formal administrative decision is made to release IT equipment, or its waste, into the public domain." - title: Guidelines for media props: - name: sort-id value: "catalog[1].group[14]" groups: - title: Media usage props: - name: sort-id value: "catalog[1].group[14].group[1]" parts: - name: overview prose: |- # Further information Further information on cyber supply chain risk management can be found in the ‘Cyber supply chain risk management’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on the protection of media can be found in the Department of Home Affairs’ [Protective Security Policy Framework](#92679127-f61d-486a-a93e-df2a26dfb07a). Further information on securing media when not in use can be found in the ‘IT equipment and media’ section of the [Guidelines for physical security](#4deea7ea-18a2-4fd7-8b25-0b3603215df2). Further information on encrypting media can be found in the ‘Cryptographic fundamentals’ section of the [Guidelines for cryptography](#195abe87-bb1e-4006-8b42-eaecca4d51f1). Further information on using media to transfer data between systems can be found in the ‘Data transfers’ section of the [Guidelines for data transfers](#1eefdaf7-3991-4ba2-9439-79565f508c44). groups: - title: Media management policy props: - name: sort-id value: "catalog[1].group[14].group[1].group[01]" parts: - name: overview prose: "Since media can store sensitive or classified data, it is important that a media management policy is developed, implemented and maintained to ensure that all types of media, and the data it stores, is protected in an appropriate manner. In many cases, an organisation’s media management policy will be closely tied to their removable media usage policy." controls: - id: ism-1549 class: ISM-control title: "Control: ism-1549" props: - name: sort-id value: "catalog[1].group[14].group[1].group[01].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1549_smt name: statement prose: "A media management policy is developed, implemented and maintained." - title: Removable media usage policy props: - name: sort-id value: "catalog[1].group[14].group[1].group[02]" parts: - name: overview prose: |- Establishing a removable media usage policy can decrease the likelihood and consequence of data spills, data loss and data theft. In doing so, a removable media usage policy will likely cover the following: - permitted types and uses of removable media - registration and labelling of removable media - handling and protection of removable media - reporting of lost or stolen removable media - sanitisation or destruction of removable media at the end of its life. controls: - id: ism-1359 class: ISM-control title: "Control: ism-1359" props: - name: sort-id value: "catalog[1].group[14].group[1].group[02].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1359_smt name: statement prose: "A removable media usage policy is developed, implemented and maintained." - title: Removable media register props: - name: sort-id value: "catalog[1].group[14].group[1].group[03]" parts: - name: overview prose: "Developing, implementing, maintaining and regularly verifying a register of removable media can assist an organisation in tracking and accounting for authorised removable media as well as identifying any unauthorised removable media in use within their organisation." controls: - id: ism-1713 class: ISM-control title: "Control: ism-1713" props: - name: sort-id value: "catalog[1].group[14].group[1].group[03].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1713_smt name: statement prose: "A removable media register is developed, implemented, maintained and regularly verified." - title: Labelling media props: - name: sort-id value: "catalog[1].group[14].group[1].group[04]" parts: - name: overview prose: |- Labelling media helps personnel to identify its sensitivity or classification and ensure that appropriate measures are applied to its storage, handling and use. While text-based protective markings are typically used for labelling media, there may be circumstances where colour-based protective markings or other marking schemes need to be used instead. In such cases, the marking scheme will need to be documented and personnel trained in its use. controls: - id: ism-0332 class: ISM-control title: "Control: ism-0332" props: - name: sort-id value: "catalog[1].group[14].group[1].group[04].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0332_smt name: statement prose: "Media, except for internally mounted fixed media within information technology equipment, is labelled with protective markings reflecting its sensitivity or classification." - title: Classifying media props: - name: sort-id value: "catalog[1].group[14].group[1].group[05]" parts: - name: overview prose: "Media that is not correctly classified could be stored and handled inappropriately, accessed by personnel who do not have an appropriate security clearance or used with systems it is not authorised to be used with." controls: - id: ism-0323 class: ISM-control title: "Control: ism-0323" props: - name: sort-id value: "catalog[1].group[14].group[1].group[05].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0323_smt name: statement prose: "Media is classified to the highest sensitivity or classification of data it stores, unless the media has been classified to a higher sensitivity or classification." - id: ism-0337 class: ISM-control title: "Control: ism-0337" props: - name: sort-id value: "catalog[1].group[14].group[1].group[05].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0337_smt name: statement prose: "Media is only used with systems that are authorised to process, store or communicate its sensitivity or classification." - title: Reclassifying media props: - name: sort-id value: "catalog[1].group[14].group[1].group[06]" parts: - name: overview prose: "Some activities may necessitate or allow for a change to the sensitivity or classification of media. For example, when media is connected to a system that lacks a mechanism through which read-only access can be ensured, when media is sanitised or destroyed, or when data stored on media is subject to a sensitivity or classification change." controls: - id: ism-0325 class: ISM-control title: "Control: ism-0325" props: - name: sort-id value: "catalog[1].group[14].group[1].group[06].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Apr-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0325_smt name: statement prose: "Any media connected to a system with a higher sensitivity or classification than the media is reclassified to the higher sensitivity or classification, unless the media is read-only or the system has a mechanism through which read-only access can be ensured." - id: ism-0330 class: ISM-control title: "Control: ism-0330" props: - name: sort-id value: "catalog[1].group[14].group[1].group[06].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0330_smt name: statement prose: "Before reclassifying media to a lower sensitivity or classification, the media is sanitised or destroyed, and a formal administrative decision is made to reclassify it." - title: Encrypting media props: - name: sort-id value: "catalog[1].group[14].group[1].group[07]" parts: - name: overview prose: |- Suitably encrypting media will help prevent malicious actors from gaining easy access to any sensitive or classified data stored on it if it is lost or stolen. As such, it is critical that Australian Signals Directorate (ASD)-approved cryptography is used. Furthermore, applying encryption to media may change the way it needs to be handled. In doing so, any change in handling needs to be based on the original sensitivity or classification of the media and the level of assurance in the cryptographic equipment, applications or libraries being used to encrypt it. Finally, when encryption is applied to media, it is important that full disk encryption is used as it provides a greater level of protection than file-based encryption. This is because while file-based encryption may encrypt individual files, there is the possibility that unencrypted copies of files may be left in temporary locations used by an operating system. controls: - id: ism-1059 class: ISM-control title: "Control: ism-1059" props: - name: sort-id value: "catalog[1].group[14].group[1].group[07].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1059_smt name: statement prose: All data stored on media is encrypted using ASD-approved cryptography. - id: ism-0459 class: ISM-control title: "Control: ism-0459" props: - name: sort-id value: "catalog[1].group[14].group[1].group[07].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0459_smt name: statement prose: "Full disk encryption, or partial encryption where access controls only allow writing to encrypted partitions or volumes, is implemented when encrypting media." - id: ism-2109 class: ISM-control title: "Control: ism-2109" props: - name: sort-id value: "catalog[1].group[14].group[1].group[07].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2109_smt name: statement prose: "Pre-boot authentication using passwords, or managed network-based key release, is implemented for media containing encrypted system volumes." - title: Handling media props: - name: sort-id value: "catalog[1].group[14].group[1].group[08]" parts: - name: overview prose: "As media can be easily misplaced or stolen, physical handling measures should be put in place to protect the data stored on it." controls: - id: ism-0831 class: ISM-control title: "Control: ism-0831" props: - name: sort-id value: "catalog[1].group[14].group[1].group[08].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0831_smt name: statement prose: Media is handled in a manner suitable for its sensitivity or classification. - title: Sanitising media before first use props: - name: sort-id value: "catalog[1].group[14].group[1].group[09]" parts: - name: overview prose: "Sanitising media before first use can assist in reducing cyber supply chain risks, such as new media containing malicious code. In addition, sanitising media before first use in a different security domain can prevent potential data spills from occurring." controls: - id: ism-1600 class: ISM-control title: "Control: ism-1600" props: - name: sort-id value: "catalog[1].group[14].group[1].group[09].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Apr-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1600_smt name: statement prose: Media is sanitised before it is used for the first time. - id: ism-1642 class: ISM-control title: "Control: ism-1642" props: - name: sort-id value: "catalog[1].group[14].group[1].group[09].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Apr-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1642_smt name: statement prose: Media is sanitised before it is reused in a different security domain. - title: Using media for data transfers props: - name: sort-id value: "catalog[1].group[14].group[1].group[10]" parts: - name: overview prose: |- An organisation transferring data between systems belonging to different security domains is strongly encouraged to use write-once media. When done properly, such as using non-rewritable compact discs that have been finalised, this ensures that data from the destination system cannot be accidentally transferred, or maliciously exfiltrated, onto the media and then onto another system. Alternatively, if suitable write-once media is not used, the destination system should have a mechanism through which read-only access can be ensured, such as via a read-only device or hardware write-blocker. However, the use of read-only mechanisms is not immune to failure or compromise. Therefore, rewritable media should still be sanitised following each data transfer. It is important to note that for most non-volatile flash memory media, it will be possible to sanitise and reclassify it following a data transfer to allow it to be connected to other systems again. This is not possible for SECRET and TOP SECRET non-volatile flash memory media as it cannot be reclassified following sanitisation. controls: - id: ism-0347 class: ISM-control title: "Control: ism-0347" props: - name: sort-id value: "catalog[1].group[14].group[1].group[10].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Apr-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0347_smt name: statement prose: "When transferring data manually between two systems belonging to different security domains, write-once media is used unless the destination system has a mechanism through which read-only access can be ensured." - id: ism-0947 class: ISM-control title: "Control: ism-0947" props: - name: sort-id value: "catalog[1].group[14].group[1].group[10].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Apr-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0947_smt name: statement prose: "When transferring data manually between two systems belonging to different security domains, rewritable media is sanitised after each data transfer." - title: Media sanitisation props: - name: sort-id value: "catalog[1].group[14].group[2]" parts: - name: overview prose: |- # Context When sanitising hybrid hard drives, first separate the non-volatile magnetic media from the circuit board containing non-volatile flash memory media and then sanitise each separately. When sanitising solid-state drives, the method for sanitising non-volatile flash memory media applies. # Further information Further information on the random-access memory testing tool [MemTest86](#629818d8-430c-4125-8fd2-5e3f988fce21) can be obtained from PassMark Software. Further information on the graphics card random-access memory testing tools [MemtestG80](#39e186f3-d175-4eed-afe6-2b9a7a936a91) and [MemtestCL](#9d38f42d-eeff-4124-93db-4b29abaafb67) can be obtained from their GitHub projects. Further information on HDDerase is available from the [Center for Memory and Recording Research](#401ed034-e2bd-43b4-9fde-05d07618039a) at the University of California San Diego. HDDerase can call the ATA secure erase command as well as reset the host-protected area and device configuration overlay table on non-volatile magnetic media. groups: - title: Media sanitisation processes and procedures props: - name: sort-id value: "catalog[1].group[14].group[2].group[01]" parts: - name: overview prose: "Using approved methods to sanitise media provides a level of assurance that, to the extent possible, no data will be left following sanitisation. The methods described in these guidelines are designed not only to prevent common data recovery practices but also to protect from those that could emerge in the future." controls: - id: ism-0348 class: ISM-control title: "Control: ism-0348" props: - name: sort-id value: "catalog[1].group[14].group[2].group[01].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0348_smt name: statement prose: "Media sanitisation processes, and supporting media sanitisation procedures, are developed, implemented and maintained." - title: Volatile media sanitisation props: - name: sort-id value: "catalog[1].group[14].group[2].group[02]" parts: - name: overview prose: "When sanitising volatile media, the specified time to wait following the removal of power is based on applying a safety factor to the time recommended by research into preventing the recovery of data. In addition to the removal of power, SECRET and TOP SECRET volatile media should be overwritten at least once in its entirety with a random pattern followed by a read back for verification." controls: - id: ism-0351 class: ISM-control title: "Control: ism-0351" props: - name: sort-id value: "catalog[1].group[14].group[2].group[02].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0351_smt name: statement prose: Volatile media is sanitised by removing its power for at least 10 minutes. - id: ism-0352 class: ISM-control title: "Control: ism-0352" props: - name: sort-id value: "catalog[1].group[14].group[2].group[02].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0352_smt name: statement prose: SECRET and TOP SECRET volatile media is sanitised by overwriting it at least once in its entirety with a random pattern followed by a read back for verification. - title: Treatment of volatile media following sanitisation props: - name: sort-id value: "catalog[1].group[14].group[2].group[03]" parts: - name: overview prose: |- Research suggests that short-term remanence effects are likely in volatile media. For example, up to minutes at normal room temperatures and up to hours in extremely cold temperatures. Furthermore, some volatile media can suffer from long-term remanence effects resulting from physical changes due to the continuous storage of static data for extended periods. It is for these reasons that under certain circumstances TOP SECRET volatile media retains its classification following sanitisation. Typical circumstances preventing the reclassification of TOP SECRET volatile media include a static cryptographic key being stored in the same memory location during every boot of a device, or a static image being displayed on a device and stored in volatile media for a period of months. controls: - id: ism-0835 class: ISM-control title: "Control: ism-0835" props: - name: sort-id value: "catalog[1].group[14].group[2].group[03].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0835_smt name: statement prose: "Following sanitisation, TOP SECRET volatile media retains its classification if it stored static data for an extended period, or had data repeatedly stored on or written to the same memory location for an extended period." - title: Non-volatile magnetic media sanitisation props: - name: sort-id value: "catalog[1].group[14].group[2].group[04]" parts: - name: overview prose: |- Non-volatile magnetic media encompasses non-volatile magnetic hard drives, magnetic tape and floppy disks. While non-volatile magnetic tape and floppy disks can be sanitised by overwriting them at least once (or three times if pre-2001 or under 15 GB) in their entirety with a random pattern followed by a read back for verification, additional considerations apply to non-volatile magnetic hard drives due to their use of a host-protected area, device configuration overlay table and growth defects table. The host-protected area and device configuration overlay table of non-volatile magnetic hard drives are normally not visible to a computer’s Unified Extensible Firmware Interface or operating system. Therefore, any sanitisation of the readable sectors of non-volatile magnetic hard drives will leave any data contained in sectors listed in the host-protected area and device configuration overlay table untouched. Some sanitisation applications include the ability to reset non-volatile magnetic hard drives to their default state, removing any host-protected areas or device configuration overlays. This allows the sanitisation applications to see the entire contents of non-volatile magnetic hard drives during subsequent sanitisation processes. Modern non-volatile magnetic hard drives automatically reallocate space for bad sectors at a hardware level. These bad sectors are maintained in what is known as the growth defects table or ‘g-list’. If data was stored in a sector that was subsequently added to the growth defects table, sanitising the non-volatile magnetic hard drive will not overwrite such data. While these sectors may be considered bad by non-volatile magnetic hard drives, quite often this is due to the sectors no longer meeting expected performance norms and not due to an inability to read or write to them. The Advanced Technology Attachment (ATA) secure erase command was built into the firmware of post-2001 non-volatile magnetic hard drives and can access sectors that have been added to the growth defects table. Modern non-volatile magnetic hard drives also contain a primary defects table or ‘p-list’. The primary defects table contains a list of bad sectors found during post-production processes. No data is ever stored in sectors listed in the primary defects table as they are marked as inaccessible before non-volatile magnetic hard drives are used for the first time. controls: - id: ism-0354 class: ISM-control title: "Control: ism-0354" props: - name: sort-id value: "catalog[1].group[14].group[2].group[04].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0354_smt name: statement prose: Non-volatile magnetic media is sanitised by overwriting it at least once (or three times if pre-2001 or under 15 GB) in its entirety with a random pattern followed by a read back for verification. - id: ism-1065 class: ISM-control title: "Control: ism-1065" props: - name: sort-id value: "catalog[1].group[14].group[2].group[04].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1065_smt name: statement prose: The host-protected area and device configuration overlay table are reset prior to the sanitisation of non-volatile magnetic hard drives. - id: ism-1067 class: ISM-control title: "Control: ism-1067" props: - name: sort-id value: "catalog[1].group[14].group[2].group[04].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1067_smt name: statement prose: "The ATA secure erase command is used, in addition to block overwriting software, to ensure the growth defects table of non-volatile magnetic hard drives is overwritten." - title: Treatment of non-volatile magnetic media following sanitisation props: - name: sort-id value: "catalog[1].group[14].group[2].group[05]" parts: - name: overview prose: "Due to concerns with the sanitisation processes for non-volatile magnetic media, SECRET and TOP SECRET non-volatile magnetic media retains its classification following sanitisation." controls: - id: ism-0356 class: ISM-control title: "Control: ism-0356" props: - name: sort-id value: "catalog[1].group[14].group[2].group[05].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0356_smt name: statement prose: "Following sanitisation, SECRET and TOP SECRET non-volatile magnetic media retains its classification." - title: Non-volatile erasable programmable read-only memory media sanitisation props: - name: sort-id value: "catalog[1].group[14].group[2].group[06]" parts: - name: overview prose: "When sanitising non-volatile erasable programmable read-only memory (EPROM), three times the manufacturer’s specification for ultraviolet erasure time should be applied to provide additional certainty in sanitisation processes. Subsequently, the non-volatile EPROM media should be overwritten at least once in its entirety with a random pattern followed by a read back for verification." controls: - id: ism-0357 class: ISM-control title: "Control: ism-0357" props: - name: sort-id value: "catalog[1].group[14].group[2].group[06].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0357_smt name: statement prose: Non-volatile EPROM media is sanitised by applying three times the manufacturer’s specified ultraviolet erasure time and then overwriting it at least once in its entirety with a random pattern followed by a read back for verification. - title: Non-volatile electrically erasable programmable read-only memory media sanitisation props: - name: sort-id value: "catalog[1].group[14].group[2].group[07]" parts: - name: overview prose: "A single overwrite with a random pattern, followed by a read back for verification, is considered suitable for sanitising non-volatile electrically erasable programmable read-only memory (EEPROM) media." controls: - id: ism-0836 class: ISM-control title: "Control: ism-0836" props: - name: sort-id value: "catalog[1].group[14].group[2].group[07].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0836_smt name: statement prose: Non-volatile EEPROM media is sanitised by overwriting it at least once in its entirety with a random pattern followed by a read back for verification. - title: Treatment of non-volatile erasable and electrically erasable programmable read-only memory media following sanitisation props: - name: sort-id value: "catalog[1].group[14].group[2].group[08]" parts: - name: overview prose: "As little research has been conducted into the recovery of data from non-volatile EPROM and EEPROM media, SECRET and TOP SECRET EPROM and EEPROM media retains its classification following sanitisation." controls: - id: ism-0358 class: ISM-control title: "Control: ism-0358" props: - name: sort-id value: "catalog[1].group[14].group[2].group[08].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0358_smt name: statement prose: "Following sanitisation, SECRET and TOP SECRET non-volatile EPROM and EEPROM media retains its classification." - title: Non-volatile flash memory media sanitisation props: - name: sort-id value: "catalog[1].group[14].group[2].group[09]" parts: - name: overview prose: "For non-volatile flash memory media, a technique known as wear levelling ensures that writes are distributed evenly across each memory block. This feature necessitates non-volatile flash memory media being overwritten with a random pattern at least twice, and followed by a read back for verification, as this helps to ensure that all memory blocks are overwritten." controls: - id: ism-0359 class: ISM-control title: "Control: ism-0359" props: - name: sort-id value: "catalog[1].group[14].group[2].group[09].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0359_smt name: statement prose: Non-volatile flash memory media is sanitised by overwriting it at least twice in its entirety with a random pattern followed by a read back for verification. - title: Treatment of non-volatile flash memory media following sanitisation props: - name: sort-id value: "catalog[1].group[14].group[2].group[10]" parts: - name: overview prose: "Due to the use of wear levelling in non-volatile flash memory media, and the potential for bad memory blocks, it is possible that not all memory blocks will be overwritten during sanitisation processes. For this reason, SECRET and TOP SECRET non-volatile flash memory media retains its classification following sanitisation." controls: - id: ism-0360 class: ISM-control title: "Control: ism-0360" props: - name: sort-id value: "catalog[1].group[14].group[2].group[10].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0360_smt name: statement prose: "Following sanitisation, SECRET and TOP SECRET non-volatile flash memory media retains its classification." - title: Media that cannot be successfully sanitised props: - name: sort-id value: "catalog[1].group[14].group[2].group[11]" parts: - name: overview prose: "In some cases, attempts to sanitise media, or verify the sanitisation of media, will be unsuccessful. For example, due to the media being faulty or damaged. In such cases, the media will need to be destroyed prior to its disposal." controls: - id: ism-1735 class: ISM-control title: "Control: ism-1735" props: - name: sort-id value: "catalog[1].group[14].group[2].group[11].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1735_smt name: statement prose: Media that cannot be successfully sanitised is destroyed prior to its disposal. - title: Media destruction props: - name: sort-id value: "catalog[1].group[14].group[3]" parts: - name: overview prose: |- # Further information Further information on cyber supply chain risk management can be found in the ‘Cyber supply chain risk management’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). groups: - title: Media destruction processes and procedures props: - name: sort-id value: "catalog[1].group[14].group[3].group[1]" parts: - name: overview prose: "Developing, implementing and maintaining processes and procedures for media destruction will ensure that an organisation carries out media destruction in an appropriate and consistent manner." controls: - id: ism-0363 class: ISM-control title: "Control: ism-0363" props: - name: sort-id value: "catalog[1].group[14].group[3].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0363_smt name: statement prose: "Media destruction processes, and supporting media destruction procedures, are developed, implemented and maintained." - title: Media that cannot be sanitised props: - name: sort-id value: "catalog[1].group[14].group[3].group[2]" parts: - name: overview prose: "Some media types are incapable of being sanitised. As such, they will need to be destroyed prior to their disposal." controls: - id: ism-0350 class: ISM-control title: "Control: ism-0350" props: - name: sort-id value: "catalog[1].group[14].group[3].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0350_smt name: statement prose: |- The following media types are destroyed prior to their disposal: - microfiche and microfilm - optical discs - programmable read-only memory - read-only memory - other types of media that cannot be sanitised. - title: Media destruction equipment props: - name: sort-id value: "catalog[1].group[14].group[3].group[3]" parts: - name: overview prose: |- When physically destroying media, using approved equipment can provide a level of assurance that the data it stores is destroyed. Approved equipment includes destruction equipment listed on the Security Construction and Equipment Committee’s [Security Equipment Evaluated Products List](#f7e13f7b-eb48-4294-bd01-9c22c756d96b), and in the Australian Security Intelligence Organisation’s (ASIO) Security Equipment Guide-009, Optical Media Shredders and Security Equipment Guide-018, Destructors. ASIO’s Security Equipment Guides are available from the Protective Security Policy GovTEAMS community or ASIO by email. If using degaussers to destroy media, the United States’ National Security Agency maintains the [NSA/CSS Evaluated Products List for Magnetic Degaussers](#b0a56885-8484-42d6-af79-4c87237ede30) and information on common types of magnetic media and their associated magnetic field strengths and orientations. controls: - id: ism-1361 class: ISM-control title: "Control: ism-1361" props: - name: sort-id value: "catalog[1].group[14].group[3].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1361_smt name: statement prose: Security Construction and Equipment Committee-approved equipment or ASIO-approved equipment is used when destroying media. - id: ism-1160 class: ISM-control title: "Control: ism-1160" props: - name: sort-id value: "catalog[1].group[14].group[3].group[3].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Aug-20 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1160_smt name: statement prose: "If using degaussers to destroy media, degaussers evaluated by the United States’ National Security Agency are used." - title: Media destruction methods props: - name: sort-id value: "catalog[1].group[14].group[3].group[4]" parts: - name: overview prose: The destruction methods identified below are designed to ensure that recovery of data is impossible or impractical. controls: - id: ism-1517 class: ISM-control title: "Control: ism-1517" props: - name: sort-id value: "catalog[1].group[14].group[3].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1517_smt name: statement prose: "Equipment that is capable of reducing microform to a fine powder, with resultant particles not showing more than five consecutive characters per particle upon microscopic inspection, is used to destroy microfiche and microfilm." - id: ism-1722 class: ISM-control title: "Control: ism-1722" props: - name: sort-id value: "catalog[1].group[14].group[3].group[4].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1722_smt name: statement prose: "Electrostatic memory devices are destroyed using a furnace/incinerator, hammer mill, disintegrator or grinder/sander." - id: ism-1723 class: ISM-control title: "Control: ism-1723" props: - name: sort-id value: "catalog[1].group[14].group[3].group[4].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1723_smt name: statement prose: "Magnetic floppy disks are destroyed using a furnace/incinerator, hammer mill, disintegrator, degausser or by cutting." - id: ism-1724 class: ISM-control title: "Control: ism-1724" props: - name: sort-id value: "catalog[1].group[14].group[3].group[4].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1724_smt name: statement prose: "Magnetic hard disks are destroyed using a furnace/incinerator, hammer mill, disintegrator, grinder/sander or degausser." - id: ism-1725 class: ISM-control title: "Control: ism-1725" props: - name: sort-id value: "catalog[1].group[14].group[3].group[4].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1725_smt name: statement prose: "Magnetic tapes are destroyed using a furnace/incinerator, hammer mill, disintegrator, degausser or by cutting." - id: ism-1726 class: ISM-control title: "Control: ism-1726" props: - name: sort-id value: "catalog[1].group[14].group[3].group[4].control[6]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1726_smt name: statement prose: "Optical disks are destroyed using a furnace/incinerator, hammer mill, disintegrator, grinder/sander or by cutting." - id: ism-1727 class: ISM-control title: "Control: ism-1727" props: - name: sort-id value: "catalog[1].group[14].group[3].group[4].control[7]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1727_smt name: statement prose: "Semiconductor memory is destroyed using a furnace/incinerator, hammer mill or disintegrator." - id: ism-0368 class: ISM-control title: "Control: ism-0368" props: - name: sort-id value: "catalog[1].group[14].group[3].group[4].control[8]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0368_smt name: statement prose: "Media destroyed using a hammer mill, disintegrator, grinder/sander or by cutting results in media waste particles no larger than 9 mm." - title: Treatment of media waste particles props: - name: sort-id value: "catalog[1].group[14].group[3].group[5]" parts: - name: overview prose: "Following the destruction of SECRET and TOP SECRET media, normal accounting and verification processes and procedures do not apply. However, if a destruction method is used that results in the generation of media waste particles, such as a hammer mill, disintegrator, grinder/sander or by cutting, it may still need to be stored and handled as classified waste." controls: - id: ism-1728 class: ISM-control title: "Control: ism-1728" props: - name: sort-id value: "catalog[1].group[14].group[3].group[5].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S parts: - id: ism-1728_smt name: statement prose: "The resulting media waste particles from the destruction of SECRET media is stored and handled as OFFICIAL if less than or equal to 3 mm, PROTECTED if greater than 3 mm and less than or equal to 6 mm, or SECRET if greater than 6 mm and less than or equal to 9 mm." - id: ism-1729 class: ISM-control title: "Control: ism-1729" props: - name: sort-id value: "catalog[1].group[14].group[3].group[5].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1729_smt name: statement prose: "The resulting media waste particles from the destruction of TOP SECRET media is stored and handled as OFFICIAL if less than or equal to 3 mm, or SECRET if greater than 3 mm and less than or equal to 9 mm." - title: Degaussing magnetic media props: - name: sort-id value: "catalog[1].group[14].group[3].group[6]" parts: - name: overview prose: "Degaussing magnetic media changes its magnetic properties, permanently corrupting data. When degaussing magnetic media, care needs to be taken as a degausser of insufficient magnetic field strength will not be effective. In addition, since 2006 perpendicular magnetic media has progressively replaced longitudinal magnetic media. As some older degaussers are only capable of destroying longitudinal magnetic media, care needs to be taken to ensure that a degausser with a suitable magnetic orientation is also used. Furthermore, to ensure that degaussers are being used in the correct manner to effectively destroy magnetic media, product-specific directions provided by degausser manufacturers should be followed. Finally, to provide an additional level of assurance following the use of a degausser, magnetic media should be physically damaged by deforming any internal platters." controls: - id: ism-0361 class: ISM-control title: "Control: ism-0361" props: - name: sort-id value: "catalog[1].group[14].group[3].group[6].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0361_smt name: statement prose: Magnetic media is destroyed using a degausser with a suitable magnetic field strength and magnetic orientation. - id: ism-0362 class: ISM-control title: "Control: ism-0362" props: - name: sort-id value: "catalog[1].group[14].group[3].group[6].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0362_smt name: statement prose: Product-specific directions provided by degausser manufacturers are followed. - id: ism-1641 class: ISM-control title: "Control: ism-1641" props: - name: sort-id value: "catalog[1].group[14].group[3].group[6].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1641_smt name: statement prose: "Following the use of a degausser, magnetic media is physically damaged by deforming any internal platters." - title: Supervision of destruction props: - name: sort-id value: "catalog[1].group[14].group[3].group[7]" parts: - name: overview prose: "To verify that media is appropriately destroyed, destruction processes need to be supervised by at least one cleared person." controls: - id: ism-0370 class: ISM-control title: "Control: ism-0370" props: - name: sort-id value: "catalog[1].group[14].group[3].group[7].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0370_smt name: statement prose: The destruction of media is performed under the supervision of at least one cleared person. - id: ism-0371 class: ISM-control title: "Control: ism-0371" props: - name: sort-id value: "catalog[1].group[14].group[3].group[7].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0371_smt name: statement prose: Personnel supervising the destruction of media supervise its handling to the point of destruction and ensure that the destruction is completed successfully. - title: Supervision of accountable material destruction props: - name: sort-id value: "catalog[1].group[14].group[3].group[8]" parts: - name: overview prose: "The successful destruction of media storing accountable material is more important than for other media. As such, its destruction should be supervised by at least two cleared personnel who sign a destruction certificate afterwards." controls: - id: ism-0372 class: ISM-control title: "Control: ism-0372" props: - name: sort-id value: "catalog[1].group[14].group[3].group[8].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0372_smt name: statement prose: The destruction of media storing accountable material is performed under the supervision of at least two cleared personnel. - id: ism-0373 class: ISM-control title: "Control: ism-0373" props: - name: sort-id value: "catalog[1].group[14].group[3].group[8].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0373_smt name: statement prose: "Personnel supervising the destruction of media storing accountable material supervise its handling to the point of destruction, ensure that the destruction is completed successfully and sign a destruction certificate afterwards." - title: Outsourcing media destruction props: - name: sort-id value: "catalog[1].group[14].group[3].group[9]" parts: - name: overview prose: "While media storing accountable material cannot be outsourced, media storing non-accountable material can be outsourced when using a National Association for Information Destruction AAA certified destruction service with endorsements, as specified in ASIO’s Protective Security Circular-167, External destruction of security classified information. This publication is available from the Protective Security Policy GovTEAMS community or ASIO by email." controls: - id: ism-0839 class: ISM-control title: "Control: ism-0839" props: - name: sort-id value: "catalog[1].group[14].group[3].group[9].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0839_smt name: statement prose: The destruction of media storing accountable material is not outsourced. - id: ism-0840 class: ISM-control title: "Control: ism-0840" props: - name: sort-id value: "catalog[1].group[14].group[3].group[9].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S parts: - id: ism-0840_smt name: statement prose: "When outsourcing the destruction of media storing non-accountable material, a National Association for Information Destruction AAA certified destruction service with endorsements, as specified in ASIO’s Protective Security Circular-167, is used." - title: Media disposal props: - name: sort-id value: "catalog[1].group[14].group[4]" groups: - title: Media disposal processes and procedures props: - name: sort-id value: "catalog[1].group[14].group[4].group[1]" parts: - name: overview prose: "Developing, implementing and maintaining processes and procedures for media disposal will ensure that an organisation carries out media disposal in an appropriate and consistent manner." controls: - id: ism-0374 class: ISM-control title: "Control: ism-0374" props: - name: sort-id value: "catalog[1].group[14].group[4].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0374_smt name: statement prose: "Media disposal processes, and supporting media disposal procedures, are developed, implemented and maintained." - title: Disposal of media props: - name: sort-id value: "catalog[1].group[14].group[4].group[2]" parts: - name: overview prose: "Before media can be released into the public domain, it needs to be sanitised, destroyed or declassified. As sanitised, destroyed or declassified media still presents a security risk, albeit minor, an appropriate authority needs to formally authorise its release into the public domain. Furthermore, as part of disposal processes, removing labels and markings indicating the owner, sensitivity, classification or any other marking that can associate media with its prior use will ensure it does not draw undue attention following its disposal." controls: - id: ism-0378 class: ISM-control title: "Control: ism-0378" props: - name: sort-id value: "catalog[1].group[14].group[4].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0378_smt name: statement prose: "Labels and markings indicating the owner, sensitivity, classification or any other marking that can associate media with its prior use are removed prior to its disposal." - id: ism-0375 class: ISM-control title: "Control: ism-0375" props: - name: sort-id value: "catalog[1].group[14].group[4].group[2].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0375_smt name: statement prose: "Following sanitisation, destruction or declassification, a formal administrative decision is made to release media, or its waste, into the public domain." - title: Guidelines for system hardening props: - name: sort-id value: "catalog[1].group[15]" groups: - title: Operating system hardening props: - name: sort-id value: "catalog[1].group[15].group[1]" parts: - name: overview prose: |- # Context This section describes security controls applicable to operating systems used on workstations and servers. Guidance on the use of mobile operating systems is available in the ‘Mobile device management’ section of the [Guidelines for enterprise mobility](#9a8f5a63-bcd5-45a8-9f9c-974fc796ac95). # Further information Further information on cyber supply chain risk management can be found in the ‘Cyber supply chain risk management’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on vendors that have made a pledge to implement Secure by Design and Secure by Default principles and practices can be found on the United States’ Cybersecurity \& Infrastructure Security Agency’s [Secure by Design Pledge](#4974639a-f41a-4280-ae06-33d1f13d6083) website. Further information on patching or updating operating systems can be found in the ‘System maintenance’ section of the [Guidelines for system management](#c6ca6620-ccd5-4c5d-b97c-9d92f1162948). Further information on hardening Microsoft Windows operating systems can be found in ASD’s [Hardening Microsoft Windows 10 workstations](#9209d9cd-86c1-486f-890e-1edfa4545093) and [Hardening Microsoft Windows 11 workstations](#43fbcaf9-03a3-493a-83be-9340a37778fa) publications. Further information on hardening Microsoft Windows operating systems can also be found in Microsoft’s [Windows 11 Security Book](#63bba9d2-127e-41d5-b735-e0cf3fe4b9aa) and on the [Microsoft Security Baselines Blog](#0bf3a1ef-031a-419b-80c3-08a08b1cee9d) website. Further information on hardening Linux workstations and servers can be found in ASD’s [Hardening Linux workstations and servers](#8132c47e-a2dc-4dd9-81d6-38db96e5cec6) publication. Further information on Microsoft’s attack surface reduction rules can be found on Microsoft’s [attack surface reduction rules overview](#82ae76a4-ed9e-4a7b-8bad-f1950c41eab7) website. Further information on [exploit protection functionality](#d0df96bb-7236-4784-8f54-2cb6335ad228) within Microsoft Windows is available from Microsoft. Further information on [memory integrity functionality](#d446dea3-c36d-45af-9623-05b686624af0) is available from Microsoft. Further information on implementing application control can be found in ASD’s [Implementing application control](#4eeff329-cea0-4baf-a80b-8b0b76436075) publication. Further information on Microsoft’s [recommended application blocklist](#5a2ed3ef-afcc-485e-8014-5107e9ed97e3) and [vulnerable driver blocklist](#4a3a265f-7772-433b-9906-7f784052f28b) are available from Microsoft. Further information on [command line process logging](#0a1508c0-b062-4d85-8ded-a95316e17a3a) is available from Microsoft. Further information on the use of PowerShell can be found in ASD’s [Securing PowerShell in the enterprise](#8ffea524-0974-4b53-a8f5-41166073ede5) publication. Further information on [the use of PowerShell by blue teams](#7d22400c-ddef-4cbb-90f1-7502dc569e5b) is available from Microsoft. Further information on obtaining [greater visibility through PowerShell logging](#af0810aa-3486-4ca6-a48a-fad8ce9ac193) is available from Google. Further information on independent testing of security products’ ability to [detect or prevent various stages of network intrusions](#3a1a00f6-2f56-4d04-b99d-6f1682b95a98) is available from MITRE. Further information on independent testing of antivirus applications is available from [AV-Comparatives](#c852e735-4920-4616-8e34-2fddfb49eea8) and [AV-TEST](#18203e18-2aca-492e-be44-770b2f47242f). Further information on the use of removable media can be found in the ‘Media usage’ section of the [Guidelines for media](#b594c9c0-b42f-4f06-b643-38023275a5c7). Further information on event logging can be found in the ‘Security monitoring’ section of the [Guidelines for security assurance](#ef60c0e4-acfb-4a8b-b5ed-25675c6e117c). Further information on security-relevant events to monitor for Apple macOS, Linux and Microsoft Windows operating systems can be found in the following ASD publications: - [Hardening Microsoft Windows 10 workstations](#9209d9cd-86c1-486f-890e-1edfa4545093) - [Hardening Microsoft Windows 11 workstations](#43fbcaf9-03a3-493a-83be-9340a37778fa) - [Priority logs for SIEM ingestion: Practitioner guidance](#1dbda98a-4e8b-4a52-b4f7-9d1a895fd324) - [Windows event logging and forwarding](#de239dae-d1e8-4969-9680-ef3444d32a83). groups: - title: Operating system selection props: - name: sort-id value: "catalog[1].group[15].group[1].group[01]" parts: - name: overview prose: "When selecting operating systems, it is important that an organisation preferences vendors that have demonstrated a commitment to Secure by Design and Secure by Default principles and practices. This includes secure programming practices and either memory-safe programming languages (such as C#, Go, Java, Ruby, Rust and Swift) or less preferably memory-safe programming practices. This will assist in not only reducing the potential number of vulnerabilities in operating systems, but also increasing the likelihood that timely patches, updates or vendor mitigations will be released to remediate any vulnerabilities that are found." controls: - id: ism-1743 class: ISM-control title: "Control: ism-1743" props: - name: sort-id value: "catalog[1].group[15].group[1].group[01].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1743_smt name: statement prose: "Vendors that have demonstrated a commitment to Secure by Design and Secure by Default principles and practices, including secure programming practices and either memory-safe programming languages or less preferably memory-safe programming practices, are used for operating systems." - title: Operating system releases and versions props: - name: sort-id value: "catalog[1].group[15].group[1].group[02]" parts: - name: overview prose: "Newer releases of operating systems often introduce improvements in security functionality. This can make it more difficult for malicious actors to craft reliable exploits for vulnerabilities they discover. Using older releases of operating systems, especially those no longer supported by vendors, may expose an organisation to vulnerabilities or exploitation techniques that have since been mitigated. In addition, 64-bit versions of operating systems support additional security functionality that legacy 32-bit versions do not." controls: - id: ism-1407 class: ISM-control title: "Control: ism-1407" props: - name: sort-id value: "catalog[1].group[15].group[1].group[02].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1407_smt name: statement prose: "The latest release, or the previous release, of operating systems are used." - id: ism-1408 class: ISM-control title: "Control: ism-1408" props: - name: sort-id value: "catalog[1].group[15].group[1].group[02].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1408_smt name: statement prose: 64-bit versions of operating systems are used. - title: Standard operating environments props: - name: sort-id value: "catalog[1].group[15].group[1].group[03]" parts: - name: overview prose: |- Allowing workstations and servers to be set up, configured and maintained outside of centrally managed processes can result in an inconsistent operating environment. Such operating environments may assist malicious actors in gaining an initial foothold on networks due to the higher likelihood of poorly configured or maintained workstations and servers. Conversely, a standard operating environment (SOE), provided via an automated build process or a golden image, is designed to facilitate a standardised and consistent operating environment within an organisation. When SOEs are obtained from third parties, such as service providers, there are additional cyber supply chain risks that should be considered, such as the accidental or deliberate inclusion of malicious code or configurations. To reduce the likelihood of such occurrences, an organisation should endeavour to obtain their SOEs from trustworthy third parties while also scanning them for malicious code and configurations. As operating environments naturally change over time, such as patches or updates are applied, configurations are changed, and applications are added or removed, it is essential that SOEs are reviewed and updated at least annually to ensure that an up-to-date baseline is maintained. controls: - id: ism-1406 class: ISM-control title: "Control: ism-1406" props: - name: sort-id value: "catalog[1].group[15].group[1].group[03].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Aug-20 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1406_smt name: statement prose: SOEs are used for workstations and servers. - id: ism-1608 class: ISM-control title: "Control: ism-1608" props: - name: sort-id value: "catalog[1].group[15].group[1].group[03].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1608_smt name: statement prose: SOEs provided by third parties are scanned for malicious code and configurations. - id: ism-1588 class: ISM-control title: "Control: ism-1588" props: - name: sort-id value: "catalog[1].group[15].group[1].group[03].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Aug-20 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1588_smt name: statement prose: SOEs are reviewed and updated at least annually. - title: Hardening operating system configurations props: - name: sort-id value: "catalog[1].group[15].group[1].group[04]" parts: - name: overview prose: "When operating systems are deployed in their default state, or with an unapproved configuration, it can lead to an insecure operating environment that may allow malicious actors to gain an initial foothold on networks. Many settings exist within operating systems enabling them to be configured in an approved secure state to minimise this security risk. As such, the Australian Signals Directorate (ASD) and vendors often produce hardening guidance to assist in hardening the configuration of operating systems. However, in situations where ASD and vendor hardening guidance conflicts, precedence should be given to implementing the most restrictive guidance." controls: - id: ism-1914 class: ISM-control title: "Control: ism-1914" props: - name: sort-id value: "catalog[1].group[15].group[1].group[04].control[01]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1914_smt name: statement prose: "Approved configurations for operating systems are developed, implemented and maintained." - id: ism-1409 class: ISM-control title: "Control: ism-1409" props: - name: sort-id value: "catalog[1].group[15].group[1].group[04].control[02]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1409_smt name: statement prose: "Operating systems are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur." - id: ism-1601 class: ISM-control title: "Control: ism-1601" props: - name: sort-id value: "catalog[1].group[15].group[1].group[04].control[03]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1601_smt name: statement prose: Microsoft’s attack surface reduction rules are implemented. - id: ism-0383 class: ISM-control title: "Control: ism-0383" props: - name: sort-id value: "catalog[1].group[15].group[1].group[04].control[04]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "11" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0383_smt name: statement prose: "Default user accounts or credentials for operating systems, including for any pre-configured user accounts, are changed, disabled or removed during initial setup." - id: ism-0380 class: ISM-control title: "Control: ism-0380" props: - name: sort-id value: "catalog[1].group[15].group[1].group[04].control[05]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "10" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0380_smt name: statement prose: "Unneeded user accounts, components, services and functionality of operating systems are disabled or removed." - id: ism-0341 class: ISM-control title: "Control: ism-0341" props: - name: sort-id value: "catalog[1].group[15].group[1].group[04].control[06]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0341_smt name: statement prose: Automatic execution features for removable media are disabled. - id: ism-1654 class: ISM-control title: "Control: ism-1654" props: - name: sort-id value: "catalog[1].group[15].group[1].group[04].control[07]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1654_smt name: statement prose: Internet Explorer 11 is disabled or removed. - id: ism-1655 class: ISM-control title: "Control: ism-1655" props: - name: sort-id value: "catalog[1].group[15].group[1].group[04].control[08]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1655_smt name: statement prose: .NET Framework 3.5 (includes .NET 2.0 and 3.0) is disabled or removed. - id: ism-1492 class: ISM-control title: "Control: ism-1492" props: - name: sort-id value: "catalog[1].group[15].group[1].group[04].control[09]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1492_smt name: statement prose: Operating system exploit protection functionality is enabled. - id: ism-1745 class: ISM-control title: "Control: ism-1745" props: - name: sort-id value: "catalog[1].group[15].group[1].group[04].control[10]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1745_smt name: statement prose: "Early Launch Antimalware, Secure Boot, Trusted Boot and Measured Boot functionality is enabled." - id: ism-2127 class: ISM-control title: "Control: ism-2127" props: - name: sort-id value: "catalog[1].group[15].group[1].group[04].control[11]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2127_smt name: statement prose: Digital signature verification functionality for drivers is enforced before they are loaded. - id: ism-1896 class: ISM-control title: "Control: ism-1896" props: - name: sort-id value: "catalog[1].group[15].group[1].group[04].control[12]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1896_smt name: statement prose: Memory integrity functionality is enabled. - id: ism-2128 class: ISM-control title: "Control: ism-2128" props: - name: sort-id value: "catalog[1].group[15].group[1].group[04].control[13]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2128_smt name: statement prose: "The ability to install, load or modify kernel-mode code, including drivers, kernel modules and extensions, is limited to privileged users who require such abilities as part of their duties or functions." - id: ism-1584 class: ISM-control title: "Control: ism-1584" props: - name: sort-id value: "catalog[1].group[15].group[1].group[04].control[14]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1584_smt name: statement prose: "Unprivileged users are prevented from bypassing, disabling or modifying security functionality of operating systems." - id: ism-1491 class: ISM-control title: "Control: ism-1491" props: - name: sort-id value: "catalog[1].group[15].group[1].group[04].control[15]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1491_smt name: statement prose: |- Unprivileged human users are prevented from running script execution engines, including: - Windows Script Host (cscript.exe and wscript.exe) - PowerShell (powershell.exe, powershell_ise.exe and pwsh.exe) - Command Prompt (cmd.exe) - Windows Management Instrumentation (wmic.exe) - Microsoft Hypertext Markup Language (HTML) Application Host (mshta.exe). - title: Application management props: - name: sort-id value: "catalog[1].group[15].group[1].group[05]" parts: - name: overview prose: "Unprivileged human users’ ability to install any application can be exploited by malicious actors using social engineering to convince them to install malicious applications. One way to mitigate this security risk, while also removing burden from system administrators, is to allow unprivileged human users the ability to install approved applications from organisation-managed application repositories or from trustworthy application marketplaces. Furthermore, to prevent unprivileged human users from removing security functionality, or breaking system functionality, unprivileged human users should not have the ability to uninstall or disable approved applications." controls: - id: ism-1592 class: ISM-control title: "Control: ism-1592" props: - name: sort-id value: "catalog[1].group[15].group[1].group[05].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1592_smt name: statement prose: Unprivileged human users do not have the ability to install unapproved applications. - id: ism-0382 class: ISM-control title: "Control: ism-0382" props: - name: sort-id value: "catalog[1].group[15].group[1].group[05].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "9" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0382_smt name: statement prose: Unprivileged human users do not have the ability to uninstall or disable approved applications. - title: Application control props: - name: sort-id value: "catalog[1].group[15].group[1].group[06]" parts: - name: overview prose: |- Application control can be an effective way to both prevent malicious code from executing on workstations and servers and ensure only approved applications can execute. When developing application control rulesets, determining approved executables (e.g. .exe and .com files), libraries (e.g. .dll and.ocx files), scripts (e.g. .ps1, .bat, .cmd, .vbs and .js files), installers (e.g. .msi, .msp and .mst files), compiled HTML (e.g. .chm files), HTML applications (e.g. .hta files), control panel applets (e.g. .cpl files) and drivers based on business requirements is a more secure method than simply approving those already residing on a workstation or server. Furthermore, it is preferable that an organisation defines their own application control rulesets, rather than relying on those from application control vendors, and validate them at least annually. In implementing application control, an organisation should use a reliable method, or combination of methods, such as cryptographic hash rules, publisher certificate rules or path rules. Depending on the method chosen, further hardening may be required to ensure that application control mechanisms and application control rulesets cannot be bypassed by malicious actors. Finally, centrally logging and analysing application control events can assist in monitoring the security posture of systems, detecting malicious behaviour and contributing to investigations following cyber security incidents. controls: - id: ism-0843 class: ISM-control title: "Control: ism-0843" props: - name: sort-id value: "catalog[1].group[15].group[1].group[06].control[01]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "9" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-0843_smt name: statement prose: Application control is implemented on workstations. - id: ism-1490 class: ISM-control title: "Control: ism-1490" props: - name: sort-id value: "catalog[1].group[15].group[1].group[06].control[02]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1490_smt name: statement prose: Application control is implemented on internet-facing servers. - id: ism-1656 class: ISM-control title: "Control: ism-1656" props: - name: sort-id value: "catalog[1].group[15].group[1].group[06].control[03]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1656_smt name: statement prose: Application control is implemented on non-internet-facing servers. - id: ism-1870 class: ISM-control title: "Control: ism-1870" props: - name: sort-id value: "catalog[1].group[15].group[1].group[06].control[04]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1870_smt name: statement prose: "Application control is applied to user profiles and temporary folders used by operating systems, web browsers and email clients." - id: ism-1871 class: ISM-control title: "Control: ism-1871" props: - name: sort-id value: "catalog[1].group[15].group[1].group[06].control[05]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1871_smt name: statement prose: "Application control is applied to all locations other than user profiles and temporary folders used by operating systems, web browsers and email clients." - id: ism-1657 class: ISM-control title: "Control: ism-1657" props: - name: sort-id value: "catalog[1].group[15].group[1].group[06].control[06]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1657_smt name: statement prose: "Application control restricts the execution of executables, libraries, scripts, installers, compiled HTML, HTML applications and control panel applets to an organisation-approved set." - id: ism-1658 class: ISM-control title: "Control: ism-1658" props: - name: sort-id value: "catalog[1].group[15].group[1].group[06].control[07]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1658_smt name: statement prose: Application control restricts the execution of drivers to an organisation-approved set. - id: ism-0955 class: ISM-control title: "Control: ism-0955" props: - name: sort-id value: "catalog[1].group[15].group[1].group[06].control[08]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Apr-20 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0955_smt name: statement prose: "Application control is implemented using cryptographic hash rules, publisher certificate rules or path rules." - id: ism-1471 class: ISM-control title: "Control: ism-1471" props: - name: sort-id value: "catalog[1].group[15].group[1].group[06].control[09]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1471_smt name: statement prose: "When implementing application control using publisher certificate rules, publisher names and product names are used." - id: ism-1392 class: ISM-control title: "Control: ism-1392" props: - name: sort-id value: "catalog[1].group[15].group[1].group[06].control[10]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1392_smt name: statement prose: "When implementing application control using path rules, only approved users can modify approved files and write to approved folders." - id: ism-1746 class: ISM-control title: "Control: ism-1746" props: - name: sort-id value: "catalog[1].group[15].group[1].group[06].control[11]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1746_smt name: statement prose: "When implementing application control using path rules, only approved users can change file system permissions for approved files and folders." - id: ism-1544 class: ISM-control title: "Control: ism-1544" props: - name: sort-id value: "catalog[1].group[15].group[1].group[06].control[12]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1544_smt name: statement prose: Microsoft’s recommended application blocklist is implemented. - id: ism-1659 class: ISM-control title: "Control: ism-1659" props: - name: sort-id value: "catalog[1].group[15].group[1].group[06].control[13]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1659_smt name: statement prose: Microsoft’s vulnerable driver blocklist is implemented. - id: ism-1582 class: ISM-control title: "Control: ism-1582" props: - name: sort-id value: "catalog[1].group[15].group[1].group[06].control[14]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1582_smt name: statement prose: Application control rulesets are validated at least annually. - id: ism-0846 class: ISM-control title: "Control: ism-0846" props: - name: sort-id value: "catalog[1].group[15].group[1].group[06].control[15]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "10" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0846_smt name: statement prose: "Users cannot disable or bypass application control, and are not exempted from application control, except when using local administrator accounts or break glass accounts." - id: ism-1660 class: ISM-control title: "Control: ism-1660" props: - name: sort-id value: "catalog[1].group[15].group[1].group[06].control[16]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1660_smt name: statement prose: Allowed and blocked application control events are centrally logged. - title: Command Shell props: - name: sort-id value: "catalog[1].group[15].group[1].group[07]" parts: - name: overview prose: "The Command shell was the first shell developed by Microsoft to assist with the automation of routine system administration tasks, such as running Windows Commands via batch scripts. However, the Command shell can also be used by malicious actors to run Windows Commands on compromised systems. As such, centrally logging and analysing command line process creation events can assist in monitoring the security posture of systems, detecting malicious behaviour and contributing to investigations following cyber security incidents." controls: - id: ism-1889 class: ISM-control title: "Control: ism-1889" props: - name: sort-id value: "catalog[1].group[15].group[1].group[07].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1889_smt name: statement prose: Command line process creation events are centrally logged. - title: PowerShell props: - name: sort-id value: "catalog[1].group[15].group[1].group[08]" parts: - name: overview prose: |- PowerShell is a powerful scripting language developed by Microsoft and, due to its ubiquity and ease with which it can be used to control operating systems, is an important part of system administrator toolkits. However, PowerShell can also be a dangerous exploitation tool in the hands of malicious actors. To prevent attacks leveraging vulnerabilities in earlier PowerShell versions, Windows PowerShell 2.0 should be disabled or removed from operating systems. Additionally, PowerShell’s language mode should be set to Constrained Language Mode to achieve a balance between security and functionality. Finally, centrally logging and analysing PowerShell events can assist in monitoring the security posture of systems, detecting malicious behaviour and contributing to investigations following cyber security incidents. controls: - id: ism-1621 class: ISM-control title: "Control: ism-1621" props: - name: sort-id value: "catalog[1].group[15].group[1].group[08].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1621_smt name: statement prose: Windows PowerShell 2.0 is disabled or removed. - id: ism-1622 class: ISM-control title: "Control: ism-1622" props: - name: sort-id value: "catalog[1].group[15].group[1].group[08].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Oct-20 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1622_smt name: statement prose: PowerShell is configured to use Constrained Language Mode. - id: ism-1623 class: ISM-control title: "Control: ism-1623" props: - name: sort-id value: "catalog[1].group[15].group[1].group[08].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1623_smt name: statement prose: "PowerShell module logging, script block logging and transcription events are centrally logged." - id: ism-1624 class: ISM-control title: "Control: ism-1624" props: - name: sort-id value: "catalog[1].group[15].group[1].group[08].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Oct-20 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1624_smt name: statement prose: PowerShell script block logs are protected by Protected Event Logging functionality. - title: Windows Management Instrumentation props: - name: sort-id value: "catalog[1].group[15].group[1].group[09]" parts: - name: overview prose: "Malicious actors increasingly avoid deploying their own malware and instead live off the land by using management frameworks, such as Windows Management Instrumentation (WMI), that are already present on systems. As these management frameworks are required for legitimate administration activities, blocking them outright is often not feasible. As such, centrally logging and analysing WMI activity, including the creation of permanent event subscriptions, can assist in monitoring the security posture of systems, detecting malicious behaviour and contributing to investigations following cyber security incidents." controls: - id: ism-2129 class: ISM-control title: "Control: ism-2129" props: - name: sort-id value: "catalog[1].group[15].group[1].group[09].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2129_smt name: statement prose: "WMI activity, including the creation of permanent event subscriptions, is centrally logged." - title: Host-based intrusion detection and response solution props: - name: sort-id value: "catalog[1].group[15].group[1].group[10]" parts: - name: overview prose: "Many security products rely on signatures to detect malicious code. This approach is only effective when malicious code has already been profiled, and signatures are available from security vendors. Unfortunately, malicious actors can easily create variants of known malicious code to bypass traditional signature-based detection. A host-based intrusion prevention system (HIPS) or endpoint detection and response (EDR) solution can use behaviour-based detection to assist in identifying and blocking anomalous behaviour as well as detecting malicious code that has yet to be identified by security vendors. As such, it is important that either a HIPS or EDR solution is implemented on workstations, critical servers and high-value servers." controls: - id: ism-1341 class: ISM-control title: "Control: ism-1341" props: - name: sort-id value: "catalog[1].group[15].group[1].group[10].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1341_smt name: statement prose: A HIPS or EDR solution is implemented on workstations. - id: ism-1034 class: ISM-control title: "Control: ism-1034" props: - name: sort-id value: "catalog[1].group[15].group[1].group[10].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1034_smt name: statement prose: A HIPS or EDR solution is implemented on critical servers and high-value servers. - title: Software firewall props: - name: sort-id value: "catalog[1].group[15].group[1].group[11]" parts: - name: overview prose: "Traditional network firewalls often fail to prevent the propagation of malicious code on networks, or malicious actors from exfiltrating data from networks, as they only control which ports or protocols can be used between different network segments. Many forms of malicious code are designed specifically to take advantage of this by using common protocols, such as Hypertext Transfer Protocol, Hypertext Transfer Protocol Secure, Simple Mail Transfer Protocol or Domain Name System. Software firewalls are more effective than traditional network firewalls as they can control which applications and services can communicate to and from workstations and servers. As such, a software firewall should be implemented on workstations and servers to restrict inbound and outbound network connections to an organisation-approved set of applications and services." controls: - id: ism-1416 class: ISM-control title: "Control: ism-1416" props: - name: sort-id value: "catalog[1].group[15].group[1].group[11].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1416_smt name: statement prose: A software firewall is implemented on workstations and servers to restrict inbound and outbound network connections to an organisation-approved set of applications and services. - title: Antivirus application props: - name: sort-id value: "catalog[1].group[15].group[1].group[12]" parts: - name: overview prose: "When vendors develop operating systems and applications, they may make coding mistakes that lead to vulnerabilities. Malicious actors can take advantage of this by developing malicious code to exploit any vulnerabilities that have not been detected and remedied by vendors. As significant time and effort is often involved in developing functioning and reliable exploits, malicious actors will often attempt to reuse their exploits as much as possible. While exploits may have been previously identified by security vendors, they often remain viable against an organisation that does not have an antivirus application in place." controls: - id: ism-1417 class: ISM-control title: "Control: ism-1417" props: - name: sort-id value: "catalog[1].group[15].group[1].group[12].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1417_smt name: statement prose: |- An antivirus application is implemented on workstations and servers with: - signature-based detection functionality enabled and set to a high level - heuristic-based detection functionality enabled and set to a high level - reputation rating functionality enabled - ransomware protection functionality enabled - detection signatures configured to update at least daily - regular scanning configured for all fixed disks and removable media. - title: Device access control props: - name: sort-id value: "catalog[1].group[15].group[1].group[13]" parts: - name: overview prose: |- A device access control application, or disabling external communication interfaces, can be used to prevent removable media and mobile devices from being connected to workstations and servers via external communication interfaces. This can assist in preventing the introduction of malicious code or the exfiltration of data by malicious actors. In addition, malicious actors can connect to locked workstations and servers via external communication interfaces that allow direct memory access (DMA). In doing so, malicious actors can gain access to encryption keys in memory or write malicious code to memory. The best defence against this security risk is to disable access to external communication interfaces that allow DMA, such as FireWire, ExpressCard and Thunderbolt. controls: - id: ism-1418 class: ISM-control title: "Control: ism-1418" props: - name: sort-id value: "catalog[1].group[15].group[1].group[13].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1418_smt name: statement prose: "If there is no business requirement for reading from removable media and devices, such functionality is disabled via the use of a device access control application or by disabling external communication interfaces." - id: ism-0343 class: ISM-control title: "Control: ism-0343" props: - name: sort-id value: "catalog[1].group[15].group[1].group[13].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0343_smt name: statement prose: "If there is no business requirement for writing to removable media and devices, such functionality is disabled via the use of a device access control application or by disabling external communication interfaces." - id: ism-0345 class: ISM-control title: "Control: ism-0345" props: - name: sort-id value: "catalog[1].group[15].group[1].group[13].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0345_smt name: statement prose: External communication interfaces that allow DMA are disabled. - title: Operating system event logging props: - name: sort-id value: "catalog[1].group[15].group[1].group[14]" parts: - name: overview prose: |- Centrally logging and analysing security-relevant events, including configuration changes, for operating systems can assist in monitoring the security posture of systems, detecting malicious behaviour and contributing to investigations following cyber security incidents. Typical security-relevant events for operating systems that can be logged include: - changes to security policies - failed user logons and account lockouts - failures, restarts and changes to important processes, services and scheduled tasks - operating system and application usage, error messages and crashes - security product-related events - successful process creations and terminations - successful user logons and logoffs - system startups and shutdowns. controls: - id: ism-1976 class: ISM-control title: "Control: ism-1976" props: - name: sort-id value: "catalog[1].group[15].group[1].group[14].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1976_smt name: statement prose: Security-relevant events for Apple macOS operating systems are centrally logged. - id: ism-1977 class: ISM-control title: "Control: ism-1977" props: - name: sort-id value: "catalog[1].group[15].group[1].group[14].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1977_smt name: statement prose: Security-relevant events for Linux operating systems are centrally logged. - id: ism-0582 class: ISM-control title: "Control: ism-0582" props: - name: sort-id value: "catalog[1].group[15].group[1].group[14].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "10" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0582_smt name: statement prose: Security-relevant events for Microsoft Windows operating systems are centrally logged. - title: User application hardening props: - name: sort-id value: "catalog[1].group[15].group[2]" parts: - name: overview prose: |- # Context This section describes security controls applicable to user applications typically installed on workstations, such as artificial intelligence (AI) applications, email clients, office productivity suites, Portable Document Format (PDF) applications, security products (e.g. antivirus applications, device access control applications, HIPS and software firewalls) and web browsers, including their extensions. Additional information on cloud-based versions of user applications can be found in the ‘Managed services and cloud services’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Information on server applications can be found in the ‘Server application hardening’ section of these guidelines. # Further information Further information on cyber supply chain risk management can be found in the ‘Cyber supply chain risk management’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on vendors that have made a pledge to implement Secure by Design and Secure by Default principles and practices can be found on the United States’ Cybersecurity \& Infrastructure Security Agency’s [Secure by Design Pledge](#4974639a-f41a-4280-ae06-33d1f13d6083) website. Further information on patching or updating user applications can be found in the ‘System maintenance’ section of the [Guidelines for system management](#c6ca6620-ccd5-4c5d-b97c-9d92f1162948). Further information on the use of AI agents can be found in ASD’s [Careful adoption of agentic AI services](#388c3570-58ed-40be-be5e-bdfba9cfee1d) publication. Further information on hardening AI applications can be found in the United States’ National Security Agency’s [Deploying AI Systems Securely: Best Practices for Deploying Secure and Resilient AI Systems](#c5ca2027-161e-4322-9367-7ec736b4846f) publication. Further information on hardening Microsoft Office can be found in ASD’s [Hardening Microsoft 365, Office 2021, Office 2019 and Office 2016](#58c9abfb-58fe-416e-a279-dfbfe123c99f) and [Restricting Microsoft Office macros](#dfb52998-0e7e-420d-97e1-d1313c8f919a) publications. Further information on hardening Microsoft Office can also be found on the [Microsoft Security Baselines Blog](#0bf3a1ef-031a-419b-80c3-08a08b1cee9d) website. Further information on hardening Adobe Reader and Adobe Acrobat can be found in Adobe’s [Security Configuration Guide for Acrobat](#9ad09461-7b3d-4faf-bdcd-61df9952cf49) publication. Further information on the implementation and configuration of security products can be found in the ‘Operating system hardening’ section of these guidelines. Further information on hardening Microsoft Edge can be found on the [Microsoft Security Baselines Blog](#0bf3a1ef-031a-419b-80c3-08a08b1cee9d) website. Further information on hardening Google Chrome can be found in Google’s [Chrome Browser Enterprise Security Configuration Guide (Windows)](#741ab440-5759-4571-894d-e499dea3a54c). groups: - title: User application selection props: - name: sort-id value: "catalog[1].group[15].group[2].group[1]" parts: - name: overview prose: "When selecting user applications, it is important that an organisation preferences vendors that have demonstrated a commitment to Secure by Design and Secure by Default principles and practices. This includes secure programming practices and either memory-safe programming languages (such as C#, Go, Java, Ruby, Rust and Swift) or less preferably memory-safe programming practices. This will assist in not only reducing the potential number of vulnerabilities in user applications, but also increasing the likelihood that timely patches, updates or vendor mitigations will be released to remediate any vulnerabilities that are found." controls: - id: ism-0938 class: ISM-control title: "Control: ism-0938" props: - name: sort-id value: "catalog[1].group[15].group[2].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0938_smt name: statement prose: "Vendors that have demonstrated a commitment to Secure by Design and Secure by Default principles and practices, including secure programming practices and either memory-safe programming languages or less preferably memory-safe programming practices, are used for user applications." - title: User application releases props: - name: sort-id value: "catalog[1].group[15].group[2].group[2]" parts: - name: overview prose: "Newer releases of user applications often introduce improvements in security functionality. This can make it more difficult for malicious actors to craft reliable exploits for vulnerabilities they discover. In addition, using older releases of user applications, especially those no longer supported by vendors, may expose an organisation to vulnerabilities or exploitation techniques that have since been mitigated. This is particularly important for email clients, office productivity suites, PDF applications, security products and web browsers, including their extensions." controls: - id: ism-1467 class: ISM-control title: "Control: ism-1467" props: - name: sort-id value: "catalog[1].group[15].group[2].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1467_smt name: statement prose: "The latest release of email clients, office productivity suites, PDF applications, security products and web browsers, including their extensions, are used." - title: Hardening user application configurations props: - name: sort-id value: "catalog[1].group[15].group[2].group[3]" parts: - name: overview prose: "When user applications are deployed in their default state, or with an unapproved configuration, it can lead to an insecure operating environment that may allow malicious actors to gain an initial foothold on networks. Many settings exist within user applications enabling them to be configured in an approved secure state to minimise this security risk. As such, ASD and vendors often produce hardening guidance to assist in hardening the configuration of user applications. However, in situations where ASD and vendor hardening guidance conflicts, precedence should be given to implementing the most restrictive guidance." controls: - id: ism-1915 class: ISM-control title: "Control: ism-1915" props: - name: sort-id value: "catalog[1].group[15].group[2].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1915_smt name: statement prose: "Approved configurations for user applications are developed, implemented and maintained." - id: ism-2110 class: ISM-control title: "Control: ism-2110" props: - name: sort-id value: "catalog[1].group[15].group[2].group[3].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2110_smt name: statement prose: "User applications are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur." - id: ism-1806 class: ISM-control title: "Control: ism-1806" props: - name: sort-id value: "catalog[1].group[15].group[2].group[3].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1806_smt name: statement prose: "Default user accounts or credentials for user applications, including for any pre-configured user accounts, are changed, disabled or removed during initial setup." - id: ism-1470 class: ISM-control title: "Control: ism-1470" props: - name: sort-id value: "catalog[1].group[15].group[2].group[3].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1470_smt name: statement prose: "Unneeded user accounts, components, services and functionality of user applications are disabled or removed." - id: ism-1235 class: ISM-control title: "Control: ism-1235" props: - name: sort-id value: "catalog[1].group[15].group[2].group[3].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1235_smt name: statement prose: Extensions for user applications are restricted to an organisation-approved set. - id: ism-2111 class: ISM-control title: "Control: ism-2111" props: - name: sort-id value: "catalog[1].group[15].group[2].group[3].control[6]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2111_smt name: statement prose: All temporary installation files created during user application installation processes are removed after user applications have been installed. - title: Artificial intelligence applications props: - name: sort-id value: "catalog[1].group[15].group[2].group[4]" parts: - name: overview prose: |- Allowing AI applications that process classified data to directly access external public data sources, such as by performing web searches, or accessing third-party cloud services or application programming interfaces, could lead to data spills involving classified prompts or responses. For this reason, AI applications processing classified data should not be granted direct access to external public data sources. Furthermore, allowing AI applications to perform sensitive or high-impact actions without human oversight could result in unintended cyber security incidents. For example, actions that change privileges, that disable security controls, that initiate financial commitments, that transfer data outside the system boundary or that are otherwise irreversible. In such cases, AI applications should show human users the proposed action, target, data being disclosed and expected consequences. Dual approval should be considered for exceptionally consequential actions. controls: - id: ism-2112 class: ISM-control title: "Control: ism-2112" props: - name: sort-id value: "catalog[1].group[15].group[2].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2112_smt name: statement prose: AI applications that process classified data have their ability to directly access external public data sources disabled. - id: ism-2113 class: ISM-control title: "Control: ism-2113" props: - name: sort-id value: "catalog[1].group[15].group[2].group[4].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2113_smt name: statement prose: AI applications are configured to require human approval before executing sensitive or high-impact actions. - id: ism-2114 class: ISM-control title: "Control: ism-2114" props: - name: sort-id value: "catalog[1].group[15].group[2].group[4].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2114_smt name: statement prose: Baselines of expected behaviour and performance for AI applications are established and monitored for unexpected deviations. - title: Email clients props: - name: sort-id value: "catalog[1].group[15].group[2].group[5]" parts: - name: overview prose: "Human users’ ability to change the security settings of email clients can be exploited by malicious actors using social engineering. To prevent human users from removing security functionality, or breaking security functionality, human users should not have the ability to change security settings for email clients." controls: - id: ism-1748 class: ISM-control title: "Control: ism-1748" props: - name: sort-id value: "catalog[1].group[15].group[2].group[5].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1748_smt name: statement prose: Email client security settings cannot be changed by human users. - title: Office productivity suites props: - name: sort-id value: "catalog[1].group[15].group[2].group[6]" parts: - name: overview prose: |- When office productivity suites, such as Microsoft Office, are deployed in their default state, or with an unapproved configuration, it can lead to an insecure operating environment that may allow malicious actors to gain an initial foothold on networks. Many settings exist within office productivity suites enabling them to be configured in an approved secure state to minimise this security risk. As such, ASD and vendors often produce hardening guidance to assist in hardening the configuration of office productivity suites. However, in situations where ASD and vendor hardening guidance conflicts, precedence should be given to implementing the most restrictive guidance. In addition, human users’ ability to change the security settings of office productivity suites can be exploited by malicious actors using social engineering. To prevent human users from removing security functionality, or breaking security functionality, human users should not have the ability to change security settings for office productivity suites. Finally, Microsoft Office files can contain embedded code, known as a macro, written in the Visual Basic for Applications programming language. A macro can contain a series of commands that can be coded or recorded and replayed later to automate repetitive tasks. Macros are powerful tools that can be easily created by human users to improve their productivity. However, malicious actors can also create macros to perform a variety of malicious activities, such as assisting to compromise workstations to exfiltrate or deny access to data. To reduce this security risk, an organisation should disable Microsoft Office macros for human users that do not have a demonstrated business requirement and secure their use for those that do. controls: - id: ism-1859 class: ISM-control title: "Control: ism-1859" props: - name: sort-id value: "catalog[1].group[15].group[2].group[6].control[01]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1859_smt name: statement prose: "Office productivity suites are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur." - id: ism-1667 class: ISM-control title: "Control: ism-1667" props: - name: sort-id value: "catalog[1].group[15].group[2].group[6].control[02]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1667_smt name: statement prose: Microsoft Office is blocked from creating child processes. - id: ism-1668 class: ISM-control title: "Control: ism-1668" props: - name: sort-id value: "catalog[1].group[15].group[2].group[6].control[03]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1668_smt name: statement prose: Microsoft Office is blocked from creating executable content. - id: ism-1669 class: ISM-control title: "Control: ism-1669" props: - name: sort-id value: "catalog[1].group[15].group[2].group[6].control[04]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1669_smt name: statement prose: Microsoft Office is blocked from injecting code into other processes. - id: ism-1542 class: ISM-control title: "Control: ism-1542" props: - name: sort-id value: "catalog[1].group[15].group[2].group[6].control[05]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jan-19 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1542_smt name: statement prose: Microsoft Office is configured to prevent activation of Object Linking and Embedding packages. - id: ism-1823 class: ISM-control title: "Control: ism-1823" props: - name: sort-id value: "catalog[1].group[15].group[2].group[6].control[06]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1823_smt name: statement prose: Office productivity suite security settings cannot be changed by human users. - id: ism-1671 class: ISM-control title: "Control: ism-1671" props: - name: sort-id value: "catalog[1].group[15].group[2].group[6].control[07]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1671_smt name: statement prose: Microsoft Office macros are disabled for human users that do not have a demonstrated business requirement. - id: ism-1488 class: ISM-control title: "Control: ism-1488" props: - name: sort-id value: "catalog[1].group[15].group[2].group[6].control[08]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1488_smt name: statement prose: Microsoft Office macros in files originating from the internet are blocked. - id: ism-1672 class: ISM-control title: "Control: ism-1672" props: - name: sort-id value: "catalog[1].group[15].group[2].group[6].control[09]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1672_smt name: statement prose: Microsoft Office macro antivirus scanning is enabled. - id: ism-1673 class: ISM-control title: "Control: ism-1673" props: - name: sort-id value: "catalog[1].group[15].group[2].group[6].control[10]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1673_smt name: statement prose: Microsoft Office macros are blocked from making Win32 API calls. - id: ism-1674 class: ISM-control title: "Control: ism-1674" props: - name: sort-id value: "catalog[1].group[15].group[2].group[6].control[11]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1674_smt name: statement prose: "Only Microsoft Office macros running from within a sandboxed environment, a Trusted Location or that are digitally signed by a trusted publisher are allowed to execute." - id: ism-1890 class: ISM-control title: "Control: ism-1890" props: - name: sort-id value: "catalog[1].group[15].group[2].group[6].control[12]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1890_smt name: statement prose: Microsoft Office macros are checked to ensure they are free of malicious code before being digitally signed or placed within Trusted Locations. - id: ism-1487 class: ISM-control title: "Control: ism-1487" props: - name: sort-id value: "catalog[1].group[15].group[2].group[6].control[13]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1487_smt name: statement prose: Only privileged human users responsible for checking that Microsoft Office macros are free of malicious code can write to and modify content within Trusted Locations. - id: ism-1675 class: ISM-control title: "Control: ism-1675" props: - name: sort-id value: "catalog[1].group[15].group[2].group[6].control[14]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1675_smt name: statement prose: Microsoft Office macros digitally signed by an untrusted publisher cannot be enabled via the Message Bar or Backstage View. - id: ism-1891 class: ISM-control title: "Control: ism-1891" props: - name: sort-id value: "catalog[1].group[15].group[2].group[6].control[15]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1891_smt name: statement prose: Microsoft Office macros digitally signed by signatures other than V3 signatures cannot be enabled via the Message Bar or Backstage View. - id: ism-1676 class: ISM-control title: "Control: ism-1676" props: - name: sort-id value: "catalog[1].group[15].group[2].group[6].control[16]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1676_smt name: statement prose: Microsoft Office’s list of trusted publishers is validated at least annually. - id: ism-1489 class: ISM-control title: "Control: ism-1489" props: - name: sort-id value: "catalog[1].group[15].group[2].group[6].control[17]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1489_smt name: statement prose: Microsoft Office macro security settings cannot be changed by human users. - title: Portable Document Format applications props: - name: sort-id value: "catalog[1].group[15].group[2].group[7]" parts: - name: overview prose: |- When PDF applications suites are deployed in their default state, or with an unapproved configuration, it can lead to an insecure operating environment that may allow malicious actors to gain an initial foothold on networks. Many settings exist within PDF applications enabling them to be configured in an approved secure state to minimise this security risk. As such, ASD and vendors often produce hardening guidance to assist in hardening the configuration of PDF applications. However, in situations where ASD and vendor hardening guidance conflicts, precedence should be given to implementing the most restrictive guidance. In addition, human users’ ability to change the security settings of PDF applications can be exploited by malicious actors using social engineering. To prevent human users from removing security functionality, or breaking security functionality, human users should not have the ability to change the security settings for PDF applications. controls: - id: ism-1670 class: ISM-control title: "Control: ism-1670" props: - name: sort-id value: "catalog[1].group[15].group[2].group[7].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1670_smt name: statement prose: PDF applications are blocked from creating child processes. - id: ism-1860 class: ISM-control title: "Control: ism-1860" props: - name: sort-id value: "catalog[1].group[15].group[2].group[7].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1860_smt name: statement prose: "PDF applications are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur." - id: ism-1824 class: ISM-control title: "Control: ism-1824" props: - name: sort-id value: "catalog[1].group[15].group[2].group[7].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1824_smt name: statement prose: PDF application security settings cannot be changed by human users. - title: Security products props: - name: sort-id value: "catalog[1].group[15].group[2].group[8]" parts: - name: overview prose: "Human users’ ability to change the security settings of security products can be exploited by malicious actors using social engineering. To prevent human users from removing security functionality, or breaking security functionality, human users should not have the ability to change security settings for security products." controls: - id: ism-1825 class: ISM-control title: "Control: ism-1825" props: - name: sort-id value: "catalog[1].group[15].group[2].group[8].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1825_smt name: statement prose: Security product security settings cannot be changed by human users. - title: Web browsers props: - name: sort-id value: "catalog[1].group[15].group[2].group[9]" parts: - name: overview prose: |- When web browsers are deployed in their default state, or with an unapproved configuration, it can lead to an insecure operating environment that may allow malicious actors to gain an initial foothold on networks. Many settings exist within web browsers enabling them to be configured in an approved secure state to minimise this security risk. As such, ASD and vendors often produce hardening guidance to assist in hardening the configuration of web browsers. However, in situations where ASD and vendor hardening guidance conflicts, precedence should be given to implementing the most restrictive guidance. In addition, human users’ ability to change the security settings of web browsers can be exploited by malicious actors using social engineering. To prevent human users from removing security functionality, or breaking security functionality, human users should not have the ability to change the security settings for web browsers. controls: - id: ism-1486 class: ISM-control title: "Control: ism-1486" props: - name: sort-id value: "catalog[1].group[15].group[2].group[9].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1486_smt name: statement prose: Web browsers do not process Java from the internet. - id: ism-1485 class: ISM-control title: "Control: ism-1485" props: - name: sort-id value: "catalog[1].group[15].group[2].group[9].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1485_smt name: statement prose: Web browsers do not process web advertisements from the internet. - id: ism-1412 class: ISM-control title: "Control: ism-1412" props: - name: sort-id value: "catalog[1].group[15].group[2].group[9].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1412_smt name: statement prose: "Web browsers are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur." - id: ism-1585 class: ISM-control title: "Control: ism-1585" props: - name: sort-id value: "catalog[1].group[15].group[2].group[9].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1585_smt name: statement prose: Web browser security settings cannot be changed by human users. - title: Server application hardening props: - name: sort-id value: "catalog[1].group[15].group[3]" parts: - name: overview prose: |- # Context This section describes security controls applicable to server applications associated with specific server functionality, such as Microsoft Active Directory services, database management system applications, email server applications and web hosting applications. Information on user applications can be found in the ‘User application hardening’ section of these guidelines. # Further information Further information on cyber supply chain risk management can be found in the ‘Cyber supply chain risk management’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on vendors that have made a pledge to implement Secure by Design and Secure by Default principles and practices can be found on the United States’ Cybersecurity \& Infrastructure Security Agency’s [Secure by Design Pledge](#4974639a-f41a-4280-ae06-33d1f13d6083) website. Further information on patching or updating server applications can be found in the ‘System maintenance’ section of the [Guidelines for system management](#c6ca6620-ccd5-4c5d-b97c-9d92f1162948). Further information on the use of privileged user accounts can be found in the ‘Identity and access management’ section of the [Guidelines for system access](#76d68682-44dd-4e97-98c8-66db2cce1fda). Further information on administering Microsoft Active Directory services can be found in the ‘System administration’ section of the [Guidelines for system management](#c6ca6620-ccd5-4c5d-b97c-9d92f1162948). Further information on hardening Microsoft Active Directory services can be found in ASD’s [Detecting and mitigating Active Directory compromises](#331263bc-3314-496b-9d35-76788eb0f403) publication. Further information on hardening Microsoft Active Directory services can also be found in Microsoft’s [Best practices for securing Active Directory](#b151e338-c42f-41ef-9f99-2cb98f368637) publication. Further information on hardening Microsoft Entra Connect can be found in Microsoft’s [Prerequisites for Microsoft Entra Connect](#1ba81b1c-8e4b-4d7c-85b4-6175ea5fc9bf) publication. Further information on event logging can be found in the ‘Security monitoring’ section of the [Guidelines for security assurance](#ef60c0e4-acfb-4a8b-b5ed-25675c6e117c). Further information on security-relevant events to monitor for Microsoft Active Directory can be found in ASD’s [Detecting and mitigating Active Directory compromises](#331263bc-3314-496b-9d35-76788eb0f403) and [Priority logs for SIEM ingestion: Practitioner guidance](#1dbda98a-4e8b-4a52-b4f7-9d1a895fd324) publications. Further information on security-relevant events to monitor for Microsoft Active Directory can also be found in Microsoft’s [Events to monitor](#022fcd70-df8b-45ee-ae19-fb9cfe7b6cb6) publication. Further information on database servers can be found in the ‘Database servers’ section of the [Guidelines for database systems](#3f349d16-11a1-459a-a299-c9446aea7597). Further information on email servers can be found in the ‘Email gateways and servers’ section of the [Guidelines for email](#ab73fa95-f213-4041-915e-a8ccbdf74331). groups: - title: Server application selection props: - name: sort-id value: "catalog[1].group[15].group[3].group[01]" parts: - name: overview prose: "When selecting server applications, it is important that an organisation preferences vendors that have demonstrated a commitment to Secure by Design and Secure by Default principles and practices. This includes secure programming practices and either memory-safe programming languages (such as C#, Go, Java, Ruby, Rust and Swift) or less preferably memory-safe programming practices. This will assist in not only reducing the potential number of vulnerabilities in server applications, but also increasing the likelihood that timely patches, updates or vendor mitigations will be released to remediate any vulnerabilities that are found." controls: - id: ism-1826 class: ISM-control title: "Control: ism-1826" props: - name: sort-id value: "catalog[1].group[15].group[3].group[01].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1826_smt name: statement prose: "Vendors that have demonstrated a commitment to Secure by Design and Secure by Default principles and practices, including secure programming practices and either memory-safe programming languages or less preferably memory-safe programming practices, are used for server applications." - title: Server application releases props: - name: sort-id value: "catalog[1].group[15].group[3].group[02]" parts: - name: overview prose: "Newer releases of server applications often introduce improvements in security functionality. This can make it more difficult for malicious actors to craft reliable exploits for vulnerabilities they discover. In addition, using older releases of server applications, especially those no longer supported by vendors, may expose an organisation to vulnerabilities or exploitation techniques that have since been mitigated. This is particularly important for internet-facing server applications." controls: - id: ism-1483 class: ISM-control title: "Control: ism-1483" props: - name: sort-id value: "catalog[1].group[15].group[3].group[02].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1483_smt name: statement prose: The latest release of internet-facing server applications is used. - title: Hardening server application configurations props: - name: sort-id value: "catalog[1].group[15].group[3].group[03]" parts: - name: overview prose: "When server applications are deployed in their default state, or with an unapproved configuration, it can lead to an insecure operating environment that may allow malicious actors to gain an initial foothold on networks. Many settings exist within server applications enabling them to be configured in an approved secure state to minimise this security risk. As such, ASD and vendors often produce hardening guidance to assist in hardening the configuration of server applications. However, in situations where ASD and vendor hardening guidance conflicts, precedence should be given to implementing the most restrictive guidance." controls: - id: ism-1916 class: ISM-control title: "Control: ism-1916" props: - name: sort-id value: "catalog[1].group[15].group[3].group[03].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1916_smt name: statement prose: "Approved configurations for server applications are developed, implemented and maintained." - id: ism-1246 class: ISM-control title: "Control: ism-1246" props: - name: sort-id value: "catalog[1].group[15].group[3].group[03].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1246_smt name: statement prose: "Server applications are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur." - id: ism-1260 class: ISM-control title: "Control: ism-1260" props: - name: sort-id value: "catalog[1].group[15].group[3].group[03].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1260_smt name: statement prose: "Default user accounts or credentials for server applications, including for any pre-configured user accounts, are changed, disabled or removed during initial setup." - id: ism-1247 class: ISM-control title: "Control: ism-1247" props: - name: sort-id value: "catalog[1].group[15].group[3].group[03].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1247_smt name: statement prose: "Unneeded user accounts, components, services and functionality of server applications are disabled or removed." - id: ism-2115 class: ISM-control title: "Control: ism-2115" props: - name: sort-id value: "catalog[1].group[15].group[3].group[03].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2115_smt name: statement prose: Extensions for server applications are restricted to an organisation-approved set. - id: ism-1245 class: ISM-control title: "Control: ism-1245" props: - name: sort-id value: "catalog[1].group[15].group[3].group[03].control[6]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1245_smt name: statement prose: All temporary installation files created during server application installation processes are removed after server applications have been installed. - title: Restricting privileges for server applications props: - name: sort-id value: "catalog[1].group[15].group[3].group[04]" parts: - name: overview prose: "If a server application operating as a local administrator or root account is compromised by malicious actors, it can present a significant security risk to the underlying server. In addition, server applications by default are often capable of widely accessing their underlying server’s file system. Therefore, restricting the ability of server applications to access their underlying server’s file system can limit damage should malicious actors compromise the server application." controls: - id: ism-1249 class: ISM-control title: "Control: ism-1249" props: - name: sort-id value: "catalog[1].group[15].group[3].group[04].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1249_smt name: statement prose: Server applications are configured to run as a separate user account with the minimum privileges needed to perform their functions. - id: ism-1250 class: ISM-control title: "Control: ism-1250" props: - name: sort-id value: "catalog[1].group[15].group[3].group[04].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1250_smt name: statement prose: The user accounts under which server applications run have limited access to their underlying server’s file system. - title: Microsoft Active Directory services props: - name: sort-id value: "catalog[1].group[15].group[3].group[05]" parts: - name: overview prose: |- Due to the critical role that Microsoft Active Directory services perform for domain services, certification services, federated services and identity services within networks, it is crucial that servers performing these services are hardened and access to them is strictly limited, including to their backups. Specifically, this includes servers for Microsoft Active Directory Domain Services (AD DS), Microsoft Active Directory Certificate Services (AD CS), Microsoft Active Directory Federation Services (AD FS) and Microsoft Entra Connect. In addition, centrally logging and analysing security-relevant events, including configuration changes, for Microsoft Active Directory services can assist in monitoring the security posture of systems, detecting malicious behaviour and contributing to investigations following cyber security incidents. controls: - id: ism-1926 class: ISM-control title: "Control: ism-1926" props: - name: sort-id value: "catalog[1].group[15].group[3].group[05].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1926_smt name: statement prose: "Microsoft AD DS domain controllers, Microsoft AD CS servers, Microsoft AD FS servers and Microsoft Entra Connect servers are only used for their designed role and no other applications or services are installed, unless they are security related." - id: ism-1927 class: ISM-control title: "Control: ism-1927" props: - name: sort-id value: "catalog[1].group[15].group[3].group[05].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1927_smt name: statement prose: "Access to Microsoft AD DS domain controllers, Microsoft AD CS servers, Microsoft AD FS servers and Microsoft Entra Connect servers is limited to privileged users that require access." - id: ism-1928 class: ISM-control title: "Control: ism-1928" props: - name: sort-id value: "catalog[1].group[15].group[3].group[05].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1928_smt name: statement prose: "Backups of Microsoft AD DS domain controllers, Microsoft AD CS servers, Microsoft AD FS servers and Microsoft Entra Connect servers are encrypted using ASD-approved cryptography, stored securely and only accessible to backup administrator accounts." - id: ism-1830 class: ISM-control title: "Control: ism-1830" props: - name: sort-id value: "catalog[1].group[15].group[3].group[05].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1830_smt name: statement prose: "Security-relevant events for Microsoft AD DS domain controllers, Microsoft AD CS servers, Microsoft AD FS servers and Microsoft Entra Connect servers are centrally logged." - title: Microsoft Active Directory Domain Services props: - name: sort-id value: "catalog[1].group[15].group[3].group[06]" parts: - name: overview prose: "Microsoft AD DS domain controllers hold sensitive data for systems, such as hashed credentials for all user accounts. As such, particular care should be taken to secure these servers. This can be achieved by hardening their configuration while using dedicated domain administrator user accounts exclusively for their administration. In doing so, technical security controls should ensure these dedicated domain administrator user accounts cannot be used to connect to or administer other systems." controls: - id: ism-1827 class: ISM-control title: "Control: ism-1827" props: - name: sort-id value: "catalog[1].group[15].group[3].group[06].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1827_smt name: statement prose: Microsoft AD DS domain controllers are administered using dedicated domain administrator user accounts that are not used to administer other systems. - id: ism-1929 class: ISM-control title: "Control: ism-1929" props: - name: sort-id value: "catalog[1].group[15].group[3].group[06].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1929_smt name: statement prose: Lightweight Directory Access Protocol signing is enabled on Microsoft AD DS domain controllers. - id: ism-1828 class: ISM-control title: "Control: ism-1828" props: - name: sort-id value: "catalog[1].group[15].group[3].group[06].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1828_smt name: statement prose: The Print Spooler service is disabled on Microsoft AD DS domain controllers. - id: ism-1829 class: ISM-control title: "Control: ism-1829" props: - name: sort-id value: "catalog[1].group[15].group[3].group[06].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1829_smt name: statement prose: Passwords are not stored in Group Policy Preferences. - id: ism-1930 class: ISM-control title: "Control: ism-1930" props: - name: sort-id value: "catalog[1].group[15].group[3].group[06].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1930_smt name: statement prose: Passwords are prevented from being stored in Group Policy Preferences. - id: ism-1931 class: ISM-control title: "Control: ism-1931" props: - name: sort-id value: "catalog[1].group[15].group[3].group[06].control[6]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1931_smt name: statement prose: SID Filtering is enabled for domain and forest trusts. - title: Microsoft Active Directory Domain Services account hardening props: - name: sort-id value: "catalog[1].group[15].group[3].group[07]" parts: - name: overview prose: "Misconfigured user accounts and computer accounts within Microsoft AD DS can pose a significant threat to the security of a system. For example, when malicious actors obtain credentials for a user account, along with associated system access, they may further compromise the system by querying Microsoft AD DS to assist in gaining an understanding of the environment, moving laterally through the network and escalating privileges by compromising privileged user accounts. Furthermore, malicious actors with this level of access can become difficult to detect and remove, as they may not need to use exploits for vulnerabilities to achieve their goals. Malicious activities performed by compromised user accounts or computer accounts may also appear very similar to legitimate system activities." controls: - id: ism-1832 class: ISM-control title: "Control: ism-1832" props: - name: sort-id value: "catalog[1].group[15].group[3].group[07].control[01]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1832_smt name: statement prose: Only service accounts and computer accounts are configured with Service Principal Names (SPNs). - id: ism-1932 class: ISM-control title: "Control: ism-1932" props: - name: sort-id value: "catalog[1].group[15].group[3].group[07].control[02]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1932_smt name: statement prose: The number of service accounts configured with an SPN is minimised. - id: ism-1933 class: ISM-control title: "Control: ism-1933" props: - name: sort-id value: "catalog[1].group[15].group[3].group[07].control[03]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1933_smt name: statement prose: Service accounts configured with an SPN do not have DCSync permissions. - id: ism-2010 class: ISM-control title: "Control: ism-2010" props: - name: sort-id value: "catalog[1].group[15].group[3].group[07].control[04]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2010_smt name: statement prose: Service accounts configured with an SPN use the Advanced Encryption Standard for encryption. - id: ism-1834 class: ISM-control title: "Control: ism-1834" props: - name: sort-id value: "catalog[1].group[15].group[3].group[07].control[05]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1834_smt name: statement prose: Duplicate SPNs do not exist within the domain. - id: ism-1833 class: ISM-control title: "Control: ism-1833" props: - name: sort-id value: "catalog[1].group[15].group[3].group[07].control[06]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1833_smt name: statement prose: User accounts are provisioned with the minimum privileges required. - id: ism-1934 class: ISM-control title: "Control: ism-1934" props: - name: sort-id value: "catalog[1].group[15].group[3].group[07].control[07]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1934_smt name: statement prose: "User accounts with DCSync permissions are reviewed at least every six months, and those without an ongoing requirement for the permissions have them removed." - id: ism-1835 class: ISM-control title: "Control: ism-1835" props: - name: sort-id value: "catalog[1].group[15].group[3].group[07].control[08]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1835_smt name: statement prose: Privileged user accounts are configured as sensitive and cannot be delegated. - id: ism-1935 class: ISM-control title: "Control: ism-1935" props: - name: sort-id value: "catalog[1].group[15].group[3].group[07].control[09]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1935_smt name: statement prose: Computer accounts are not configured for unconstrained delegation. - id: ism-1836 class: ISM-control title: "Control: ism-1836" props: - name: sort-id value: "catalog[1].group[15].group[3].group[07].control[10]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1836_smt name: statement prose: User accounts require Kerberos pre-authentication. - id: ism-1838 class: ISM-control title: "Control: ism-1838" props: - name: sort-id value: "catalog[1].group[15].group[3].group[07].control[11]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1838_smt name: statement prose: The UserPassword attribute for user accounts is not used. - id: ism-1936 class: ISM-control title: "Control: ism-1936" props: - name: sort-id value: "catalog[1].group[15].group[3].group[07].control[12]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1936_smt name: statement prose: The sIDHistory attribute for user accounts is not used. - id: ism-1937 class: ISM-control title: "Control: ism-1937" props: - name: sort-id value: "catalog[1].group[15].group[3].group[07].control[13]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1937_smt name: statement prose: User accounts are checked at least weekly for the presence of the sIDHistory attribute. - id: ism-1839 class: ISM-control title: "Control: ism-1839" props: - name: sort-id value: "catalog[1].group[15].group[3].group[07].control[14]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1839_smt name: statement prose: Account properties accessible by unprivileged users are not used to store passwords. - id: ism-1840 class: ISM-control title: "Control: ism-1840" props: - name: sort-id value: "catalog[1].group[15].group[3].group[07].control[15]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1840_smt name: statement prose: User account passwords do not use reversible encryption. - id: ism-1841 class: ISM-control title: "Control: ism-1841" props: - name: sort-id value: "catalog[1].group[15].group[3].group[07].control[16]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1841_smt name: statement prose: Unprivileged user accounts cannot add machines to the domain. - id: ism-1842 class: ISM-control title: "Control: ism-1842" props: - name: sort-id value: "catalog[1].group[15].group[3].group[07].control[17]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1842_smt name: statement prose: Dedicated privileged service accounts are used to add machines to the domain. - id: ism-1843 class: ISM-control title: "Control: ism-1843" props: - name: sort-id value: "catalog[1].group[15].group[3].group[07].control[18]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1843_smt name: statement prose: "User accounts with unconstrained delegation are reviewed at least annually, and those without an SPN or demonstrated business requirement are removed." - id: ism-1844 class: ISM-control title: "Control: ism-1844" props: - name: sort-id value: "catalog[1].group[15].group[3].group[07].control[19]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1844_smt name: statement prose: Computer accounts that are not Microsoft AD DS domain controllers are not trusted for delegation to services. - id: ism-1938 class: ISM-control title: "Control: ism-1938" props: - name: sort-id value: "catalog[1].group[15].group[3].group[07].control[20]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1938_smt name: statement prose: The Domain Computers security group does not have write or modify permissions to any Microsoft Active Directory objects. - title: Microsoft Active Directory Domain Services security group memberships props: - name: sort-id value: "catalog[1].group[15].group[3].group[08]" parts: - name: overview prose: "Microsoft AD DS contains several built-in security groups that have elevated permissions or deliberately relaxed security policies. These security groups are often required for a specific purpose; however, overuse or inappropriate use may allow malicious actors to more easily move laterally throughout a network or escalate their privileges. Highly privileged security groups, such as the Domain Admins and Enterprise Admins security groups, should have their membership limited to the smallest set of possible user accounts to limit malicious actors’ opportunities for privilege escalation. In doing so, such highly privileged security groups should exclude service accounts and computer accounts. In addition, the Domain Computers security group should be excluded from belonging to any privileged or highly privileged security groups." controls: - id: ism-1620 class: ISM-control title: "Control: ism-1620" props: - name: sort-id value: "catalog[1].group[15].group[3].group[08].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1620_smt name: statement prose: Privileged user accounts are members of the Protected Users security group. - id: ism-1939 class: ISM-control title: "Control: ism-1939" props: - name: sort-id value: "catalog[1].group[15].group[3].group[08].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1939_smt name: statement prose: "The number of user accounts that are members of the Domain Admins, Enterprise Admins or other highly privileged security groups is minimised." - id: ism-1940 class: ISM-control title: "Control: ism-1940" props: - name: sort-id value: "catalog[1].group[15].group[3].group[08].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1940_smt name: statement prose: "Service accounts are not members of the Domain Admins, Enterprise Admins or other highly privileged security groups." - id: ism-1941 class: ISM-control title: "Control: ism-1941" props: - name: sort-id value: "catalog[1].group[15].group[3].group[08].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1941_smt name: statement prose: "Computer accounts are not members of the Domain Admins, Enterprise Admins or other highly privileged security groups." - id: ism-1942 class: ISM-control title: "Control: ism-1942" props: - name: sort-id value: "catalog[1].group[15].group[3].group[08].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1942_smt name: statement prose: The Domain Computers security group is not a member of any privileged or highly privileged security groups. - id: ism-1845 class: ISM-control title: "Control: ism-1845" props: - name: sort-id value: "catalog[1].group[15].group[3].group[08].control[6]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1845_smt name: statement prose: "When a user account is disabled, it is removed from all security group memberships." - id: ism-1846 class: ISM-control title: "Control: ism-1846" props: - name: sort-id value: "catalog[1].group[15].group[3].group[08].control[7]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1846_smt name: statement prose: The Pre-Windows 2000 Compatible Access security group does not contain user accounts. - title: Microsoft Active Directory Certificate Services props: - name: sort-id value: "catalog[1].group[15].group[3].group[09]" parts: - name: overview prose: "Microsoft AD CS is responsible for the management of public key infrastructure certificates used to secure authentication and communication protocols for systems, and presents significant opportunities for privilege escalation and persistence by malicious actors. As such, particular care should be taken to secure servers that perform this role. For example, in addition to baseline configuration hardening, web-based enrolment interfaces should be disabled or hardened against authentication-relay attacks, certificate templates should be periodically audited, and certificate enrolment activity should be centrally logged." controls: - id: ism-1943 class: ISM-control title: "Control: ism-1943" props: - name: sort-id value: "catalog[1].group[15].group[3].group[09].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1943_smt name: statement prose: Strong mapping between certificates and users is enforced. - id: ism-1944 class: ISM-control title: "Control: ism-1944" props: - name: sort-id value: "catalog[1].group[15].group[3].group[09].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1944_smt name: statement prose: The EDITF_ATTRIBUTESUBJECTALTNAME2 flag is removed from Microsoft AD CS certification authority configurations. - id: ism-1945 class: ISM-control title: "Control: ism-1945" props: - name: sort-id value: "catalog[1].group[15].group[3].group[09].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1945_smt name: statement prose: The CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag is removed from certificate templates. - id: ism-1946 class: ISM-control title: "Control: ism-1946" props: - name: sort-id value: "catalog[1].group[15].group[3].group[09].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1946_smt name: statement prose: Unprivileged user accounts do not have write access to certificate templates. - id: ism-1947 class: ISM-control title: "Control: ism-1947" props: - name: sort-id value: "catalog[1].group[15].group[3].group[09].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1947_smt name: statement prose: Extended Key Usages that enable user authentication are removed. - id: ism-1948 class: ISM-control title: "Control: ism-1948" props: - name: sort-id value: "catalog[1].group[15].group[3].group[09].control[6]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1948_smt name: statement prose: Certificate manager approval is required for certificate templates that allow a Subject Alternative Name to be supplied. - id: ism-2130 class: ISM-control title: "Control: ism-2130" props: - name: sort-id value: "catalog[1].group[15].group[3].group[09].control[7]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2130_smt name: statement prose: "Web-based enrolment interfaces for Microsoft AD CS servers are disabled unless required, and where enabled, are configured to require HTTPS and Extended Protection for Authentication." - id: ism-2131 class: ISM-control title: "Control: ism-2131" props: - name: sort-id value: "catalog[1].group[15].group[3].group[09].control[8]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2131_smt name: statement prose: Certificate templates are reviewed at least every three months to identify and remediate misconfigurations that could enable privilege escalation or unauthorised certificate enrolment. - id: ism-2132 class: ISM-control title: "Control: ism-2132" props: - name: sort-id value: "catalog[1].group[15].group[3].group[09].control[9]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2132_smt name: statement prose: "Certificate enrolment events, including successful and unsuccessful requests and changes to certificate templates or Microsoft AD CS configurations, are centrally logged." - title: Microsoft Active Directory Federation Services props: - name: sort-id value: "catalog[1].group[15].group[3].group[10]" parts: - name: overview prose: "Microsoft AD FS is responsible for the sharing of identity and access management rights across security boundaries. As such, particular care should be taken to secure servers that perform this role." controls: - id: ism-1949 class: ISM-control title: "Control: ism-1949" props: - name: sort-id value: "catalog[1].group[15].group[3].group[10].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1949_smt name: statement prose: Microsoft AD FS servers are administered using a dedicated service account that is not used to administer other systems. - title: Microsoft Entra Connect props: - name: sort-id value: "catalog[1].group[15].group[3].group[11]" parts: - name: overview prose: "Microsoft Entra Connect is responsible for synchronising identity information between Microsoft AD DS and Microsoft Entra ID services within hybrid on-premises and cloud-based environments. As such, particular care should be taken to secure servers that perform this role." controls: - id: ism-1950 class: ISM-control title: "Control: ism-1950" props: - name: sort-id value: "catalog[1].group[15].group[3].group[11].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1950_smt name: statement prose: Soft matching between Microsoft AD DS and Microsoft Entra ID is disabled following initial synchronisation activities. - id: ism-1951 class: ISM-control title: "Control: ism-1951" props: - name: sort-id value: "catalog[1].group[15].group[3].group[11].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1951_smt name: statement prose: Hard match takeover is disabled for Microsoft Entra Connect servers. - id: ism-1952 class: ISM-control title: "Control: ism-1952" props: - name: sort-id value: "catalog[1].group[15].group[3].group[11].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1952_smt name: statement prose: Privileged user accounts are not synchronised between Microsoft AD DS and Microsoft Entra ID. - title: Server application event logging props: - name: sort-id value: "catalog[1].group[15].group[3].group[12]" parts: - name: overview prose: "Centrally logging and analysing security-relevant events, including configuration changes, for server applications can assist in monitoring the security posture of systems, detecting malicious behaviour and contributing to investigations following cyber security incidents." controls: - id: ism-1978 class: ISM-control title: "Control: ism-1978" props: - name: sort-id value: "catalog[1].group[15].group[3].group[12].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1978_smt name: statement prose: Security-relevant events for server applications on internet-facing servers are centrally logged. - id: ism-1979 class: ISM-control title: "Control: ism-1979" props: - name: sort-id value: "catalog[1].group[15].group[3].group[12].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1979_smt name: statement prose: Security-relevant events for server applications on non-internet-facing servers are centrally logged. - title: Virtualisation hardening props: - name: sort-id value: "catalog[1].group[15].group[4]" parts: - name: overview prose: |- # Context This section describes security controls applicable to Type 1 hypervisors (those that run on bare metal) and Type 2 hypervisors (those that run on top of a general-purpose operating system). In doing so, Type 1 hypervisors should be treated as operating systems while Type 2 hypervisors should be treated as applications. As Type 1 hypervisors are themselves lightweight operating systems, they can be treated as a combination of a software-based isolation mechanism and an underlying operating system. Conversely, Type 2 hypervisors will run on top of a general-purpose operating system that may be provided by a different vendor to that of the software-based isolation mechanism. Furthermore, containers enable versatile deployment of systems and, in doing so, should be treated the same as any other system. However, security controls in a containerised environment may take a different form when compared to other types of systems. For example, patching the operating system of a workstation may be performed differently to ensuring that a patched image is used for a container, however, the principle is the same. In general, the same security risks that apply to non-containerised systems will likely apply to containerised systems. # Further information Further information on container security can be found in National Institute of Standards and Technology Special Publication 800-190, [Application Container Security Guide](#887c65c3-c853-41c6-89d5-3f297108889e). Further information on cyber supply chain risk management can be found in the ‘Cyber supply chain risk management’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on vendors that have made a pledge to implement Secure by Design and Secure by Default principles and practices can be found on the United States’ Cybersecurity \& Infrastructure Security Agency’s [Secure by Design Pledge](#4974639a-f41a-4280-ae06-33d1f13d6083) website. Further information on the use of cloud services can be found in the ‘Managed services and cloud services’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on hardening operating systems can be found in the ‘Operating system hardening’ section of these guidelines. Further information on patching or updating operating systems and applications can be found in the ‘System maintenance’ section of the [Guidelines for system management](#c6ca6620-ccd5-4c5d-b97c-9d92f1162948). Further information on event logging can be found in the ‘Security monitoring’ section of the [Guidelines for security assurance](#ef60c0e4-acfb-4a8b-b5ed-25675c6e117c). Further information on hypervisor security can be found in National Institute of Standards and Technology Special Publication 800-125A Rev. 1, [Security Recommendations for Server-based Hypervisor Platforms](#33d26cdd-51fc-45d3-a026-0814d51a4c7e). groups: - title: Functional separation between operating environments props: - name: sort-id value: "catalog[1].group[15].group[4].group[1]" parts: - name: overview prose: |- Physical computing resources can be shared among multiple operating environments via software-based isolation mechanisms. In doing so, an operating environment only has access to the virtual resources provided via the software-based isolation mechanism. In some cases, multiple layers of virtualisation, known as nested virtualisation, can exist. This is particularly prevalent with cloud services. Examples of software-based isolation include: - an operating system installed in a virtual machine where the isolation mechanism is a hypervisor, such as an Infrastructure as a Service offering - an application that uses the shared kernel of the underlying operating system of the physical computing resource where the isolation mechanism is an application container or application sandbox, such as a Platform as a Service offering - a containerised service hosted in a cloud environment, such as a Platform as a Service offering. The logical separation of data within a single application, such as a Software as a Service offering, is not considered the same as multiple operating environments. Malicious actors who have compromised a single operating environment, or who legitimately control a single operating environment, might exploit a misconfiguration or vulnerability in an underlying software-based isolation mechanism. This can lead to the compromise of other operating environments that share the same software-based isolation mechanism or the compromise of the underlying operating system of the physical computing resource. As such, it is important that additional security controls be implemented when using a software-based isolation mechanism that consumes shared physical computing resources. controls: - id: ism-1460 class: ISM-control title: "Control: ism-1460" props: - name: sort-id value: "catalog[1].group[15].group[4].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1460_smt name: statement prose: "When using a software-based isolation mechanism that consumes shared physical computing resources, the isolation mechanism is from a vendor that has demonstrated a commitment to Secure by Design and Secure by Default principles and practices, including secure programming practices and either memory-safe programming languages or less preferably memory-safe programming practices." - id: ism-1604 class: ISM-control title: "Control: ism-1604" props: - name: sort-id value: "catalog[1].group[15].group[4].group[1].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1604_smt name: statement prose: "When using a software-based isolation mechanism that consumes shared physical computing resources, the configuration of the isolation mechanism is hardened by removing unneeded functionality and restricting access to the administrative interface used to manage the isolation mechanism." - id: ism-1605 class: ISM-control title: "Control: ism-1605" props: - name: sort-id value: "catalog[1].group[15].group[4].group[1].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1605_smt name: statement prose: "When using a software-based isolation mechanism that consumes shared physical computing resources, the underlying operating system is hardened." - id: ism-1606 class: ISM-control title: "Control: ism-1606" props: - name: sort-id value: "catalog[1].group[15].group[4].group[1].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1606_smt name: statement prose: "When using a software-based isolation mechanism that consumes shared physical computing resources, patches, updates or vendor mitigations for vulnerabilities are applied to the isolation mechanism and underlying operating system in a timely manner." - id: ism-1848 class: ISM-control title: "Control: ism-1848" props: - name: sort-id value: "catalog[1].group[15].group[4].group[1].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1848_smt name: statement prose: "When using a software-based isolation mechanism that consumes shared physical computing resources, the isolation mechanism or underlying operating system is replaced when it is no longer supported by a vendor." - id: ism-1607 class: ISM-control title: "Control: ism-1607" props: - name: sort-id value: "catalog[1].group[15].group[4].group[1].control[6]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1607_smt name: statement prose: "When using a software-based isolation mechanism that consumes shared physical resources, integrity monitoring and centralised event logging is performed for the isolation mechanism and underlying operating system." - id: ism-1461 class: ISM-control title: "Control: ism-1461" props: - name: sort-id value: "catalog[1].group[15].group[4].group[1].control[7]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1461_smt name: statement prose: "When using a software-based isolation mechanism that consumes shared physical computing resources for SECRET or TOP SECRET operating environments, the physical server and all operating environments are of the same classification and belong to the same security domain." - title: Guidelines for system access props: - name: sort-id value: "catalog[1].group[16]" groups: - title: Identity and access management props: - name: sort-id value: "catalog[1].group[16].group[1]" parts: - name: overview prose: |- # Context Where these guidelines refer to security clearances, this includes both Australian security clearances and those from foreign governments that are formally recognised by Australia. In addition, while some security controls in these guidelines apply specifically to human users, security controls for identifying, authenticating, authorising and monitoring users also apply to non-human users, such as services, applications, workloads and artificial intelligence (AI) agents. # Further information Further information on access to government resources, including required security clearances, can be found in the Department of Home Affairs’ [Protective Security Policy Framework](#92679127-f61d-486a-a93e-df2a26dfb07a). Further information on access to highly sensitive government resources, including required briefings, can be found in the Government Security Committee’s Australian Government Security Caveat Guidelines. This publication is available from the Protective Security Policy GovTEAMS community or the Australian Security Intelligence Organisation by email. Further information on restricting the use of privileged user accounts can be found in ASD’s [Restricting administrative privileges](#3ccea9a8-a728-4f5b-a0a8-43f2f206f76b) publication. Further information on administering systems and their resources can be found in the ‘System administration’ section of the [Guidelines for system management](#c6ca6620-ccd5-4c5d-b97c-9d92f1162948). Further information on event logging can be found in the ‘Security monitoring’ section of the [Guidelines for security assurance](#ef60c0e4-acfb-4a8b-b5ed-25675c6e117c). Further information on the use of AI agents can be found in ASD’s [Careful adoption of agentic AI services](#388c3570-58ed-40be-be5e-bdfba9cfee1d) publication. Further information on implementing multi-factor authentication can be found in ASD’s [Implementing multi-factor authentication](#83e3a9b1-5057-4531-91dd-03c8d92634b0) publication. groups: - title: System usage policy props: - name: sort-id value: "catalog[1].group[16].group[1].group[01]" parts: - name: overview prose: "To enable an organisation to be capable of holding personnel accountable for the actions they perform on their systems, it is important that the organisation develops, implements and maintains a system usage policy governing the use of systems and their resources." controls: - id: ism-1864 class: ISM-control title: "Control: ism-1864" props: - name: sort-id value: "catalog[1].group[16].group[1].group[01].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1864_smt name: statement prose: "A system usage policy is developed, implemented and maintained." - title: System access requirements props: - name: sort-id value: "catalog[1].group[16].group[1].group[02]" parts: - name: overview prose: |- Documenting access requirements for systems and their resources can assist in determining whether users meet requirements for access. In doing so, requirements should account for whether access is unprivileged or privileged and, for personnel, whether additional requirements apply because they are foreign nationals or contractors. To reinforce personnel’s agreement to abide by system usage policies as a condition of being granted access to a system and its resources, displaying a logon banner each time they log on to the system can provide a continual reminder of their security responsibilities. Logon banners may cover topics such as: - the sensitivity or classification of the system - access requirements for the system - usage policies for the system and its resources - details of any monitoring activities for the system. controls: - id: ism-0432 class: ISM-control title: "Control: ism-0432" props: - name: sort-id value: "catalog[1].group[16].group[1].group[02].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0432_smt name: statement prose: Access requirements for systems and their resources are documented in their system security plan. - id: ism-0434 class: ISM-control title: "Control: ism-0434" props: - name: sort-id value: "catalog[1].group[16].group[1].group[02].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0434_smt name: statement prose: "Personnel undergo appropriate employment screening and, where necessary, hold an appropriate security clearance before being granted access to systems and their resources." - id: ism-0435 class: ISM-control title: "Control: ism-0435" props: - name: sort-id value: "catalog[1].group[16].group[1].group[02].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0435_smt name: statement prose: Personnel receive any necessary briefings before being granted access to systems and their resources. - id: ism-1865 class: ISM-control title: "Control: ism-1865" props: - name: sort-id value: "catalog[1].group[16].group[1].group[02].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1865_smt name: statement prose: Personnel agree to abide by system usage policies before being granted access to systems and their resources. - id: ism-0408 class: ISM-control title: "Control: ism-0408" props: - name: sort-id value: "catalog[1].group[16].group[1].group[02].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0408_smt name: statement prose: Systems have a logon banner that reminds personnel of their security responsibilities when accessing the system and its resources. - title: User identification props: - name: sort-id value: "catalog[1].group[16].group[1].group[03]" parts: - name: overview prose: "Ensuring users are uniquely identifiable enables their access and activities to be attributed to them. Furthermore, where systems process, store or communicate Australian Eyes Only (AUSTEO), Australian Government Access Only (AGAO) or Releasable To (REL) data, and foreign nationals have access, it is important that the foreign nationals are identified as such." controls: - id: ism-0414 class: ISM-control title: "Control: ism-0414" props: - name: sort-id value: "catalog[1].group[16].group[1].group[03].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0414_smt name: statement prose: Users granted access to systems and their resources are uniquely identifiable. - id: ism-0415 class: ISM-control title: "Control: ism-0415" props: - name: sort-id value: "catalog[1].group[16].group[1].group[03].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0415_smt name: statement prose: "The use of shared user accounts is strictly controlled, and users of such accounts are uniquely identifiable." - id: ism-1583 class: ISM-control title: "Control: ism-1583" props: - name: sort-id value: "catalog[1].group[16].group[1].group[03].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Aug-20 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1583_smt name: statement prose: Personnel who are contractors are identified as such. - id: ism-0420 class: ISM-control title: "Control: ism-0420" props: - name: sort-id value: "catalog[1].group[16].group[1].group[03].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "12" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0420_smt name: statement prose: "Where systems process, store or communicate AUSTEO, AGAO or REL data, personnel who are foreign nationals are identified as such, including by their specific nationality." - title: Artificial intelligence agent identification props: - name: sort-id value: "catalog[1].group[16].group[1].group[04]" parts: - name: overview prose: "In addition to the general requirement for users to be uniquely identifiable, assigning each AI agent its own unique identity ensures that actions taken by an AI agent can be distinguished from actions taken directly by a user on whose behalf it acts, as well as from actions taken by other AI agents. In doing so, identities assigned to AI agents should be managed in a similar manner to service accounts, including being disabled or removed when no longer required. Where an AI agent is assigned multiple identities, such as across different environments or platforms, all identities should be recorded in an organisation’s AI agent register." controls: - id: ism-2133 class: ISM-control title: "Control: ism-2133" props: - name: sort-id value: "catalog[1].group[16].group[1].group[04].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2133_smt name: statement prose: Each AI agent is assigned a unique identity that is distinct from the user accounts of personnel and the identities of other AI agents. - title: Unprivileged access to systems props: - name: sort-id value: "catalog[1].group[16].group[1].group[05]" parts: - name: overview prose: |- Personnel seeking access to systems and their resources should have a genuine business requirement validated by their manager or another appropriate authority. In addition, centrally logging and analysing unprivileged access events can assist in monitoring the security posture of systems and their resources, detecting malicious behaviour and contributing to investigations following cyber security incidents. controls: - id: ism-0405 class: ISM-control title: "Control: ism-0405" props: - name: sort-id value: "catalog[1].group[16].group[1].group[05].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0405_smt name: statement prose: Requests for unprivileged access to systems and their resources are validated when first requested. - id: ism-1852 class: ISM-control title: "Control: ism-1852" props: - name: sort-id value: "catalog[1].group[16].group[1].group[05].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1852_smt name: statement prose: Unprivileged access to systems and their resources is limited to only what is required for users to undertake their duties or functions. - id: ism-1566 class: ISM-control title: "Control: ism-1566" props: - name: sort-id value: "catalog[1].group[16].group[1].group[05].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1566_smt name: statement prose: Use of unprivileged access is centrally logged. - title: Unprivileged access to systems by foreign nationals props: - name: sort-id value: "catalog[1].group[16].group[1].group[06]" parts: - name: overview prose: "Due to the extra sensitivities associated with AUSTEO, AGAO and REL data, foreign access to such data is strictly controlled." controls: - id: ism-0409 class: ISM-control title: "Control: ism-0409" props: - name: sort-id value: "catalog[1].group[16].group[1].group[06].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "9" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0409_smt name: statement prose: "Foreign nationals, including seconded foreign nationals, do not have access to systems that process, store or communicate AUSTEO or REL data unless effective security controls are in place to ensure such data is not accessible to them." - id: ism-0411 class: ISM-control title: "Control: ism-0411" props: - name: sort-id value: "catalog[1].group[16].group[1].group[06].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0411_smt name: statement prose: "Foreign nationals, excluding seconded foreign nationals, do not have access to systems that process, store or communicate AGAO data unless effective security controls are in place to ensure such data is not accessible to them." - title: Privileged access to systems props: - name: sort-id value: "catalog[1].group[16].group[1].group[07]" parts: - name: overview prose: |- Privileged user accounts are considered those that can alter or circumvent security controls. This also applies to user accounts that may only have limited privileges but still have the ability to bypass some security controls. Privileged user accounts are often targeted by malicious actors as they can potentially give full access to systems and their resources. As such, ensuring that privileged user accounts are prevented from accessing the internet, email and web services minimises opportunities for these accounts to be compromised. However, if privileged user accounts are explicitly authorised to access online services, they should be strictly limited to only what is required for users to undertake their duties or functions. Finally, centrally logging and analysing privileged access events, as well as privileged user account and security group management events, can assist in monitoring the security posture of systems and their resources, detecting malicious behaviour and contributing to investigations following cyber security incidents. controls: - id: ism-1507 class: ISM-control title: "Control: ism-1507" props: - name: sort-id value: "catalog[1].group[16].group[1].group[07].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1507_smt name: statement prose: Requests for privileged access to systems and their resources are validated when first requested. - id: ism-1508 class: ISM-control title: "Control: ism-1508" props: - name: sort-id value: "catalog[1].group[16].group[1].group[07].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1508_smt name: statement prose: Privileged access to systems and their resources is limited to only what is required for users to undertake their duties or functions. - id: ism-1175 class: ISM-control title: "Control: ism-1175" props: - name: sort-id value: "catalog[1].group[16].group[1].group[07].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1175_smt name: statement prose: "Privileged user accounts (excluding those explicitly authorised to access online services) are prevented from accessing the internet, email and web services." - id: ism-1883 class: ISM-control title: "Control: ism-1883" props: - name: sort-id value: "catalog[1].group[16].group[1].group[07].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1883_smt name: statement prose: Privileged user accounts explicitly authorised to access online services are strictly limited to only what is required for users to undertake their duties or functions. - id: ism-1649 class: ISM-control title: "Control: ism-1649" props: - name: sort-id value: "catalog[1].group[16].group[1].group[07].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1649_smt name: statement prose: Just-in-time administration is used for the administration of systems and their resources. - id: ism-0445 class: ISM-control title: "Control: ism-0445" props: - name: sort-id value: "catalog[1].group[16].group[1].group[07].control[6]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "9" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-0445_smt name: statement prose: Privileged human users are assigned a dedicated privileged user account to be used solely for duties requiring privileged access. - id: ism-1263 class: ISM-control title: "Control: ism-1263" props: - name: sort-id value: "catalog[1].group[16].group[1].group[07].control[7]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1263_smt name: statement prose: Unique privileged user accounts are used for administering individual server applications. - id: ism-1509 class: ISM-control title: "Control: ism-1509" props: - name: sort-id value: "catalog[1].group[16].group[1].group[07].control[8]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1509_smt name: statement prose: Privileged access events are centrally logged. - id: ism-1650 class: ISM-control title: "Control: ism-1650" props: - name: sort-id value: "catalog[1].group[16].group[1].group[07].control[9]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1650_smt name: statement prose: Privileged user account and security group management events are centrally logged. - title: Privileged access to systems by foreign nationals props: - name: sort-id value: "catalog[1].group[16].group[1].group[08]" parts: - name: overview prose: "As privileged user accounts often have the ability to bypass security controls, it is strongly encouraged that foreign nationals are not given privileged access to systems that process, store or communicate AUSTEO, AGAO or REL data." controls: - id: ism-0446 class: ISM-control title: "Control: ism-0446" props: - name: sort-id value: "catalog[1].group[16].group[1].group[08].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0446_smt name: statement prose: "Foreign nationals, including seconded foreign nationals, do not have privileged access to systems that process, store or communicate AUSTEO or REL data." - id: ism-0447 class: ISM-control title: "Control: ism-0447" props: - name: sort-id value: "catalog[1].group[16].group[1].group[08].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0447_smt name: statement prose: "Foreign nationals, excluding seconded foreign nationals, do not have privileged access to systems that process, store or communicate AGAO data." - title: Recording authorisation for personnel to access systems props: - name: sort-id value: "catalog[1].group[16].group[1].group[09]" parts: - name: overview prose: "Retaining records of account requests for systems and their resources will assist in maintaining personnel accountability. Such records should include each human user’s unique identifier, their agreement to abide by system usage policies, who provided the authorisation for their access, when their authorisation was granted and when their access was last reviewed." controls: - id: ism-0407 class: ISM-control title: "Control: ism-0407" props: - name: sort-id value: "catalog[1].group[16].group[1].group[09].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0407_smt name: statement prose: |- A secure record is maintained for the life of systems and their resources that covers the following for each human user: - their unique identifier - their signed agreement to abide by system usage policies - who authorised their access - when their access was granted - the level of access they were granted - when their access, and their level of access, was last reviewed - when their level of access was changed, and to what extent (if applicable) - when their access was withdrawn (if applicable). - title: Artificial intelligence agent register props: - name: sort-id value: "catalog[1].group[16].group[1].group[10]" parts: - name: overview prose: "AI agents can be rapidly created and deployed across an organisation’s systems, often by personnel operating outside of traditional software deployment processes. Each AI agent may be configured with its own instructions, AI models, tools, permissions, credentials and access to data repositories. Without visibility of the AI agents operating across its systems, an organisation cannot effectively restrict AI agents to the minimum permissions they require, review their continued need, identify unauthorised or abandoned AI agents, or investigate cyber security incidents involving them. As such, an organisation should develop, implement, maintain and regularly verify an AI agent register. An AI agent register may also record additional details, such as the AI models used by each AI agent and their versions, to support change management and cyber supply chain risk management activities." controls: - id: ism-2134 class: ISM-control title: "Control: ism-2134" props: - name: sort-id value: "catalog[1].group[16].group[1].group[10].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2134_smt name: statement prose: "An AI agent register is developed, implemented, maintained and regularly verified." - id: ism-2135 class: ISM-control title: "Control: ism-2135" props: - name: sort-id value: "catalog[1].group[16].group[1].group[10].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2135_smt name: statement prose: |- An AI agent register contains the following for each AI agent: - its unique identifier - its owner and business purpose - the identities assigned to it - any user accounts and credentials it uses - the tools, permissions and data repositories it can access. - title: Suspension of access to systems props: - name: sort-id value: "catalog[1].group[16].group[1].group[11]" parts: - name: overview prose: "Removing or suspending access to systems and their resources, ideally using an automatic mechanism, can prevent them from being accessed when there is no longer a legitimate business requirement for their use, such as when users change duties or functions, or are detected undertaking malicious activities." controls: - id: ism-0430 class: ISM-control title: "Control: ism-0430" props: - name: sort-id value: "catalog[1].group[16].group[1].group[11].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "9" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0430_smt name: statement prose: Access to systems and their resources are removed or suspended the same day users no longer have a legitimate requirement for access. - id: ism-1591 class: ISM-control title: "Control: ism-1591" props: - name: sort-id value: "catalog[1].group[16].group[1].group[11].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1591_smt name: statement prose: Access to systems and their resources are removed or suspended as soon as practicable when users are detected undertaking malicious activities. - id: ism-1404 class: ISM-control title: "Control: ism-1404" props: - name: sort-id value: "catalog[1].group[16].group[1].group[11].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1404_smt name: statement prose: Unprivileged access to systems and their resources are disabled after 45 days of inactivity. - id: ism-1648 class: ISM-control title: "Control: ism-1648" props: - name: sort-id value: "catalog[1].group[16].group[1].group[11].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1648_smt name: statement prose: Privileged access to systems and their resources are disabled after 45 days of inactivity. - id: ism-1647 class: ISM-control title: "Control: ism-1647" props: - name: sort-id value: "catalog[1].group[16].group[1].group[11].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1647_smt name: statement prose: Privileged access to systems and their resources are disabled after 12 months unless revalidated. - title: Temporary access to systems props: - name: sort-id value: "catalog[1].group[16].group[1].group[12]" parts: - name: overview prose: "Under strict circumstances, temporary access to systems and their resources may be granted to personnel who lack an appropriate security clearance or briefing. In such circumstances, personnel should have their access controlled in such a way that they only have access to data required for them to undertake their duties or functions." controls: - id: ism-0441 class: ISM-control title: "Control: ism-0441" props: - name: sort-id value: "catalog[1].group[16].group[1].group[12].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "10" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0441_smt name: statement prose: "When personnel are granted temporary access to systems and their resources, effective security controls are put in place to restrict their access to only data required for them to undertake their duties or functions." - id: ism-0443 class: ISM-control title: "Control: ism-0443" props: - name: sort-id value: "catalog[1].group[16].group[1].group[12].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0443_smt name: statement prose: "Temporary access is not granted to systems that process, store or communicate caveated or sensitive compartmented information." - title: Emergency access to systems props: - name: sort-id value: "catalog[1].group[16].group[1].group[13]" parts: - name: overview prose: |- It is important that an organisation does not lose access to systems and their resources. As such, an organisation should always have a method for gaining access during emergencies. Typically, emergencies can occur when access cannot be gained via normal authentication processes, such as due to misconfigurations of authentication services, misconfigurations of security settings or due to a cyber security incident. In these situations, break glass accounts (also known as emergency access accounts) can be used to gain access. As break glass accounts have the highest level of privileges available, extreme care should be taken to protect them, as well as monitor them for any signs of compromise or abuse. When break glass accounts are used, any administrative activities performed will not be directly attributable to individuals, and event logs may not be generated. As such, additional security controls need to be implemented to maintain the system’s integrity. In doing so, an organisation should ensure that any administrative activities performed using break glass accounts are identified and documented in support of change management processes and procedures. This includes documenting the individuals using break glass accounts, the reasons for using break glass accounts and any administrative activities performed using break glass accounts. As the custodian of each break glass account should be the only party who knows the break glass account’s credentials, credentials will need to be changed and tested by custodians after any authorised access by another party. Modern password managers that support automated credential changes can assist in reducing the administrative overhead of such activities. Finally, centrally logging and analysing break glass account events can assist in monitoring the security posture of systems and their resources, detecting malicious behaviour and contributing to investigations following cyber security incidents. controls: - id: ism-1610 class: ISM-control title: "Control: ism-1610" props: - name: sort-id value: "catalog[1].group[16].group[1].group[13].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1610_smt name: statement prose: A method of emergency access to systems and their resources is documented and tested at least once when initially implemented and each time fundamental information technology infrastructure changes occur. - id: ism-1611 class: ISM-control title: "Control: ism-1611" props: - name: sort-id value: "catalog[1].group[16].group[1].group[13].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Aug-20 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1611_smt name: statement prose: Break glass accounts are only used when normal authentication processes cannot be used. - id: ism-1612 class: ISM-control title: "Control: ism-1612" props: - name: sort-id value: "catalog[1].group[16].group[1].group[13].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Aug-20 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1612_smt name: statement prose: Break glass accounts are only used for specific authorised activities. - id: ism-1614 class: ISM-control title: "Control: ism-1614" props: - name: sort-id value: "catalog[1].group[16].group[1].group[13].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Aug-20 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1614_smt name: statement prose: Break glass account credentials are changed by the account custodian after they are accessed by any other party. - id: ism-1615 class: ISM-control title: "Control: ism-1615" props: - name: sort-id value: "catalog[1].group[16].group[1].group[13].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Aug-20 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1615_smt name: statement prose: Break glass accounts are tested after credentials are changed. - id: ism-1613 class: ISM-control title: "Control: ism-1613" props: - name: sort-id value: "catalog[1].group[16].group[1].group[13].control[6]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1613_smt name: statement prose: Use of break glass accounts is centrally logged. - title: Control of Australian systems props: - name: sort-id value: "catalog[1].group[16].group[1].group[14]" parts: - name: overview prose: "Due to extra sensitivities associated with AUSTEO and AGAO data, it is essential that control of systems that process, store or communicate such data are maintained by Australian nationals working for or on behalf of the Australian Government. Furthermore, AUSTEO and AGAO data should only be accessible from systems under the sole control of the Australian Government that are located within facilities authorised by the Australian Government." controls: - id: ism-0078 class: ISM-control title: "Control: ism-0078" props: - name: sort-id value: "catalog[1].group[16].group[1].group[14].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0078_smt name: statement prose: "Systems processing, storing or communicating AUSTEO or AGAO data remain at all times under the control of an Australian national working for or on behalf of the Australian Government." - id: ism-0854 class: ISM-control title: "Control: ism-0854" props: - name: sort-id value: "catalog[1].group[16].group[1].group[14].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0854_smt name: statement prose: AUSTEO and AGAO data can only be accessed from systems under the sole control of the Australian Government that are located within facilities authorised by the Australian Government. - title: Authenticating to systems props: - name: sort-id value: "catalog[1].group[16].group[1].group[15]" parts: - name: overview prose: |- Before access to a system and its resources is granted to a user, it is essential that they are authenticated. For human users, this can be achieved via multi-factor authentication, such as a username, password and security key, or less preferably via single-factor authentication, such as a username and password. In addition, access decisions should not rely solely on the successful presentation of authentication artefacts. Risk-based access decisions can draw upon contextual signals such as device compliance, authentication strength, privilege level and user behaviour to determine whether access should be granted, re-authentication should be required or access should be denied. In doing so, an organisation should be aware that sign-in location is a weak signal on its own, as malicious actors increasingly route their activities through residential internet protocol addresses and covert networks of compromised devices to defeat location-based and reputation-based measures. controls: - id: ism-1546 class: ISM-control title: "Control: ism-1546" props: - name: sort-id value: "catalog[1].group[16].group[1].group[15].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Aug-19 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1546_smt name: statement prose: Users are authenticated before they are granted access to a system and its resources. - id: ism-2136 class: ISM-control title: "Control: ism-2136" props: - name: sort-id value: "catalog[1].group[16].group[1].group[15].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2136_smt name: statement prose: "Risk-based access decisions, informed by contextual signals, are enforced for access to systems and their resources." - title: Insecure authentication methods props: - name: sort-id value: "catalog[1].group[16].group[1].group[16]" parts: - name: overview prose: "Authentication methods need to resist theft, interception, duplication, forgery, unauthorised access and unauthorised modification. For example, LAN Manager authentication protects credentials with a weak hashing algorithm, while all versions of NT LAN Manager lack mutual authentication and rely on password-derived hashes. As such, malicious actors can exploit these authentication methods via relay attacks, pass-the-hash attacks and the offline cracking of captured authentication exchanges. Instead, an organisation should use Kerberos for authentication within Microsoft Windows environments." controls: - id: ism-1603 class: ISM-control title: "Control: ism-1603" props: - name: sort-id value: "catalog[1].group[16].group[1].group[16].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Aug-20 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1603_smt name: statement prose: Authentication methods susceptible to replay attacks are disabled. - id: ism-1055 class: ISM-control title: "Control: ism-1055" props: - name: sort-id value: "catalog[1].group[16].group[1].group[16].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Oct-20 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1055_smt name: statement prose: LAN Manager and NT LAN Manager authentication methods are disabled. - id: ism-2076 class: ISM-control title: "Control: ism-2076" props: - name: sort-id value: "catalog[1].group[16].group[1].group[16].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2076_smt name: statement prose: Security questions are not used for authentication purposes. - id: ism-2077 class: ISM-control title: "Control: ism-2077" props: - name: sort-id value: "catalog[1].group[16].group[1].group[16].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2077_smt name: statement prose: Email is not used for out-of-band authentication purposes. - title: Multi-factor authentication props: - name: sort-id value: "catalog[1].group[16].group[1].group[17]" parts: - name: overview prose: |- Multi-factor authentication uses two or more different authentication factors. This may include: - something people know, such as a password - something people have, such as a security key, smart card, smartphone or one-time password token - something people are, such as a fingerprint pattern or their facial geometry. Human users of online services, privileged human users of systems and human users with access to data repositories are more likely to be targeted by malicious actors due to their access. For this reason, it is especially important that multi-factor authentication is used for these user accounts. In addition, multi-factor authentication is vital when human users perform administrative activities as it can limit the consequences of a compromise by preventing or slowing malicious actors’ ability to gain unrestricted access to assets. In this regard, multi-factor authentication can be implemented as part of jump server authentication where assets being administered do not support multi-factor authentication themselves. When implementing multi-factor authentication, several different authentication factors can be implemented. Unfortunately, some authentication factors, such as biometrics or codes sent via Short Message Service, Voice over Internet Protocol or email, are more susceptible to compromise than others. For this reason, authentication factors that involve something people have should be used with something people know. Alternatively, something people have that is unlocked by something people know or are (often known as passwordless multi-factor authentication) can be used. Furthermore, for increased security, the use of phishing-resistant multi-factor authentication is recommended to protect against real-time phishing attacks. Passkey authentication may provide either single-factor or multi-factor authentication, depending on how it is implemented and used. It typically uses a computer or smartphone, or a separate security key, to store or access a private key. Where use of the private key requires an activation factor, such as a password or biometric, passkey authentication satisfies multi-factor authentication requirements. Finally, centrally logging and analysing multi-factor authentication events can assist in monitoring the security posture of systems, detecting malicious behaviour and contributing to investigations following cyber security incidents. controls: - id: ism-1504 class: ISM-control title: "Control: ism-1504" props: - name: sort-id value: "catalog[1].group[16].group[1].group[17].control[01]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1504_smt name: statement prose: "Multi-factor authentication is used to authenticate human users to their organisation’s online services that process, store or communicate their organisation’s sensitive data." - id: ism-1679 class: ISM-control title: "Control: ism-1679" props: - name: sort-id value: "catalog[1].group[16].group[1].group[17].control[02]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1679_smt name: statement prose: "Multi-factor authentication is used to authenticate human users to third-party online services that process, store or communicate their organisation’s sensitive data." - id: ism-1680 class: ISM-control title: "Control: ism-1680" props: - name: sort-id value: "catalog[1].group[16].group[1].group[17].control[03]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1680_smt name: statement prose: "Multi-factor authentication (where available) is used to authenticate human users to third-party online services that process, store or communicate their organisation’s non-sensitive data." - id: ism-1892 class: ISM-control title: "Control: ism-1892" props: - name: sort-id value: "catalog[1].group[16].group[1].group[17].control[04]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1892_smt name: statement prose: "Multi-factor authentication is used to authenticate human users to their organisation’s online customer services that process, store or communicate their organisation’s sensitive customer data." - id: ism-1893 class: ISM-control title: "Control: ism-1893" props: - name: sort-id value: "catalog[1].group[16].group[1].group[17].control[05]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1893_smt name: statement prose: "Multi-factor authentication is used to authenticate human users to third-party online customer services that process, store or communicate their organisation’s sensitive customer data." - id: ism-1681 class: ISM-control title: "Control: ism-1681" props: - name: sort-id value: "catalog[1].group[16].group[1].group[17].control[06]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1681_smt name: statement prose: "Multi-factor authentication is used to authenticate customers to online customer services that process, store or communicate sensitive customer data." - id: ism-1919 class: ISM-control title: "Control: ism-1919" props: - name: sort-id value: "catalog[1].group[16].group[1].group[17].control[07]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1919_smt name: statement prose: "When multi-factor authentication is used to authenticate human users or customers to online services or online customer services, all other authentication protocols that do not support multi-factor authentication are disabled." - id: ism-1173 class: ISM-control title: "Control: ism-1173" props: - name: sort-id value: "catalog[1].group[16].group[1].group[17].control[08]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1173_smt name: statement prose: Multi-factor authentication is used to authenticate privileged human users of systems. - id: ism-0974 class: ISM-control title: "Control: ism-0974" props: - name: sort-id value: "catalog[1].group[16].group[1].group[17].control[09]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-0974_smt name: statement prose: Multi-factor authentication is used to authenticate unprivileged human users of systems. - id: ism-1505 class: ISM-control title: "Control: ism-1505" props: - name: sort-id value: "catalog[1].group[16].group[1].group[17].control[10]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1505_smt name: statement prose: Multi-factor authentication is used to authenticate human users of data repositories. - id: ism-1401 class: ISM-control title: "Control: ism-1401" props: - name: sort-id value: "catalog[1].group[16].group[1].group[17].control[11]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1401_smt name: statement prose: "Multi-factor authentication uses either: something people have and something people know, or something people have that is unlocked by something people know or are." - id: ism-1872 class: ISM-control title: "Control: ism-1872" props: - name: sort-id value: "catalog[1].group[16].group[1].group[17].control[12]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1872_smt name: statement prose: Multi-factor authentication used for authenticating human users of online services is phishing-resistant. - id: ism-1873 class: ISM-control title: "Control: ism-1873" props: - name: sort-id value: "catalog[1].group[16].group[1].group[17].control[13]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 parts: - id: ism-1873_smt name: statement prose: Multi-factor authentication used for authenticating customers of online customer services provides a phishing-resistant option. - id: ism-1874 class: ISM-control title: "Control: ism-1874" props: - name: sort-id value: "catalog[1].group[16].group[1].group[17].control[14]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1874_smt name: statement prose: Multi-factor authentication used for authenticating customers of online customer services is phishing-resistant. - id: ism-1682 class: ISM-control title: "Control: ism-1682" props: - name: sort-id value: "catalog[1].group[16].group[1].group[17].control[15]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1682_smt name: statement prose: Multi-factor authentication used for authenticating human users of systems is phishing-resistant. - id: ism-1894 class: ISM-control title: "Control: ism-1894" props: - name: sort-id value: "catalog[1].group[16].group[1].group[17].control[16]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1894_smt name: statement prose: Multi-factor authentication used for authenticating human users of data repositories is phishing-resistant. - id: ism-2011 class: ISM-control title: "Control: ism-2011" props: - name: sort-id value: "catalog[1].group[16].group[1].group[17].control[17]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2011_smt name: statement prose: "When phishing-resistant multi-factor authentication is used by human users, other non-phishing-resistant multi-factor authentication options are disabled for their user accounts." - id: ism-1920 class: ISM-control title: "Control: ism-1920" props: - name: sort-id value: "catalog[1].group[16].group[1].group[17].control[18]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1920_smt name: statement prose: "When multi-factor authentication is used to authenticate human users to online services, online customer services, systems or data repositories – that process, store or communicate their organisation’s sensitive data or sensitive customer data – human users are prevented from self-enrolling into multi-factor authentication from untrustworthy devices." - id: ism-1683 class: ISM-control title: "Control: ism-1683" props: - name: sort-id value: "catalog[1].group[16].group[1].group[17].control[19]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1683_smt name: statement prose: Successful and unsuccessful multi-factor authentication events are centrally logged. - title: Single-factor authentication props: - name: sort-id value: "catalog[1].group[16].group[1].group[18]" parts: - name: overview prose: |- A significant threat to the compromise of user accounts is password cracking tools. When malicious actors gain access to a list of usernames and hashed passwords from a system, they can attempt to recover username and password pairs by comparing the hashes of known passwords with the hashed passwords they have gained access to. By finding a match, malicious actors will know the password associated with a given username. To reduce this security risk, an organisation should implement multi-factor authentication. In addition, centrally logging and analysing single-factor authentication events can assist in monitoring the security posture of systems, detecting malicious behaviour and contributing to investigations following cyber security incidents. controls: - id: ism-0417 class: ISM-control title: "Control: ism-0417" props: - name: sort-id value: "catalog[1].group[16].group[1].group[18].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0417_smt name: statement prose: "When systems cannot support multi-factor authentication, single-factor authentication using passwords is implemented instead." - id: ism-1895 class: ISM-control title: "Control: ism-1895" props: - name: sort-id value: "catalog[1].group[16].group[1].group[18].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1895_smt name: statement prose: Successful and unsuccessful single-factor authentication events are centrally logged. - title: User account lockouts props: - name: sort-id value: "catalog[1].group[16].group[1].group[19]" parts: - name: overview prose: "Locking user accounts after a specified number of repeated failed logon attempts reduces the likelihood of successful forms of credential brute-force attacks by malicious actors, such as credential guessing attacks, credential spraying attacks and credential stuffing attacks. However, care should be taken when implementing indefinite account lockouts in response to repeated failed logon attempts as this can increase the likelihood of a denial of service. Alternatively, some systems can be configured with risk-based lockout mechanisms in combination with automated lockout durations to slow down repeated failed logon attempts. Implementing multi-factor authentication is also an effective way of reducing the likelihood of successful credential brute-force attacks." controls: - id: ism-1403 class: ISM-control title: "Control: ism-1403" props: - name: sort-id value: "catalog[1].group[16].group[1].group[19].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1403_smt name: statement prose: "User accounts, except for break glass accounts, are protected by fixed or risk-based lockout mechanisms aligned to a maximum of five failed logon attempts, with either indefinite or automated lockout durations." - title: Session locking props: - name: sort-id value: "catalog[1].group[16].group[1].group[20]" parts: - name: overview prose: Session locking prevents unauthorised access to services that a human user has already authenticated to. controls: - id: ism-0428 class: ISM-control title: "Control: ism-0428" props: - name: sort-id value: "catalog[1].group[16].group[1].group[20].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "11" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0428_smt name: statement prose: |- Services are configured with a session lock that: - activates after a maximum of 15 minutes of human user inactivity, a maximum of 12 hours of overall session time or when manually activated - blocks access to all session content - requires re-authentication by human users using all authentication factors to unlock the session - denies human users the ability to disable the session locking mechanism. - title: Screen locking props: - name: sort-id value: "catalog[1].group[16].group[1].group[21]" parts: - name: overview prose: Screen locking prevents unauthorised access to a system that a human user has already authenticated to. controls: - id: ism-2012 class: ISM-control title: "Control: ism-2012" props: - name: sort-id value: "catalog[1].group[16].group[1].group[21].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2012_smt name: statement prose: |- Systems are configured with a screen lock that: - activates after a maximum of 15 minutes of human user inactivity, or when manually activated - conceals all content on the screen - ensures that the screen does not enter a power saving state before the screen lock is activated - requires re-authentication by human users using all authentication factors to unlock the system - denies human users the ability to disable the screen locking mechanism. - title: Session termination props: - name: sort-id value: "catalog[1].group[16].group[1].group[22]" parts: - name: overview prose: Implementing measures to terminate interactive user sessions and restart workstations at least daily can assist in system maintenance activities and removing malicious actors that may have compromised a system but failed to gain persistence. controls: - id: ism-0853 class: ISM-control title: "Control: ism-0853" props: - name: sort-id value: "catalog[1].group[16].group[1].group[22].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0853_smt name: statement prose: Interactive user sessions are terminated and workstations are restarted at least daily. - title: Third-party application access and device code authentication props: - name: sort-id value: "catalog[1].group[16].group[1].group[23]" parts: - name: overview prose: |- Malicious actors can abuse legitimate Open Authorization (OAuth) flows to obtain enduring access to data without stealing credentials. In an illicit consent grant attack, a human user is tricked into granting a malicious third-party application consent to access data, after which the application holds OAuth tokens that operate independently of the human user’s credentials and survive credential resets. Separately, the device code authentication flow can be abused so that a human user, believing they are signing themselves in, authorises a malicious actor’s session. Importantly, malicious actors do not need to establish new consent grants if they can compromise an existing third-party application that has already been granted access, such as via a cyber supply chain attack against the application’s vendor. As such, in addition to controlling how new consent is granted, an organisation should regularly review existing consent grants, revoke those that are unused or hold excessive permissions, and centrally log consent and token issuance activity to support the detection of anomalous use. Finally, while the device code authentication flow should be disabled by default, an organisation may have a legitimate business requirement for its use, such as for input-constrained devices. In such cases, its use should be restricted to the specific user accounts and managed devices that require it. controls: - id: ism-2137 class: ISM-control title: "Control: ism-2137" props: - name: sort-id value: "catalog[1].group[16].group[1].group[23].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2137_smt name: statement prose: "Human users are prevented from granting consent to third-party OAuth applications, with such consent granted only by an authorised administrator." - id: ism-2138 class: ISM-control title: "Control: ism-2138" props: - name: sort-id value: "catalog[1].group[16].group[1].group[23].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2138_smt name: statement prose: "OAuth application consents, including their granted permissions, are reviewed at least every six months, with unused applications and excessive permissions revoked." - id: ism-2139 class: ISM-control title: "Control: ism-2139" props: - name: sort-id value: "catalog[1].group[16].group[1].group[23].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2139_smt name: statement prose: "Consent grants, token issuance and token use for third-party OAuth applications are centrally logged." - id: ism-2140 class: ISM-control title: "Control: ism-2140" props: - name: sort-id value: "catalog[1].group[16].group[1].group[23].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2140_smt name: statement prose: "The OAuth device code authentication flow is disabled unless required, and where required, is restricted to authorised user accounts and managed devices." - title: Credential management props: - name: sort-id value: "catalog[1].group[16].group[2]" parts: - name: overview prose: |- # Context The guidance within this section is equally applicable to all user accounts unless specified otherwise. This includes unprivileged user accounts and privileged user accounts, which include break glass accounts and service accounts. In addition, the guidance is equally applicable to interactive authentication and non-interactive authentication. # Further information Further information on [randomly generating passphrases](#58282062-5c17-476a-98b1-105a627cd28d) is available from the Electronic Frontier Foundation while a [random dice roller](#0508be6f-cb97-44da-b212-42416a0048b0) is available from RANDOM.ORG. Further information on how to [secure group Managed Service Accounts](#91b92563-d991-40fa-9adc-548df9f6c496) in Microsoft Windows Server is available from Microsoft. Further information on changing credentials for the Kerberos Key Distribution Center’s service account can be found in Microsoft’s [Active Directory accounts](#ae426d0a-adb6-43b8-a463-faa33e83b679) and [Active Directory Forest Recovery - Reset the krbtgt password](#3e5a98e5-9219-46c8-81c2-e3a4d13407ce) publications. A script for [changing credentials for this service account](#f74ba095-a7f7-4b8c-9e60-5fe84f2a2d0b) is also available from Microsoft. Further information on [Local Security Authority protection functionality](#3f43c8d2-8a8c-4e2f-af80-48a607bce643) is available from Microsoft. Further information on [Credential Guard functionality](#8d53ee7f-54c2-4380-8408-f7403db30ba1) and [Remote Credential Guard functionality](#92975dff-58e0-4813-842b-f27c0533ca56) is available from Microsoft. groups: - title: Password strength props: - name: sort-id value: "catalog[1].group[16].group[2].group[1]" parts: - name: overview prose: "When implementing passwords as an authentication factor, it is important that suitably robust and secure passwords are used. In doing so, the degree of password security required will depend on the sensitivity or classification of the system involved and whether passwords are implemented as part of multi-factor authentication or single-factor authentication." controls: - id: ism-1559 class: ISM-control title: "Control: ism-1559" props: - name: sort-id value: "catalog[1].group[16].group[2].group[1].control[01]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P parts: - id: ism-1559_smt name: statement prose: "Passwords used for multi-factor authentication on non-classified, OFFICIAL: Sensitive and PROTECTED systems are a minimum of 6 characters." - id: ism-1560 class: ISM-control title: "Control: ism-1560" props: - name: sort-id value: "catalog[1].group[16].group[2].group[1].control[02]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S parts: - id: ism-1560_smt name: statement prose: Passwords used for multi-factor authentication on SECRET systems are a minimum of 8 characters. - id: ism-1561 class: ISM-control title: "Control: ism-1561" props: - name: sort-id value: "catalog[1].group[16].group[2].group[1].control[03]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1561_smt name: statement prose: Passwords used for multi-factor authentication on TOP SECRET systems are a minimum of 10 characters. - id: ism-0421 class: ISM-control title: "Control: ism-0421" props: - name: sort-id value: "catalog[1].group[16].group[2].group[1].control[04]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "11" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P parts: - id: ism-0421_smt name: statement prose: "Passwords used for single-factor authentication on non-classified, OFFICIAL: Sensitive and PROTECTED systems are a minimum of 15 characters." - id: ism-1557 class: ISM-control title: "Control: ism-1557" props: - name: sort-id value: "catalog[1].group[16].group[2].group[1].control[05]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S parts: - id: ism-1557_smt name: statement prose: Passwords used for single-factor authentication on SECRET systems are a minimum of 17 characters. - id: ism-0422 class: ISM-control title: "Control: ism-0422" props: - name: sort-id value: "catalog[1].group[16].group[2].group[1].control[06]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "9" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0422_smt name: statement prose: Passwords used for single-factor authentication on TOP SECRET systems are a minimum of 20 characters. - id: ism-1558 class: ISM-control title: "Control: ism-1558" props: - name: sort-id value: "catalog[1].group[16].group[2].group[1].control[07]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1558_smt name: statement prose: |- Passwords using a sequence of words for single-factor authentication are not constructed using: - a list of categorised words - a real sentence in a natural language - song lyrics, movie or television show quotes, literature, or any other publicly available material - less than 4 random words for non-classified, OFFICIAL: Sensitive and PROTECTED systems; 5 random words for SECRET systems; or 6 random words for TOP SECRET systems. - id: ism-2078 class: ISM-control title: "Control: ism-2078" props: - name: sort-id value: "catalog[1].group[16].group[2].group[1].control[08]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2078_smt name: statement prose: Passwords appearing in lists of commonly used passwords or lists of compromised passwords are not used. - id: ism-2079 class: ISM-control title: "Control: ism-2079" props: - name: sort-id value: "catalog[1].group[16].group[2].group[1].control[09]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2079_smt name: statement prose: Maximum length limits for passwords are not less than 64 characters. - id: ism-2080 class: ISM-control title: "Control: ism-2080" props: - name: sort-id value: "catalog[1].group[16].group[2].group[1].control[10]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2080_smt name: statement prose: Password complexity requirements are not imposed for passwords. - id: ism-2081 class: ISM-control title: "Control: ism-2081" props: - name: sort-id value: "catalog[1].group[16].group[2].group[1].control[11]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2081_smt name: statement prose: All ASCII printable characters are supported for passwords. - title: Setting credentials for user accounts props: - name: sort-id value: "catalog[1].group[16].group[2].group[2]" parts: - name: overview prose: "Before any credentials are set, reset, temporarily disabled or re-enrolled for user accounts assigned to human users, it is important that human users provide sufficient evidence to verify their identity, such as by physically presenting themselves and their pass to a service desk, answering a set of challenge-response questions, or by demonstrating control of a linked mobile device. Following the verification of user identity, credentials should be randomly generated and provided via a secure communications channel or, if not possible, split into two parts with one part provided to the human user and the other part provided to their supervisor. Subsequently, credentials provided to human users should be reset on first use to ensure that they are not known by other parties." controls: - id: ism-1593 class: ISM-control title: "Control: ism-1593" props: - name: sort-id value: "catalog[1].group[16].group[2].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1593_smt name: statement prose: "Human users provide sufficient evidence to verify their identity when first requesting credentials, when requesting the reset of any credentials, when requesting the temporary disabling of any credentials, and when requesting the enrolment or re-enrolment of any credentials." - id: ism-1227 class: ISM-control title: "Control: ism-1227" props: - name: sort-id value: "catalog[1].group[16].group[2].group[2].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1227_smt name: statement prose: Credentials set for user accounts are randomly generated. - id: ism-1594 class: ISM-control title: "Control: ism-1594" props: - name: sort-id value: "catalog[1].group[16].group[2].group[2].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1594_smt name: statement prose: "Credentials for human users are provided via a secure communications channel or, if not possible, split into two parts with one part provided to the human user and the other part provided to their supervisor." - id: ism-1595 class: ISM-control title: "Control: ism-1595" props: - name: sort-id value: "catalog[1].group[16].group[2].group[2].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1595_smt name: statement prose: Credentials provided to human users are changed on first use. - id: ism-1596 class: ISM-control title: "Control: ism-1596" props: - name: sort-id value: "catalog[1].group[16].group[2].group[2].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1596_smt name: statement prose: Credentials are not reused by users across different systems. - title: "Setting credentials for built-in Administrator accounts, break glass accounts, local administrator accounts and service accounts" props: - name: sort-id value: "catalog[1].group[16].group[2].group[3]" parts: - name: overview prose: |- When built-in Administrator accounts, break glass accounts, local administrator accounts and service accounts use common usernames or weak credentials, it may allow malicious actors that compromise credentials on one workstation or server to compromise other workstations and servers. As such, it is critical that credentials for the built-in Administrator account, break glass accounts, local administrator accounts and service accounts in each domain are long, unique, unpredictable and managed. To provide additional security and credential management functionality for service accounts, Microsoft introduced group Managed Service Accounts to Microsoft Windows Server. In doing so, service accounts that are created as group Managed Service Accounts do not require manual credential management by system administrators, as the operating system automatically ensures that they are long, unique, unpredictable and managed. This ensures that service account credentials are secure, not misplaced or forgotten, and that they are automatically changed regularly. However, in cases where the use of group Managed Service Accounts is not possible, credentials for service accounts should still be unique, unpredictable and random with a minimum length of 30 characters. controls: - id: ism-1953 class: ISM-control title: "Control: ism-1953" props: - name: sort-id value: "catalog[1].group[16].group[2].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1953_smt name: statement prose: "Credentials for the built-in Administrator account in each domain are long, unique, unpredictable and managed." - id: ism-1685 class: ISM-control title: "Control: ism-1685" props: - name: sort-id value: "catalog[1].group[16].group[2].group[3].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1685_smt name: statement prose: "Credentials for break glass accounts, local administrator accounts and service accounts are long, unique, unpredictable and managed." - id: ism-1795 class: ISM-control title: "Control: ism-1795" props: - name: sort-id value: "catalog[1].group[16].group[2].group[3].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1795_smt name: statement prose: "Credentials for built-in Administrator accounts, break glass accounts, local administrator accounts and service accounts are a minimum of 30 characters." - id: ism-1954 class: ISM-control title: "Control: ism-1954" props: - name: sort-id value: "catalog[1].group[16].group[2].group[3].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1954_smt name: statement prose: "Credentials for built-in Administrator accounts, break glass accounts, local administrator accounts and service accounts are randomly generated." - id: ism-1619 class: ISM-control title: "Control: ism-1619" props: - name: sort-id value: "catalog[1].group[16].group[2].group[3].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Oct-20 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1619_smt name: statement prose: Service accounts are created as group Managed Service Accounts. - title: Application and workload credentials props: - name: sort-id value: "catalog[1].group[16].group[2].group[4]" parts: - name: overview prose: |- Applications and workloads may require credentials to authenticate to systems, services and data repositories without direct human involvement. Where such credentials are long-lived or reused by multiple applications, workloads or operating environments, their compromise can provide malicious actors with persistent access to systems and increase the extent of a compromise. Applications and workloads should use short-lived dynamically issued credentials in preference to long-lived static credentials. Where static credentials are required, centrally managing them using a credential or secrets management solution can assist with their secure storage, access control and lifecycle management. In addition, applications and workloads should use unique credentials that are not shared with other applications or workloads, or across development, testing, staging and production environments. controls: - id: ism-2141 class: ISM-control title: "Control: ism-2141" props: - name: sort-id value: "catalog[1].group[16].group[2].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2141_smt name: statement prose: Applications and workloads use short-lived dynamically issued credentials in preference to long-lived static credentials. - id: ism-2142 class: ISM-control title: "Control: ism-2142" props: - name: sort-id value: "catalog[1].group[16].group[2].group[4].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2142_smt name: statement prose: Static credentials used by applications and workloads are centrally managed using a credential or secrets management solution. - id: ism-2143 class: ISM-control title: "Control: ism-2143" props: - name: sort-id value: "catalog[1].group[16].group[2].group[4].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2143_smt name: statement prose: "Applications and workloads use unique credentials that are not shared with other applications or workloads, or across development, testing, staging and production environments." - title: Changing credentials props: - name: sort-id value: "catalog[1].group[16].group[2].group[5]" parts: - name: overview prose: |- Generally, credentials should not need to be changed; however, some events may necessitate a requirement for credentials to be changed. For user accounts, this can include credentials being compromised (such as appearing in an online data breach database) or being suspected of being compromised (such as when malicious actors gain access to a network), being discovered stored on systems in the clear, being transferred across networks in the clear, or when membership of shared user accounts change. Similarly, static credentials used by applications and workloads should be changed when they are compromised or suspected of being compromised, discovered stored on systems in the clear, or discovered being transferred across networks in the clear. controls: - id: ism-1590 class: ISM-control title: "Control: ism-1590" props: - name: sort-id value: "catalog[1].group[16].group[2].group[5].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1590_smt name: statement prose: |- Credentials for user accounts are changed if: - they are compromised or suspected of being compromised - they are discovered stored on systems in the clear - they are discovered being transferred across networks in the clear - membership of a shared user account changes. - id: ism-2144 class: ISM-control title: "Control: ism-2144" props: - name: sort-id value: "catalog[1].group[16].group[2].group[5].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2144_smt name: statement prose: |- Static credentials used by applications and workloads are changed if: - they are compromised or suspected of being compromised - they are discovered stored on systems in the clear - they are discovered being transferred across networks in the clear. - id: ism-1955 class: ISM-control title: "Control: ism-1955" props: - name: sort-id value: "catalog[1].group[16].group[2].group[5].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1955_smt name: statement prose: "Credentials for computer accounts are changed if they are compromised, they are suspected of being compromised or they have not been changed in the past 30 days." - id: ism-1847 class: ISM-control title: "Control: ism-1847" props: - name: sort-id value: "catalog[1].group[16].group[2].group[5].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1847_smt name: statement prose: "Credentials for the Kerberos Key Distribution Center’s service account (KRBTGT) are changed twice, allowing for replication to all Microsoft AD DS domain controllers in-between each change, if the domain has been directly compromised, the domain is suspected of being compromised or they have not been changed in the past six months." - id: ism-1956 class: ISM-control title: "Control: ism-1956" props: - name: sort-id value: "catalog[1].group[16].group[2].group[5].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1956_smt name: statement prose: "Microsoft AD FS token-signing and encryption certificates are changed twice in quick succession if they are compromised, they are suspected of being compromised or they have not been changed in the past 12 months." - title: Revoking credentials props: - name: sort-id value: "catalog[1].group[16].group[2].group[6]" parts: - name: overview prose: "Credentials that are no longer required should be revoked to prevent their subsequent use to gain unauthorised access to systems and their resources. This includes credentials associated with user accounts that are no longer required, as well as static credentials used by applications and workloads that have been decommissioned or are no longer required for access." controls: - id: ism-2145 class: ISM-control title: "Control: ism-2145" props: - name: sort-id value: "catalog[1].group[16].group[2].group[6].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2145_smt name: statement prose: Credentials for user accounts are revoked when they are no longer required. - id: ism-2146 class: ISM-control title: "Control: ism-2146" props: - name: sort-id value: "catalog[1].group[16].group[2].group[6].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2146_smt name: statement prose: Static credentials used by applications and workloads are revoked when they are no longer required. - title: Protecting credentials props: - name: sort-id value: "catalog[1].group[16].group[2].group[7]" parts: - name: overview prose: |- Obscuring credentials as they are entered into systems can assist in protecting them against screen scrapers and shoulder surfers. In addition, physical credentials, such as written down credentials (e.g. passwords) and dedicated devices that store or generate credentials (e.g. security keys, smart cards and one-time password tokens), when kept together with systems they are used to authenticate to, can increase the likelihood of malicious actors gaining unauthorised access to systems. For example, when smart cards are left on card readers, one-time password tokens are left in laptop computer bags, security keys are left connected to computers or passwords are written down and stuck to computer monitors. To reduce this security risk, physical credentials should be kept separate from systems they are used to authenticate to, except for when performing authentication activities. If storing credentials on systems, sufficient protection should be implemented to prevent them from being compromised. For example, credentials can be stored in a password manager or hardware security module, while credentials stored in a database should be hashed, salted and stretched. When using Microsoft Windows systems, Local Security Authority protection, Credential Guard and Remote Credential Guard functionality, all preferably with a Unified Extensible Firmware Interface lock, can be enabled to provide additional protection for credentials. In addition, malicious actors that have access to systems may attempt to steal cached credentials. To reduce this security risk, cached credentials should be limited to only one previous logon. Finally, an organisation should regularly scan their systems to detect and remediate any credentials that are being stored in an unprotected manner, such as in the clear in documents, configuration files, network file shares, software repositories, cloud storage or other data repositories. controls: - id: ism-1597 class: ISM-control title: "Control: ism-1597" props: - name: sort-id value: "catalog[1].group[16].group[2].group[7].control[01]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Aug-20 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1597_smt name: statement prose: Credentials are obscured as they are entered into systems. - id: ism-1980 class: ISM-control title: "Control: ism-1980" props: - name: sort-id value: "catalog[1].group[16].group[2].group[7].control[02]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1980_smt name: statement prose: Credential hint functionality is not used for systems. - id: ism-0418 class: ISM-control title: "Control: ism-0418" props: - name: sort-id value: "catalog[1].group[16].group[2].group[7].control[03]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0418_smt name: statement prose: "Physical credentials are kept separate from systems they are used to authenticate to, except for when performing authentication activities." - id: ism-1402 class: ISM-control title: "Control: ism-1402" props: - name: sort-id value: "catalog[1].group[16].group[2].group[7].control[04]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1402_smt name: statement prose: "Credentials stored on systems are protected by a password manager; a hardware security module; or by salting, hashing and stretching them before storage within a database." - id: ism-1957 class: ISM-control title: "Control: ism-1957" props: - name: sort-id value: "catalog[1].group[16].group[2].group[7].control[05]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1957_smt name: statement prose: Private keys for Microsoft AD CS certification authority servers are protected by a hardware security module. - id: ism-1861 class: ISM-control title: "Control: ism-1861" props: - name: sort-id value: "catalog[1].group[16].group[2].group[7].control[06]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1861_smt name: statement prose: Local Security Authority protection functionality is enabled. - id: ism-1686 class: ISM-control title: "Control: ism-1686" props: - name: sort-id value: "catalog[1].group[16].group[2].group[7].control[07]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1686_smt name: statement prose: Credential Guard functionality is enabled. - id: ism-1897 class: ISM-control title: "Control: ism-1897" props: - name: sort-id value: "catalog[1].group[16].group[2].group[7].control[08]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1897_smt name: statement prose: Remote Credential Guard functionality is enabled. - id: ism-1749 class: ISM-control title: "Control: ism-1749" props: - name: sort-id value: "catalog[1].group[16].group[2].group[7].control[09]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1749_smt name: statement prose: Cached credentials are limited to one previous logon. - id: ism-1875 class: ISM-control title: "Control: ism-1875" props: - name: sort-id value: "catalog[1].group[16].group[2].group[7].control[10]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1875_smt name: statement prose: Systems are scanned at least monthly to identify any credentials that are being stored in the clear. - title: Protecting authentication artefacts props: - name: sort-id value: "catalog[1].group[16].group[2].group[8]" parts: - name: overview prose: |- Once a user has authenticated, malicious actors may target the resulting authentication artefacts rather than the user’s credentials. Adversary-in-the-middle phishing and information-stealing malware can capture these authentication artefacts and replay them to bypass authentication measures, including multi-factor authentication. As such, it is important that authentication artefacts are protected to limit their usefulness to malicious actors if stolen. This includes cryptographically binding authentication artefacts to the devices on which they were issued to help prevent successful replay from other devices. In addition, revoking active sessions and refresh tokens when trust in a user account or device changes reduces the window in which stolen authentication artefacts remain useful to malicious actors. This includes when credentials are reset or re-enrolled, when credentials are compromised or suspected of being compromised, when a device no longer meets compliance requirements, or when high-risk sign-in activity is detected. Notably, revoking active sessions and refresh tokens following credential resets and re-enrolments is an important companion to verifying human user identities when such requests are made, as malicious actors that have socially engineered a credential reset may seek to establish durable access via stolen authentication artefacts before the activity is discovered. controls: - id: ism-2147 class: ISM-control title: "Control: ism-2147" props: - name: sort-id value: "catalog[1].group[16].group[2].group[8].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2147_smt name: statement prose: "Authentication tokens, session cookies and refresh tokens are cryptographically bound to the device on which they were issued." - id: ism-2148 class: ISM-control title: "Control: ism-2148" props: - name: sort-id value: "catalog[1].group[16].group[2].group[8].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2148_smt name: statement prose: "Active sessions, refresh tokens and other authentication artefacts are revoked when credentials are reset or re-enrolled, when credentials are compromised or suspected of being compromised, when a device no longer meets compliance requirements, or when high-risk sign-in activity is detected." - title: Guidelines for system management props: - name: sort-id value: "catalog[1].group[17]" groups: - title: System administration props: - name: sort-id value: "catalog[1].group[17].group[1]" parts: - name: overview prose: |- # Context System administration of cloud services brings unique challenges when compared to system administration of on-premises assets. Importantly, responsibility for system administration of cloud services is often shared between service providers and their customers. As the system administration processes and procedures implemented by service providers are often opaque to their customers, customers should consider a service provider’s control plane to operate within a different security domain. # Further information Further information on system administration can be found in the Australian Signals Directorate’s (ASD) [Secure administration](#131048c7-a2e7-4da3-9257-7a058b06c1f8) publication. Further information on change and configuration management plans can be found in the ‘System-specific cyber security documentation’ section of the [Guidelines for cyber security documentation](#578d0434-6b3f-46f3-aad8-c7ac75c2ebcc). Further information on the use of privileged user accounts for system administration activities can be found in the ‘Identity and access management’ section of the [Guidelines for system access](#76d68682-44dd-4e97-98c8-66db2cce1fda). Further information on network segmentation and segregation can be found in the ‘Network design and configuration’ section of the [Guidelines for networking](#f145ff5b-d396-4248-8f48-621349d6f0ed). groups: - title: System administration processes and procedures props: - name: sort-id value: "catalog[1].group[17].group[1].group[1]" parts: - name: overview prose: |- A key component of system administration is ensuring that administrative activities are undertaken in a repeatable and accountable manner using system administration processes and procedures. In doing so, requirements for administrative activities may cover: - configuring applications, operating systems, network devices or networked information technology (IT) equipment - applying patches, updates or vendor mitigations to applications, drivers, operating systems or firmware - installing or removing applications, operating systems, network devices or networked IT equipment - implementing system changes or enhancements - resolving problems identified by users. Furthermore, in support of change management processes and procedures, system administrators should document requirements for administrative activities, consider potential security impacts, obtain any necessary approvals, notify any affected parties of disruptions or outages, and maintain system and cyber security documentation. controls: - id: ism-0042 class: ISM-control title: "Control: ism-0042" props: - name: sort-id value: "catalog[1].group[17].group[1].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0042_smt name: statement prose: "System administration processes, and supporting system administration procedures, are developed, implemented and maintained." - id: ism-1211 class: ISM-control title: "Control: ism-1211" props: - name: sort-id value: "catalog[1].group[17].group[1].group[1].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1211_smt name: statement prose: System administration activities are performed in accordance with the system’s change and configuration management plan. - title: Separate privileged operating environments props: - name: sort-id value: "catalog[1].group[17].group[1].group[2]" parts: - name: overview prose: |- One of the greatest threats to the security of networks is the compromise of privileged user accounts. Providing a separate privileged operating environment for system administrators, in addition to their unprivileged operating environment, makes it much harder for administrative activities and privileged user accounts to be compromised by malicious actors. Using different physical workstations, with one being a dedicated Secure Admin Workstation, is the most secure approach to separating privileged and unprivileged operating environments for system administrators. However, a trusted and hardened virtualisation-based solution may be sufficient for separating privileged and unprivileged operating environments on the same Secure Admin Workstation. In such cases, privileged operating environments should not be virtualised within unprivileged operating environments. controls: - id: ism-1898 class: ISM-control title: "Control: ism-1898" props: - name: sort-id value: "catalog[1].group[17].group[1].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1898_smt name: statement prose: Secure Admin Workstations are used in the performance of administrative activities. - id: ism-1380 class: ISM-control title: "Control: ism-1380" props: - name: sort-id value: "catalog[1].group[17].group[1].group[2].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1380_smt name: statement prose: Privileged human users use separate privileged and unprivileged operating environments. - id: ism-1687 class: ISM-control title: "Control: ism-1687" props: - name: sort-id value: "catalog[1].group[17].group[1].group[2].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1687_smt name: statement prose: Privileged operating environments are not virtualised within unprivileged operating environments. - id: ism-1688 class: ISM-control title: "Control: ism-1688" props: - name: sort-id value: "catalog[1].group[17].group[1].group[2].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1688_smt name: statement prose: Unprivileged user accounts cannot be used to log on to privileged operating environments. - id: ism-1689 class: ISM-control title: "Control: ism-1689" props: - name: sort-id value: "catalog[1].group[17].group[1].group[2].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1689_smt name: statement prose: Privileged user accounts (excluding local administrator accounts) cannot be used to log on to unprivileged operating environments. - id: ism-1958 class: ISM-control title: "Control: ism-1958" props: - name: sort-id value: "catalog[1].group[17].group[1].group[2].control[6]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1958_smt name: statement prose: User accounts with DCSync permissions cannot be used to log on to unprivileged operating environments. - title: Administrative infrastructure props: - name: sort-id value: "catalog[1].group[17].group[1].group[3]" parts: - name: overview prose: "The security of administrative activities can be improved by segregating administrative infrastructure from the wider network and the internet. In doing so, the use of a jump server (also known as a jump host or jump box) that allows only necessary ports and services to be used can be an effective way of simplifying and securing administrative activities. Specifically, a jump server can provide filtering of network management traffic while also acting as a focal point to perform multi-factor authentication; store and manage administrative tools; and perform logging, monitoring and alerting activities. In addition, using separate jump servers for the administration of critical servers (such as Microsoft Active Directory Domain Services domain controllers, Microsoft Active Directory Certificate Services servers, Microsoft Active Directory Federation Services servers and Microsoft Entra Connect servers), high-value servers (such as Domain Name System servers, database servers, email servers, file servers and web servers) and regular servers can further assist in protecting these assets." controls: - id: ism-1385 class: ISM-control title: "Control: ism-1385" props: - name: sort-id value: "catalog[1].group[17].group[1].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1385_smt name: statement prose: Administrative infrastructure is segregated from the wider network and the internet. - id: ism-1750 class: ISM-control title: "Control: ism-1750" props: - name: sort-id value: "catalog[1].group[17].group[1].group[3].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1750_smt name: statement prose: "Administrative infrastructure for critical servers, high-value servers and regular servers is segregated from each other." - id: ism-1386 class: ISM-control title: "Control: ism-1386" props: - name: sort-id value: "catalog[1].group[17].group[1].group[3].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1386_smt name: statement prose: Network management traffic can only originate from administrative infrastructure. - id: ism-1387 class: ISM-control title: "Control: ism-1387" props: - name: sort-id value: "catalog[1].group[17].group[1].group[3].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1387_smt name: statement prose: Administrative activities are conducted through jump servers. - id: ism-1899 class: ISM-control title: "Control: ism-1899" props: - name: sort-id value: "catalog[1].group[17].group[1].group[3].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1899_smt name: statement prose: Network devices that do not belong to administrative infrastructure cannot initiate connections with administrative infrastructure. - title: Administrative tools props: - name: sort-id value: "catalog[1].group[17].group[1].group[4]" parts: - name: overview prose: "Legitimate remote monitoring and management (RMM) tools and remote access tools are frequently abused by malicious actors as they are digitally signed, often permitted by application control rulesets and provide interactive access that blends with normal system administration activities. As such, an organisation should develop, enforce and maintain a list of authorised RMM tools and remote access tools, to prevent the execution of those that are not authorised, to the extent possible, and monitor for any unusual or unexpected network activity associated with their use." controls: - id: ism-2149 class: ISM-control title: "Control: ism-2149" props: - name: sort-id value: "catalog[1].group[17].group[1].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2149_smt name: statement prose: "A list of authorised RMM tools and remote access tools is developed, enforced and maintained." - id: ism-2150 class: ISM-control title: "Control: ism-2150" props: - name: sort-id value: "catalog[1].group[17].group[1].group[4].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2150_smt name: statement prose: Network connections for unauthorised RMM tools and remote access tools are blocked at gateways. - title: Software registers props: - name: sort-id value: "catalog[1].group[17].group[1].group[5]" parts: - name: overview prose: "Maintaining accurate software registers assists an organisation in managing its systems and maintaining awareness of the software installed on them, including applications, drivers, firmware and operating systems. Software registers can support change and configuration management, vulnerability management, cyber security incident response and software lifecycle management. This includes monitoring trustworthy sources for information about relevant vulnerabilities, patches, updates and cessation of support." controls: - id: ism-1493 class: ISM-control title: "Control: ism-1493" props: - name: sort-id value: "catalog[1].group[17].group[1].group[5].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1493_smt name: statement prose: "Software registers for workstations, servers, network devices and networked IT equipment are developed, implemented, maintained and regularly verified." - id: ism-1643 class: ISM-control title: "Control: ism-1643" props: - name: sort-id value: "catalog[1].group[17].group[1].group[5].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1643_smt name: statement prose: "Software registers contain versions and patch histories of applications, drivers, operating systems and firmware." - title: System maintenance props: - name: sort-id value: "catalog[1].group[17].group[2]" parts: - name: overview prose: |- # Further information Further information on system patching can be found in ASD’s [Patching applications and operating systems](#02fb4cb5-e4c4-4097-97a2-f1b6aa04131a) publication. Further information on patching evaluated products can be found in the ‘Evaluated product usage’ section of the [Guidelines for evaluated products](#a699a3aa-828d-479b-b50b-98127bb19437). Further information on managing risks associated with legacy IT can be found in ASD’s [Managing the risks of legacy IT: Executive guidance](#065263a6-4634-4a52-bd3f-48b83bf437d8) and [Managing the risks of legacy IT: Practitioner guidance](#089badd3-ed47-4597-8b1f-bce3e42f4ac4) publications. Further information on cessation of support for Microsoft Windows operating systems, including potential compensating security controls for use beyond their cessation date for support, can be found in ASD’s [End of support for Microsoft Windows and Microsoft Windows Server](#d36ce452-ec21-4b05-89c1-f29a444a3dca) publication. Further information on hardening user applications can be found in the ‘User application hardening’ section of the [Guidelines for system hardening](#de7525f3-a466-40a5-abdd-3ae24a6d1b44). Further information on hardening server applications can be found in the ‘Server application hardening’ section of the [Guidelines for system hardening](#de7525f3-a466-40a5-abdd-3ae24a6d1b44). groups: - title: Patch management processes and procedures props: - name: sort-id value: "catalog[1].group[17].group[2].group[1]" parts: - name: overview prose: "Applying patches or updates is critical to ensuring the ongoing security of applications, drivers, operating systems and firmware. In doing so, it is important that patches or updates are applied consistently and in a secure manner. For example, by using a centralised and managed approach that maintains the integrity of patches or updates and confirms that they have been applied successfully." controls: - id: ism-1143 class: ISM-control title: "Control: ism-1143" props: - name: sort-id value: "catalog[1].group[17].group[2].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "9" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1143_smt name: statement prose: "Patch management processes, and supporting patch management procedures, are developed, implemented and maintained." - id: ism-0298 class: ISM-control title: "Control: ism-0298" props: - name: sort-id value: "catalog[1].group[17].group[2].group[1].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0298_smt name: statement prose: "A centralised and managed approach that maintains the integrity of patches or updates, and confirms that they have been applied successfully, is used to patch or update applications, operating systems, drivers and firmware." - title: Mitigating known vulnerabilities props: - name: sort-id value: "catalog[1].group[17].group[2].group[2]" parts: - name: overview prose: |- When patches or updates are released by vendors for vulnerabilities, an organisation should apply them in a timeframe commensurate with the likelihood of attempted exploitation by malicious actors. For example, by prioritising patches or updates for vulnerabilities in online services as well as operating systems of internet-facing servers and internet-facing network devices. This is especially important when vulnerabilities are assessed as critical by vendors or working exploits exist. If no patches or updates are available for vulnerabilities, mitigation advice from vendors, trustworthy authorities or security researchers may provide some protection until patches or updates are made available. Such mitigation advice may be published in conjunction with, or soon after, announcements made relating to vulnerabilities. Mitigation advice may cover how to disable or block access to vulnerable functionality, how to reconfigure vulnerable functionality, or how to detect attempted or successful exploitation of vulnerable functionality. If a patch or update is released for high assurance IT equipment, ASD will assess the patch or update. Subsequently, if the patch or update is approved for deployment, ASD will provide guidance on the methods and timeframes in which it is to be applied. controls: - id: ism-1876 class: ISM-control title: "Control: ism-1876" props: - name: sort-id value: "catalog[1].group[17].group[2].group[2].control[01]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1876_smt name: statement prose: "Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist." - id: ism-1690 class: ISM-control title: "Control: ism-1690" props: - name: sort-id value: "catalog[1].group[17].group[2].group[2].control[02]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1690_smt name: statement prose: "Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist." - id: ism-1691 class: ISM-control title: "Control: ism-1691" props: - name: sort-id value: "catalog[1].group[17].group[2].group[2].control[03]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 parts: - id: ism-1691_smt name: statement prose: "Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release." - id: ism-1692 class: ISM-control title: "Control: ism-1692" props: - name: sort-id value: "catalog[1].group[17].group[2].group[2].control[04]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1692_smt name: statement prose: "Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist." - id: ism-1901 class: ISM-control title: "Control: ism-1901" props: - name: sort-id value: "catalog[1].group[17].group[2].group[2].control[05]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1901_smt name: statement prose: "Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist." - id: ism-1693 class: ISM-control title: "Control: ism-1693" props: - name: sort-id value: "catalog[1].group[17].group[2].group[2].control[06]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1693_smt name: statement prose: "Patches, updates or other vendor mitigations for vulnerabilities in applications other than office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within one month of release." - id: ism-1877 class: ISM-control title: "Control: ism-1877" props: - name: sort-id value: "catalog[1].group[17].group[2].group[2].control[07]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1877_smt name: statement prose: "Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist." - id: ism-1694 class: ISM-control title: "Control: ism-1694" props: - name: sort-id value: "catalog[1].group[17].group[2].group[2].control[08]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1694_smt name: statement prose: "Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist." - id: ism-1695 class: ISM-control title: "Control: ism-1695" props: - name: sort-id value: "catalog[1].group[17].group[2].group[2].control[09]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 parts: - id: ism-1695_smt name: statement prose: "Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release." - id: ism-1696 class: ISM-control title: "Control: ism-1696" props: - name: sort-id value: "catalog[1].group[17].group[2].group[2].control[10]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1696_smt name: statement prose: "Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist." - id: ism-1902 class: ISM-control title: "Control: ism-1902" props: - name: sort-id value: "catalog[1].group[17].group[2].group[2].control[11]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1902_smt name: statement prose: "Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist." - id: ism-1878 class: ISM-control title: "Control: ism-1878" props: - name: sort-id value: "catalog[1].group[17].group[2].group[2].control[12]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1878_smt name: statement prose: "Patches, updates or other vendor mitigations for vulnerabilities in operating systems of IT equipment other than workstations, servers and network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist." - id: ism-1751 class: ISM-control title: "Control: ism-1751" props: - name: sort-id value: "catalog[1].group[17].group[2].group[2].control[13]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1751_smt name: statement prose: "Patches, updates or other vendor mitigations for vulnerabilities in operating systems of IT equipment other than workstations, servers and network devices are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist." - id: ism-1879 class: ISM-control title: "Control: ism-1879" props: - name: sort-id value: "catalog[1].group[17].group[2].group[2].control[14]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1879_smt name: statement prose: "Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist." - id: ism-1697 class: ISM-control title: "Control: ism-1697" props: - name: sort-id value: "catalog[1].group[17].group[2].group[2].control[15]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1697_smt name: statement prose: "Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist." - id: ism-1903 class: ISM-control title: "Control: ism-1903" props: - name: sort-id value: "catalog[1].group[17].group[2].group[2].control[16]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1903_smt name: statement prose: "Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist." - id: ism-1904 class: ISM-control title: "Control: ism-1904" props: - name: sort-id value: "catalog[1].group[17].group[2].group[2].control[17]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1904_smt name: statement prose: "Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist." - id: ism-0300 class: ISM-control title: "Control: ism-0300" props: - name: sort-id value: "catalog[1].group[17].group[2].group[2].control[18]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "10" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0300_smt name: statement prose: "Patches, updates or other vendor mitigations for vulnerabilities in high assurance IT equipment are applied only when approved by ASD, and in doing so, using methods and timeframes prescribed by ASD." - title: Cessation of support props: - name: sort-id value: "catalog[1].group[17].group[2].group[3]" parts: - name: overview prose: |- When applications, operating systems, network devices and networked IT equipment reach their cessation date for support, and become legacy IT, an organisation will find it increasingly difficult to protect them against vulnerabilities as patches, updates and other forms of support will no longer be made available by vendors. As such, unsupported applications, operating systems, network devices and networked IT equipment should be removed or replaced. In planning for cessation of support, it is important to note that while vendors generally advise the cessation date for support of operating systems well in advance, some applications, network devices and networked IT equipment may cease to receive support immediately after newer versions are released. Finally, when the immediate removal or replacement of unsupported applications, operating systems, network devices or networked IT equipment is not possible, compensating security controls should be implemented until such time that they can be removed or replaced. controls: - id: ism-1905 class: ISM-control title: "Control: ism-1905" props: - name: sort-id value: "catalog[1].group[17].group[2].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1905_smt name: statement prose: Online services that are no longer supported by vendors are removed. - id: ism-1704 class: ISM-control title: "Control: ism-1704" props: - name: sort-id value: "catalog[1].group[17].group[2].group[3].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1704_smt name: statement prose: "Office productivity suites, web browsers and their extensions, email clients, PDF applications, Adobe Flash Player, and security products that are no longer supported by vendors are removed." - id: ism-0304 class: ISM-control title: "Control: ism-0304" props: - name: sort-id value: "catalog[1].group[17].group[2].group[3].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-0304_smt name: statement prose: "Applications other than office productivity suites, web browsers and their extensions, email clients, PDF applications, Adobe Flash Player, and security products that are no longer supported by vendors are removed." - id: ism-1501 class: ISM-control title: "Control: ism-1501" props: - name: sort-id value: "catalog[1].group[17].group[2].group[3].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1501_smt name: statement prose: Operating systems that are no longer supported by vendors are replaced. - id: ism-1753 class: ISM-control title: "Control: ism-1753" props: - name: sort-id value: "catalog[1].group[17].group[2].group[3].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1753_smt name: statement prose: Internet-facing network devices that are no longer supported by vendors are replaced. - id: ism-1981 class: ISM-control title: "Control: ism-1981" props: - name: sort-id value: "catalog[1].group[17].group[2].group[3].control[6]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1981_smt name: statement prose: Non-internet-facing network devices that are no longer supported by vendors are replaced. - id: ism-1982 class: ISM-control title: "Control: ism-1982" props: - name: sort-id value: "catalog[1].group[17].group[2].group[3].control[7]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1982_smt name: statement prose: Networked IT equipment that is no longer supported by vendors is replaced. - id: ism-1809 class: ISM-control title: "Control: ism-1809" props: - name: sort-id value: "catalog[1].group[17].group[2].group[3].control[8]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1809_smt name: statement prose: "When applications, operating systems, network devices or networked IT equipment that are no longer supported by vendors cannot be immediately removed or replaced, compensating security controls are implemented until such time that they can be removed or replaced." - title: Data backup and restoration props: - name: sort-id value: "catalog[1].group[17].group[3]" parts: - name: overview prose: |- # Further information Further information on [digital preservation planning](#53da8dba-961e-4222-94e0-68cb9510384d) and [data retention](#348be728-4459-4447-990e-1dfb3049c71f) is available from the National Archives of Australia. Further information on the [retention of records created using artificial intelligence](#c4f9eb1b-753e-4d16-a05e-55e6dca1dd3f) is also available from the National Archives of Australia. Further information on the collection and retention of personal information can be found in the Office of the Australian Information Commissioner’s [Australian Privacy Principles](#bac2c6f2-9356-46d2-b7c4-9af7393008df) and the associated [Australian Privacy Principles guidelines](#1e4a57a2-2832-441d-8ea4-12a98d2be417). Further information on business continuity and disaster recovery planning can be found in the ‘Chief information security officer’ section of the [Guidelines for cyber security roles](#626dab35-81ab-45fe-8c12-0faff1c23c07). groups: - title: Digital preservation policy props: - name: sort-id value: "catalog[1].group[17].group[3].group[1]" parts: - name: overview prose: "Developing, implementing and maintaining a digital preservation policy, as part of digital continuity planning, can assist in ensuring the long-term integrity and availability of data is maintained, especially when taking into account the potential for data degradation and removable media, hardware and software obsolescence." controls: - id: ism-1510 class: ISM-control title: "Control: ism-1510" props: - name: sort-id value: "catalog[1].group[17].group[3].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1510_smt name: statement prose: "A digital preservation policy is developed, implemented and maintained." - title: Data backup and restoration processes and procedures props: - name: sort-id value: "catalog[1].group[17].group[3].group[2]" parts: - name: overview prose: Having data backup and restoration processes and procedures is an important part of business continuity and disaster recovery planning. Such activities will also form an integral part of an overarching digital preservation policy. controls: - id: ism-1547 class: ISM-control title: "Control: ism-1547" props: - name: sort-id value: "catalog[1].group[17].group[3].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1547_smt name: statement prose: "Data backup processes, and supporting data backup procedures, are developed, implemented and maintained." - id: ism-1548 class: ISM-control title: "Control: ism-1548" props: - name: sort-id value: "catalog[1].group[17].group[3].group[2].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1548_smt name: statement prose: "Data restoration processes, and supporting data restoration procedures, are developed, implemented and maintained." - title: Performing and retaining backups props: - name: sort-id value: "catalog[1].group[17].group[3].group[3]" parts: - name: overview prose: "To mitigate the security risk of losing system availability or data as part of a ransomware attack, or other form of destructive attack, backups of data, applications and settings should be performed and retained in accordance with an organisation’s business criticality and business continuity requirements. In doing so, backups of all data, applications and settings should be synchronised to enable restoration to a common point in time. Furthermore, it is essential that all backups are retained in a secure and resilient manner. This will ensure that should a system fall victim to a ransomware attack, or other form of destructive attack, data will not be lost and, if necessary, systems can be quickly restored." controls: - id: ism-1511 class: ISM-control title: "Control: ism-1511" props: - name: sort-id value: "catalog[1].group[17].group[3].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1511_smt name: statement prose: "Backups of data, applications and settings are performed and retained in accordance with business criticality and business continuity requirements." - id: ism-1810 class: ISM-control title: "Control: ism-1810" props: - name: sort-id value: "catalog[1].group[17].group[3].group[3].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1810_smt name: statement prose: "Backups of data, applications and settings are synchronised to enable restoration to a common point in time." - id: ism-1811 class: ISM-control title: "Control: ism-1811" props: - name: sort-id value: "catalog[1].group[17].group[3].group[3].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1811_smt name: statement prose: "Backups of data, applications and settings are retained in a secure and resilient manner." - title: Backup access props: - name: sort-id value: "catalog[1].group[17].group[3].group[4]" parts: - name: overview prose: "To mitigate the security risk of unauthorised access to backups, an organisation should ensure that access to backups is controlled by using appropriate access controls." controls: - id: ism-1812 class: ISM-control title: "Control: ism-1812" props: - name: sort-id value: "catalog[1].group[17].group[3].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1812_smt name: statement prose: Unprivileged user accounts cannot access backups belonging to other user accounts. - id: ism-1813 class: ISM-control title: "Control: ism-1813" props: - name: sort-id value: "catalog[1].group[17].group[3].group[4].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1813_smt name: statement prose: Unprivileged user accounts cannot access their own backups. - id: ism-1705 class: ISM-control title: "Control: ism-1705" props: - name: sort-id value: "catalog[1].group[17].group[3].group[4].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1705_smt name: statement prose: Privileged user accounts (excluding backup administrator accounts) cannot access backups belonging to other user accounts. - id: ism-1706 class: ISM-control title: "Control: ism-1706" props: - name: sort-id value: "catalog[1].group[17].group[3].group[4].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1706_smt name: statement prose: Privileged user accounts (excluding backup administrator accounts) cannot access their own backups. - title: Backup modification and deletion props: - name: sort-id value: "catalog[1].group[17].group[3].group[5]" parts: - name: overview prose: "To mitigate the security risk of backups being accidentally or maliciously modified or deleted, an organisation should ensure that backups are sufficiently protected from unauthorised modification and deletion by using appropriate access controls during their retention period. Furthermore, as malicious actors routinely seek to access backup infrastructure using credentials harvested from production environments, backup infrastructure should be segregated from such environments and use a separate authentication mechanism for administrative access." controls: - id: ism-1814 class: ISM-control title: "Control: ism-1814" props: - name: sort-id value: "catalog[1].group[17].group[3].group[5].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1814_smt name: statement prose: Unprivileged user accounts are prevented from modifying and deleting backups. - id: ism-1707 class: ISM-control title: "Control: ism-1707" props: - name: sort-id value: "catalog[1].group[17].group[3].group[5].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1707_smt name: statement prose: Privileged user accounts (excluding backup administrator accounts) are prevented from modifying and deleting backups. - id: ism-1708 class: ISM-control title: "Control: ism-1708" props: - name: sort-id value: "catalog[1].group[17].group[3].group[5].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1708_smt name: statement prose: Backup administrator accounts are prevented from modifying and deleting backups during their retention period. - id: ism-2151 class: ISM-control title: "Control: ism-2151" props: - name: sort-id value: "catalog[1].group[17].group[3].group[5].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2151_smt name: statement prose: Backups are stored using a technically enforced immutability mechanism that prevents their modification or deletion for the duration of their retention period. - id: ism-2152 class: ISM-control title: "Control: ism-2152" props: - name: sort-id value: "catalog[1].group[17].group[3].group[5].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2152_smt name: statement prose: "Backup infrastructure, including backup servers, repositories and management consoles, is segregated from production environments and uses a separate authentication mechanism for administrative access." - title: Testing restoration of backups props: - name: sort-id value: "catalog[1].group[17].group[3].group[6]" parts: - name: overview prose: "To ensure that backups can be restored when the need arises, and that any dependencies can be identified and managed beforehand, it is important that the restoration of data, applications and settings from backups to a common point in time is tested in a coordinated manner as part of disaster recovery exercises." controls: - id: ism-1515 class: ISM-control title: "Control: ism-1515" props: - name: sort-id value: "catalog[1].group[17].group[3].group[6].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1515_smt name: statement prose: "Restoration of data, applications and settings from backups to a common point in time is tested as part of disaster recovery exercises." - title: Guidelines for security assurance props: - name: sort-id value: "catalog[1].group[18]" groups: - title: Security monitoring props: - name: sort-id value: "catalog[1].group[18].group[1]" parts: - name: overview prose: |- # Context This section describes security controls applicable to security-relevant event logs. It is not intended for non-security-relevant event logs, such as operating system and application performance-related event logs. # Detecting cyber security events One of the core elements of detecting cyber security events is the availability of appropriate data sources, such as event logs. The following types of event logs can be used by an organisation to assist in detecting cyber security events: - **Artificial intelligence (AI) applications:** May assist in identifying anomalous or malicious code or user behaviour indicating an exploitation attempt or successful compromise. - **Cross domain solutions:** May assist in identifying anomalous or malicious network traffic indicating an exploitation attempt or successful compromise. - **Databases:** May assist in identifying anomalous or malicious code or user behaviour indicating an exploitation attempt or successful compromise. - **Domain Name System services:** May assist in identifying attempts to resolve malicious domain names or Internet Protocol addresses indicating an exploitation attempt or successful compromise. - **Email servers:** May assist in identifying human users targeted with phishing emails, helping to identify the initial vector of a compromise. - **Gateways:** May assist in identifying anomalous or malicious network traffic indicating an exploitation attempt or successful compromise. - **Identity providers:**May assist in identifying anomalous or malicious use of user accounts, credentials, authentication artefacts or consent grants indicating an exploitation attempt or successful compromise. - **Mobile applications:** May assist in identifying anomalous or malicious code or user behaviour indicating an exploitation attempt or successful compromise. - **Multifunction devices:** May assist in identifying anomalous or malicious user behaviour indicating a cyber security incident. - **Operating systems:** May assist in identifying anomalous or malicious activity indicating an exploitation attempt or successful compromise. - **Remote access services:** May assist in identifying unusual locations of access or times of access indicating an exploitation attempt or successful compromise. - **Security products:** May assist in identifying anomalous or malicious code or network traffic indicating an exploitation attempt or successful compromise. - **Server applications:** May assist in identifying anomalous or malicious code or user behaviour indicating an exploitation attempt or successful compromise. - **System access:** May assist in identifying anomalous or malicious user behaviour indicating an exploitation attempt or successful compromise. - **User applications:** May assist in identifying anomalous or malicious code or user behaviour indicating an exploitation attempt or successful compromise. - **Web applications:** May assist in identifying anomalous or malicious code or user behaviour indicating an exploitation attempt or successful compromise. - **Web proxies:** May assist in identifying anomalous or malicious network traffic indicating an exploitation attempt or successful compromise. # Further information Further information on logging intrusion activity can be found in the ‘Managing cyber security incidents’ section of the [Guidelines for cyber security incidents](#fe0138db-e83b-4a23-85d3-d84e1c22816f). Further information on event logging for application-based security products can be found in the ‘Operating system hardening’ section of the [Guidelines for system hardening](#de7525f3-a466-40a5-abdd-3ae24a6d1b44). Further information on event logging for AI applications can be found in the ‘Software development fundamentals’ section of the [Guidelines for software development](#506198a8-7ae8-4c95-8b7b-2a4833cfab4b). Further information on event logging for cross domain solutions can be found in the ‘Cross domain solutions’ section of the [Guidelines for gateways](#e8bde527-526c-4a6a-b66f-05228f09dd7b). Further information on event logging for databases can be found in the ‘Databases’ section of the [Guidelines for database systems](#3f349d16-11a1-459a-a299-c9446aea7597). Further information on event logging for gateways can be found in the ‘Gateways’ section of the [Guidelines for gateways](#e8bde527-526c-4a6a-b66f-05228f09dd7b). Further information on event logging for mobile applications can be found in the ‘Software development fundamentals’ section of the [Guidelines for software development](#506198a8-7ae8-4c95-8b7b-2a4833cfab4b). Further information on event logging for multifunction devices can be found in the ‘Multifunction devices’ section of the [Guidelines for communications systems](#3a7b903b-ed0d-450d-9123-60f6f8fd5dd2). Further information on event logging for network-based security products can be found in the ‘Network design and configuration’ section of the [Guidelines for networking](#f145ff5b-d396-4248-8f48-621349d6f0ed). Further information on event logging for operating systems can be found in the ‘Operating system hardening’ section of the [Guidelines for system hardening](#de7525f3-a466-40a5-abdd-3ae24a6d1b44). Further information on event logging for server applications can be found in the ‘Server application hardening’ section of the [Guidelines for system hardening](#de7525f3-a466-40a5-abdd-3ae24a6d1b44). Further information on event logging for system access can be found in the ‘Identity and access management’ section of the [Guidelines for system access](#76d68682-44dd-4e97-98c8-66db2cce1fda). Further information on event logging for user applications can be found in the ‘User application hardening’ section of the [Guidelines for system hardening](#de7525f3-a466-40a5-abdd-3ae24a6d1b44). Further information on event logging for web applications can be found in the ‘Software development’ section of the [Guidelines for software development](#506198a8-7ae8-4c95-8b7b-2a4833cfab4b). Further information on event logging for web proxies can be found in the ‘Web proxies’ section of the [Guidelines for gateways](#e8bde527-526c-4a6a-b66f-05228f09dd7b). Further information on event logging can be found in the following ASD publications: - [Best practices for event logging and threat detection](#b95c4745-572a-4121-b4e1-d0baa90a84fc) - [Detecting and mitigating Active Directory compromises](#331263bc-3314-496b-9d35-76788eb0f403) - [Hardening Microsoft Windows 10 workstations](#9209d9cd-86c1-486f-890e-1edfa4545093) - [Hardening Microsoft Windows 11 workstations](#43fbcaf9-03a3-493a-83be-9340a37778fa) - [Priority logs for SIEM ingestion: Practitioner guidance](#1dbda98a-4e8b-4a52-b4f7-9d1a895fd324) - [Windows event logging and forwarding](#de239dae-d1e8-4969-9680-ef3444d32a83). Further information on ASD’s cyber threat intelligence service, that is available to [ASD Cyber Security Network Partners](#585f4feb-d589-4a8e-868a-9ae60cf822ea), can be found on ASD’s [Cyber Threat Intelligence Sharing service](#b105f0d3-3354-498a-88fe-a05a7362b4b4) webpage. Further information on using AI models for security monitoring activities can be found in ASD’s [Opportunities for AI in cyber defence](#aff92212-4cd2-459a-9ba1-d4dd1815ebec) publication. Further information on SIEM and SOAR platforms can be found in ASD’s [Implementing SIEM and SOAR platforms: Executive guidance](#4bebe303-7a91-4ffa-90d8-8df9f80a6318) and [Implementing SIEM and SOAR platforms: Practitioner guidance](#4e01708d-9c2d-4a84-a08a-cb98077235a6) publications. Further information on current ASD alerts and advisories can be found on ASD’s [Alerts and advisories](#6cd11202-0ce1-455e-95e5-d0b40d78efe4) webpage. Further information on prioritising the collection and storage of event logs can be found in the United States’ Cybersecurity \& Infrastructure Security Agency’s [Guidance for Implementing M-21-31: Improving the Federal Government’s Investigative and Remediation Capabilities](#0acc5064-2b41-4479-b396-8ca6bcdc24b1) publication. Further information on the National Archives of Australia’s requirements for event log retention can be found in their [AFDA Express Version 2 – Technology \& Information Management](#cc1a55cb-34ab-4418-b660-53571b3af899) publication. groups: - title: Security monitoring policy props: - name: sort-id value: "catalog[1].group[18].group[1].group[1]" parts: - name: overview prose: "By developing a security monitoring policy, taking into consideration any shared responsibilities between service providers and their customers, an organisation can improve their ability to detect malicious behaviour on their systems. In doing so, the security monitoring policy should cover the types of events to be logged, the event logging facilities to be used, how event logs will be monitored and how long event logs will be retained." controls: - id: ism-0580 class: ISM-control title: "Control: ism-0580" props: - name: sort-id value: "catalog[1].group[18].group[1].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0580_smt name: statement prose: "A security monitoring policy is developed, implemented and maintained." - title: Centralised event logging facility props: - name: sort-id value: "catalog[1].group[18].group[1].group[2]" parts: - name: overview prose: "A centralised event logging facility can be used to capture, protect and manage event logs from multiple sources in a coordinated manner. This may be achieved by using a security information and event management (SIEM) platform, a security orchestration, automation and response (SOAR) platform, or both. Furthermore, in support of a centralised event logging facility, it is important that an accurate and consistent time source is used to assist with identifying connections between events." controls: - id: ism-1405 class: ISM-control title: "Control: ism-1405" props: - name: sort-id value: "catalog[1].group[18].group[1].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1405_smt name: statement prose: A centralised event logging facility is implemented. - id: ism-1983 class: ISM-control title: "Control: ism-1983" props: - name: sort-id value: "catalog[1].group[18].group[1].group[2].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1983_smt name: statement prose: Event logs sent to a centralised event logging facility are sent as soon as possible after they occur. - id: ism-1984 class: ISM-control title: "Control: ism-1984" props: - name: sort-id value: "catalog[1].group[18].group[1].group[2].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1984_smt name: statement prose: Event logs sent to a centralised event logging facility are encrypted in transit using Australian Signals Directorate (ASD)-approved cryptography. - id: ism-1985 class: ISM-control title: "Control: ism-1985" props: - name: sort-id value: "catalog[1].group[18].group[1].group[2].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1985_smt name: statement prose: Event logs are protected from unauthorised access. - id: ism-1815 class: ISM-control title: "Control: ism-1815" props: - name: sort-id value: "catalog[1].group[18].group[1].group[2].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1815_smt name: statement prose: Event logs are protected from unauthorised modification and deletion. - id: ism-0988 class: ISM-control title: "Control: ism-0988" props: - name: sort-id value: "catalog[1].group[18].group[1].group[2].control[6]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0988_smt name: statement prose: An accurate and consistent time source is used for event logging. - title: Event log details props: - name: sort-id value: "catalog[1].group[18].group[1].group[3]" parts: - name: overview prose: "For each event logged, sufficient detail needs to be captured for event logs to be useful. In doing so, event logs should be captured and stored in a consistent and structured format." controls: - id: ism-0585 class: ISM-control title: "Control: ism-0585" props: - name: sort-id value: "catalog[1].group[18].group[1].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0585_smt name: statement prose: "For each event logged, the date and time of the event, the relevant user or process, the relevant filename, the event description, and the information technology equipment involved are captured." - id: ism-1959 class: ISM-control title: "Control: ism-1959" props: - name: sort-id value: "catalog[1].group[18].group[1].group[3].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1959_smt name: statement prose: "To the extent possible, event logs are captured and stored in a consistent and structured format." - title: Event log monitoring props: - name: sort-id value: "catalog[1].group[18].group[1].group[4]" parts: - name: overview prose: "Event log monitoring is critical to maintaining the security posture of systems. It involves the timely analysis of event logs to detect cyber security events and identify potential cyber security incidents. In doing so, successful detection of cyber security events, and identification of cyber security incidents, requires trained cyber security personnel with access to sufficient tools that support manual and automated analysis of system behaviour." controls: - id: ism-0120 class: ISM-control title: "Control: ism-0120" props: - name: sort-id value: "catalog[1].group[18].group[1].group[4].control[01]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0120_smt name: statement prose: Cyber security personnel have access to sufficient tools to facilitate the detection of cyber security events and the identification of cyber security incidents. - id: ism-2116 class: ISM-control title: "Control: ism-2116" props: - name: sort-id value: "catalog[1].group[18].group[1].group[4].control[02]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2116_smt name: statement prose: Cyber threat intelligence services are used to support the detection of cyber security events and the identification of cyber security incidents. - id: ism-2117 class: ISM-control title: "Control: ism-2117" props: - name: sort-id value: "catalog[1].group[18].group[1].group[4].control[03]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2117_smt name: statement prose: Suitable AI models are used to augment the detection of cyber security events and the identification of cyber security incidents. - id: ism-1986 class: ISM-control title: "Control: ism-1986" props: - name: sort-id value: "catalog[1].group[18].group[1].group[4].control[04]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1986_smt name: statement prose: Event logs from critical servers are analysed in a timely manner to detect cyber security events. - id: ism-1906 class: ISM-control title: "Control: ism-1906" props: - name: sort-id value: "catalog[1].group[18].group[1].group[4].control[05]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1906_smt name: statement prose: Event logs from internet-facing servers are analysed in a timely manner to detect cyber security events. - id: ism-1907 class: ISM-control title: "Control: ism-1907" props: - name: sort-id value: "catalog[1].group[18].group[1].group[4].control[06]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1907_smt name: statement prose: Event logs from non-internet-facing servers are analysed in a timely manner to detect cyber security events. - id: ism-0109 class: ISM-control title: "Control: ism-0109" props: - name: sort-id value: "catalog[1].group[18].group[1].group[4].control[07]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "9" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-0109_smt name: statement prose: Event logs from workstations are analysed in a timely manner to detect cyber security events. - id: ism-1987 class: ISM-control title: "Control: ism-1987" props: - name: sort-id value: "catalog[1].group[18].group[1].group[4].control[08]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1987_smt name: statement prose: Event logs from security products are analysed in a timely manner to detect cyber security events. - id: ism-1960 class: ISM-control title: "Control: ism-1960" props: - name: sort-id value: "catalog[1].group[18].group[1].group[4].control[09]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1960_smt name: statement prose: Event logs from internet-facing network devices are analysed in a timely manner to detect cyber security events. - id: ism-1961 class: ISM-control title: "Control: ism-1961" props: - name: sort-id value: "catalog[1].group[18].group[1].group[4].control[10]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1961_smt name: statement prose: Event logs from non-internet-facing network devices are analysed in a timely manner to detect cyber security events. - id: ism-1228 class: ISM-control title: "Control: ism-1228" props: - name: sort-id value: "catalog[1].group[18].group[1].group[4].control[11]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1228_smt name: statement prose: Cyber security events are analysed in a timely manner to identify cyber security incidents. - title: Threat hunting props: - name: sort-id value: "catalog[1].group[18].group[1].group[5]" parts: - name: overview prose: "Threat hunting activities can assist in identifying malicious actors who have established persistent access to systems but have not triggered event log monitoring capabilities. Threat hunting complements event log monitoring activities by actively searching for indicators of compromise and adversary tradecraft using current strategic and sector-specific cyber threat intelligence. Threat hunting activities may be scoped to specific cyber threats, such as searching systems for indicators of compromise or adversary tradecraft identified in current ASD alerts and advisories. In doing so, threat hunting activities should be conducted by personnel with sufficient skills and tools, with any findings documented, actioned and used to improve automated event log monitoring capabilities." controls: - id: ism-2153 class: ISM-control title: "Control: ism-2153" props: - name: sort-id value: "catalog[1].group[18].group[1].group[5].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2153_smt name: statement prose: "Threat hunting activities, informed by current strategic and sector-specific cyber threat intelligence, are conducted at least every three months." - title: Event log retention props: - name: sort-id value: "catalog[1].group[18].group[1].group[6]" parts: - name: overview prose: "The retention of event logs is integral to event log monitoring, threat hunting and cyber security incident response activities. As such, event logs should be retained for a suitable period to facilitate these activities." controls: - id: ism-1988 class: ISM-control title: "Control: ism-1988" props: - name: sort-id value: "catalog[1].group[18].group[1].group[6].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1988_smt name: statement prose: Event logs are retained in a searchable manner for at least 12 months. - id: ism-1989 class: ISM-control title: "Control: ism-1989" props: - name: sort-id value: "catalog[1].group[18].group[1].group[6].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1989_smt name: statement prose: Event logs are retained as per minimum retention requirements for various classes of records as set out by the National Archives of Australia’s Administrative Functions Disposal Authority Express (AFDA Express) Version 2 publication. - title: Security assessments props: - name: sort-id value: "catalog[1].group[18].group[2]" parts: - name: overview prose: |- # Context Security assessments are activities designed to provide assurance in the security posture of systems and their operating environments. Security assessments can include security control assessments, vulnerability scanning, vulnerability assessments and penetration tests. Regardless of the security assessment activity performed, they should be conducted by suitably skilled personnel. In doing so, personnel can be internal to an organisation or from a third party, however, such personnel should be independent of the system being assessed. This ensures that there is no conflict of interest, perceived or otherwise, and that the activities are undertaken in an objective manner. # Further information Further information on responsibilities for ensuring systems undergo a security control assessment can be found in the ‘System owners’ section of the [Guidelines for cyber security roles](#626dab35-81ab-45fe-8c12-0faff1c23c07). Further information on conducting security control assessments for managed service providers and outsourced cloud service providers can be found in the ‘Managed services and cloud services’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on conducting security control assessments for gateways can be found in the ‘Gateways’ section of the [Guidelines for gateways](#e8bde527-526c-4a6a-b66f-05228f09dd7b). Further information on the cyber security documentation requirements for security control assessments can be found in the ‘System-specific cyber security documentation’ section of the [Guidelines for cyber security documentation](#578d0434-6b3f-46f3-aad8-c7ac75c2ebcc). Further information on using AI models for security assessment activities can be found in ASD’s [Opportunities for AI in cyber defence](#aff92212-4cd2-459a-9ba1-d4dd1815ebec) publication. groups: - title: Vulnerability scanning props: - name: sort-id value: "catalog[1].group[18].group[2].group[1]" parts: - name: overview prose: |- To ensure that patches or updates are being applied to applications, operating systems, drivers and firmware, it is essential that an organisation regularly identify all assets within their environment using an automated method of asset discovery, such as an asset discovery tool or a vulnerability scanner with equivalent functionality. To maximise the effectiveness of these activities, asset discovery and vulnerability scanning should be conducted from both internal and external perspectives, where applicable, to identify vulnerabilities based on how assets are exposed to malicious actors. Following asset discovery, identified assets can be scanned for missing patches or updates using a vulnerability scanner with an up-to-date vulnerability database. Ideally, vulnerability scanning should be conducted in an automated manner and take place at twice the frequency at which patches or updates need to be applied. For example, if patches or updates are to be applied within two weeks of release, then vulnerability scanning should be undertaken at least weekly. controls: - id: ism-1807 class: ISM-control title: "Control: ism-1807" props: - name: sort-id value: "catalog[1].group[18].group[2].group[1].control[01]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1807_smt name: statement prose: An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activities. - id: ism-1808 class: ISM-control title: "Control: ism-1808" props: - name: sort-id value: "catalog[1].group[18].group[2].group[1].control[02]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1808_smt name: statement prose: A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities. - id: ism-1698 class: ISM-control title: "Control: ism-1698" props: - name: sort-id value: "catalog[1].group[18].group[2].group[1].control[03]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1698_smt name: statement prose: A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online services. - id: ism-1699 class: ISM-control title: "Control: ism-1699" props: - name: sort-id value: "catalog[1].group[18].group[2].group[1].control[04]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1699_smt name: statement prose: "A vulnerability scanner is used at least weekly to identify missing patches or updates for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products." - id: ism-1700 class: ISM-control title: "Control: ism-1700" props: - name: sort-id value: "catalog[1].group[18].group[2].group[1].control[05]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1700_smt name: statement prose: "A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in applications other than office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products." - id: ism-1701 class: ISM-control title: "Control: ism-1701" props: - name: sort-id value: "catalog[1].group[18].group[2].group[1].control[06]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1701_smt name: statement prose: A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices. - id: ism-1702 class: ISM-control title: "Control: ism-1702" props: - name: sort-id value: "catalog[1].group[18].group[2].group[1].control[07]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML1 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML2 - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1702_smt name: statement prose: "A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices." - id: ism-1752 class: ISM-control title: "Control: ism-1752" props: - name: sort-id value: "catalog[1].group[18].group[2].group[1].control[08]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1752_smt name: statement prose: "A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of IT equipment other than workstations, servers and network devices." - id: ism-1703 class: ISM-control title: "Control: ism-1703" props: - name: sort-id value: "catalog[1].group[18].group[2].group[1].control[09]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1703_smt name: statement prose: A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in drivers. - id: ism-1900 class: ISM-control title: "Control: ism-1900" props: - name: sort-id value: "catalog[1].group[18].group[2].group[1].control[10]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS - name: essential-eight-applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: ML3 parts: - id: ism-1900_smt name: statement prose: A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in firmware. - id: ism-1921 class: ISM-control title: "Control: ism-1921" props: - name: sort-id value: "catalog[1].group[18].group[2].group[1].control[11]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1921_smt name: statement prose: The likelihood of system compromise is frequently assessed when working exploits exist for unmitigated vulnerabilities. - title: Vulnerability assessments and penetration tests props: - name: sort-id value: "catalog[1].group[18].group[2].group[2]" parts: - name: overview prose: "Security assessment activities designed to identify and triage vulnerabilities in systems can provide an organisation with a wealth of valuable information about their exposure to cyber threats, as well as assisting them to determine security risks associated with the operation of their systems. The use of suitable AI models to augment such activities is encouraged." controls: - id: ism-2118 class: ISM-control title: "Control: ism-2118" props: - name: sort-id value: "catalog[1].group[18].group[2].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2118_smt name: statement prose: "Vulnerability assessments and penetration tests are conducted for systems prior to their deployment, including prior to the deployment of significant changes, and at least every six months thereafter." - id: ism-2119 class: ISM-control title: "Control: ism-2119" props: - name: sort-id value: "catalog[1].group[18].group[2].group[2].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2119_smt name: statement prose: Suitable AI models are used to augment vulnerability assessments and penetration tests. - title: Guidelines for software development props: - name: sort-id value: "catalog[1].group[19]" groups: - title: Software development fundamentals props: - name: sort-id value: "catalog[1].group[19].group[1]" parts: - name: overview prose: |- # Context This section applies to human, artificial intelligence (AI)-assisted, AI-powered and AI-driven software development activities for traditional applications (including user applications and server applications), AI applications, mobile applications and web applications. Additional sections of these guidelines should also be consulted depending on the type of software development being undertaken. For example, the ‘Web application development’ section of these guidelines should be consulted for additional security controls applicable to web applications. Where references are made to software developers, they apply to humans and AI. # Further information Further information on a secure software development framework can be found in National Institute of Standards and Technology Special Publication 800-218, [Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities](#6f1f2f2b-abe6-46e4-9c9d-8339f1d9dab7). Further information on Secure by Design and Secure by Default principles and practices can be found in the following publications: - ASD’s [Secure by Design foundations](#6494bba4-bdb5-4b19-8f6c-8d5506a8bb09) - ASD’s [IoT Secure by Design guidance for manufacturers](#0d9d5f12-3519-4585-82d9-bc0f42abcd3c) - United Kingdom’s National Cyber Security Centre’s [Secure development and deployment guidance](#c74c6e7a-2209-4337-bb3a-715ce6e792a4) - United Kingdom’s Central Digital and Data Office’s [Secure by Design Principles](#89a4e4d7-0075-40f1-ae05-dff0a19183f9) and [Secure by Design Activities](#9898653e-fc87-4b42-a1fa-f7e323902841) - United States’ Cybersecurity \& Infrastructure Security Agency’s [Safe Software Deployment: How Software Manufacturers Can Ensure Reliability for Customers](#94d9fbcb-e8d1-4ef2-b543-5938f4387fee) - United States’ Cybersecurity \& Infrastructure Security Agency’s [Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software](#b794a062-2339-48ed-89ac-14aa4c3a61db). Further information on [secure programming practices](#672e85cc-2d40-46ba-9e94-c604b9731c75) is available from the Carnegie Mellon University’s Software Engineering Institute. Further information on the need for memory-safe programming languages can be found the following publications: - United States’ Cybersecurity \& Infrastructure Security Agency’s [The Case for Memory Safe Roadmaps: Why Both C-Suite Executives and Technical Experts Need to Take Memory Safe Coding Seriously](#bdb9d443-a877-4197-b9ad-ec5853f081c7) - United States’ Cybersecurity \& Infrastructure Security Agency’s [Exploring Memory Safety in Critical Open Source Projects](#a9307fb2-8003-4e6e-9d64-2c00ea8b0ec8) - United States’ National Security Agency’s [Software Memory Safety](#26137381-dc34-485c-8331-3bc9876ed48c) - United States’ National Security Agency and Cybersecurity \& Infrastructure Security Agency’s [Memory Safe Languages: Reducing Vulnerabilities in Modern Software Development](#afe3656f-2a78-488f-9eae-3cb9af69b018). Further information on the management of keys and secrets can be found in ASD’s [Managing cryptographic keys and secrets](#58589044-8b34-4d46-bf70-103ee8d10bc9) publication. Further information on [cyber supply chain transparency](#d0ace151-3c21-49af-bde7-eda58ab18a82), and recommended content for a software bill of materials, can be found in the United States’ National Telecommunications and Information Administration’s [2026 Minimum Elements for a Software Bill of Materials (SBOM)](#4da9c9bd-48a5-48dc-81e6-e005c037e998) publication. Further information on software bill of materials can also be found in the United States’ Cybersecurity \& Infrastructure Security Agency’s [A Shared Vision of Software Bill of Materials (SBOM) for Cybersecurity](#ea6f8148-55ea-4540-8b39-f35cc3411eb2) publication. Further information on strong authentication can be found in the ‘Identity and access management’ section of the [Guidelines for system access](#76d68682-44dd-4e97-98c8-66db2cce1fda). Further information on software security testing can be found on the Open Worldwide Application Security Project’s (OWASP) [DevSecOps Guidelines](#5516125f-d0eb-4196-8dc4-f8db55fca032) and [Source Code Analysis Tools](#cc618df8-757e-4d6c-9ad2-405554cb487d) websites. Further information on using AI models for software security testing activities can be found in ASD’s [Opportunities for AI in cyber defence](#aff92212-4cd2-459a-9ba1-d4dd1815ebec) publication. Further information on vulnerability identification success rates using frontier AI models is available from the [CyberGym](#c81898f4-ae8b-486f-b175-ae8e4dd5e60f) website. Further information on implementing a vulnerability disclosure program can be found in the following publications: - ASD’s [Vulnerability disclosure programs explained](#332a65d2-2836-47fa-85fd-1ec2f28edacc) - United States’ Cybersecurity \& Infrastructure Security Agency’s [Establishing a Coordinated Vulnerability Disclosure Program to Work With Security Researchers](#14ef2c5e-67a1-4fef-9264-e86e2a078ffa) - Google’s [Starting a Vulnerability Disclosure Program](#78a48231-9963-4f78-962a-861c96c58ead) - Carnegie Mellon University’s Software Engineering Institute’s [The CERT Guide to Coordinated Vulnerability Disclosure](#7ffd20ed-4f40-43be-a37b-97e7a1b31e2f) - International Organization for Standardization/International Electrotechnical Commission 29147:2018, [Information technology – Security techniques – Vulnerability disclosure](#8f1965a9-a6a1-4342-bfb8-797ea358db30) - International Organization for Standardization/International Electrotechnical Commission 30111:2019, [Information technology – Security techniques – Vulnerability handling processes](#99c117f0-78e0-4196-adc8-705405d996bc). Further information on [developing a vulnerability disclosure policy](#aab0523a-513e-48c9-978e-32d5b9adeea6) is available from the disclose.io project to assist an organisation with their implementation. Further information on [recommended contents for a ‘security.txt’ file](#24eb9af8-fb43-4772-a461-2c36dd0f6d7e) is available to assist an organisation with their implementation. Further information on [reporting vulnerabilities](#03f761fa-7014-459c-aa16-02c303d50abb) to ASD as an independent coordinator, including ASD’s [limited use obligation](#cae0ac6b-e69b-4359-bfd7-5ee5eff1049d), is available from ASD. Further information on event logging can be found in the ‘Security monitoring’ section of the [Guidelines for security assurance](#ef60c0e4-acfb-4a8b-b5ed-25675c6e117c). groups: - title: "Development, testing, staging and production environments" props: - name: sort-id value: "catalog[1].group[19].group[1].group[01]" parts: - name: overview prose: "Segregating development, testing, staging and production environments, and their associated data, can minimise the likelihood of faulty or malicious content being introduced into a production environment. Furthermore, protecting the authoritative source for software is critical to preventing malicious content being surreptitiously introduced into software." controls: - id: ism-0400 class: ISM-control title: "Control: ism-0400" props: - name: sort-id value: "catalog[1].group[19].group[1].group[01].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0400_smt name: statement prose: "Development, testing, staging and production environments are segregated." - id: ism-1419 class: ISM-control title: "Control: ism-1419" props: - name: sort-id value: "catalog[1].group[19].group[1].group[01].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1419_smt name: statement prose: Development and modification of software only take place in development environments. - id: ism-1420 class: ISM-control title: "Control: ism-1420" props: - name: sort-id value: "catalog[1].group[19].group[1].group[01].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1420_smt name: statement prose: Data from production environments is not used in non-production environments unless the non-production environment is secured to at least the same level as the production environment. - title: Authoritative source for software props: - name: sort-id value: "catalog[1].group[19].group[1].group[02]" parts: - name: overview prose: "Software developers need to ensure that they are using a secure authoritative source for software as part of their development environment, as doing so can reduce the security risks related to unauthorised access to software artefacts, tampering of software artefacts and other possible cyber supply chain attacks on software artefacts. In doing so, the authoritative source for software should be able to provide sufficient access control and event logging for access to, and modification of, any software artefacts." controls: - id: ism-2023 class: ISM-control title: "Control: ism-2023" props: - name: sort-id value: "catalog[1].group[19].group[1].group[02].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2023_smt name: statement prose: An authoritative source for software is established and maintained. - id: ism-2024 class: ISM-control title: "Control: ism-2024" props: - name: sort-id value: "catalog[1].group[19].group[1].group[02].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2024_smt name: statement prose: The authoritative source for software is used for all software development activities. - id: ism-1422 class: ISM-control title: "Control: ism-1422" props: - name: sort-id value: "catalog[1].group[19].group[1].group[02].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1422_smt name: statement prose: Unauthorised access to the authoritative source for software is prevented. - id: ism-1816 class: ISM-control title: "Control: ism-1816" props: - name: sort-id value: "catalog[1].group[19].group[1].group[02].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1816_smt name: statement prose: Unauthorised modification of the authoritative source for software is prevented. - title: Issue tracking props: - name: sort-id value: "catalog[1].group[19].group[1].group[03]" parts: - name: overview prose: "To provide visibility into code changes and support traceability, software developers should be able to link all changes, including security updates, change or feature updates, or bug fixes to a request or decision that is documented within an issue tracking solution." controls: - id: ism-2025 class: ISM-control title: "Control: ism-2025" props: - name: sort-id value: "catalog[1].group[19].group[1].group[03].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2025_smt name: statement prose: "An issue tracking solution is used to link software development tasks to security issues and decisions, change or feature requests, programming issues, or bug fixes." - title: Secure software development props: - name: sort-id value: "catalog[1].group[19].group[1].group[04]" parts: - name: overview prose: |- The use of Secure by Design principles and practices, including secure programming practices and either memory-safe programming languages (such as C#, Go, Java, Ruby, Rust and Swift) or less preferably memory-safe programming practices, along with threat modelling and mitigation of common security risks, is an important part of secure software development. In addition, providing mechanisms to assist in determining the authenticity and integrity of software, while configuring it in a secure manner, can assist with cyber supply chain security activities. As part of secure software development, software should be designed and built to be Secure by Default, that is, the software is secure ‘out of the box’ with little to no additional setup or configuration required to achieve an adequate level of security. Importantly, all built-in security measures, such as multi-factor authentication and event logging, are included in the base product at no extra cost to consumers. controls: - id: ism-2120 class: ISM-control title: "Control: ism-2120" props: - name: sort-id value: "catalog[1].group[19].group[1].group[04].control[01]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2120_smt name: statement prose: "A secure software development policy is developed, implemented and maintained." - id: ism-2033 class: ISM-control title: "Control: ism-2033" props: - name: sort-id value: "catalog[1].group[19].group[1].group[04].control[02]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2033_smt name: statement prose: "All software security requirements are documented, stored securely and maintained throughout the software development life cycle." - id: ism-2034 class: ISM-control title: "Control: ism-2034" props: - name: sort-id value: "catalog[1].group[19].group[1].group[04].control[03]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2034_smt name: statement prose: Security design decisions are documented and reviewed throughout the software development cycle. - id: ism-2035 class: ISM-control title: "Control: ism-2035" props: - name: sort-id value: "catalog[1].group[19].group[1].group[04].control[04]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2035_smt name: statement prose: "Security roles, responsibilities and knowledge required to support the software development life cycle are identified and documented." - id: ism-2036 class: ISM-control title: "Control: ism-2036" props: - name: sort-id value: "catalog[1].group[19].group[1].group[04].control[05]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2036_smt name: statement prose: Security responsibilities for software developers are identified and documented. - id: ism-2121 class: ISM-control title: "Control: ism-2121" props: - name: sort-id value: "catalog[1].group[19].group[1].group[04].control[06]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2121_smt name: statement prose: Software developers that lack sufficient cyber security knowledge and skills required for their projects or tasks are not used. - id: ism-2037 class: ISM-control title: "Control: ism-2037" props: - name: sort-id value: "catalog[1].group[19].group[1].group[04].control[07]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2037_smt name: statement prose: Software developers that lack sufficient cyber security knowledge and skills required for their projects or tasks undertake suitable training or upskilling on secure software development and programming practices. - id: ism-2038 class: ISM-control title: "Control: ism-2038" props: - name: sort-id value: "catalog[1].group[19].group[1].group[04].control[08]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2038_smt name: statement prose: "A software developer cyber security knowledge and skills register is developed, implemented and maintained." - id: ism-0401 class: ISM-control title: "Control: ism-0401" props: - name: sort-id value: "catalog[1].group[19].group[1].group[04].control[09]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0401_smt name: statement prose: Secure by Design principles and practices are followed throughout the software development life cycle. - id: ism-1238 class: ISM-control title: "Control: ism-1238" props: - name: sort-id value: "catalog[1].group[19].group[1].group[04].control[10]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1238_smt name: statement prose: Threat modelling is used in support of the software development life cycle. - id: ism-2039 class: ISM-control title: "Control: ism-2039" props: - name: sort-id value: "catalog[1].group[19].group[1].group[04].control[11]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2039_smt name: statement prose: The software threat model is reviewed throughout the software development life cycle to ensure it reflects the as-built software and any changes to the threat environment. - id: ism-2040 class: ISM-control title: "Control: ism-2040" props: - name: sort-id value: "catalog[1].group[19].group[1].group[04].control[12]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2040_smt name: statement prose: Secure programming practices for the chosen programming language are used for software development. - id: ism-2041 class: ISM-control title: "Control: ism-2041" props: - name: sort-id value: "catalog[1].group[19].group[1].group[04].control[13]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2041_smt name: statement prose: "Memory-safe programming languages, or less preferably memory-safe programming practices, are used for software development." - id: ism-2042 class: ISM-control title: "Control: ism-2042" props: - name: sort-id value: "catalog[1].group[19].group[1].group[04].control[14]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2042_smt name: statement prose: "Secure by Default principles and practices are followed throughout the software development life cycle, including by ensuring that all built-in security measures are included and enabled in the base product at no extra cost to consumers." - id: ism-1780 class: ISM-control title: "Control: ism-1780" props: - name: sort-id value: "catalog[1].group[19].group[1].group[04].control[15]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1780_smt name: statement prose: SecDevOps practices are used for software development. - id: ism-2043 class: ISM-control title: "Control: ism-2043" props: - name: sort-id value: "catalog[1].group[19].group[1].group[04].control[16]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2043_smt name: statement prose: Software is architected and structured to support readability and maintainability. - id: ism-1796 class: ISM-control title: "Control: ism-1796" props: - name: sort-id value: "catalog[1].group[19].group[1].group[04].control[17]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1796_smt name: statement prose: Files containing executable content are digitally signed by a certificate with a verifiable chain of trust as part of software development. - id: ism-1797 class: ISM-control title: "Control: ism-1797" props: - name: sort-id value: "catalog[1].group[19].group[1].group[04].control[18]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1797_smt name: statement prose: "Installers, patches and updates are digitally signed or provided with cryptographic checksums as part of software development." - id: ism-2044 class: ISM-control title: "Control: ism-2044" props: - name: sort-id value: "catalog[1].group[19].group[1].group[04].control[19]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2044_smt name: statement prose: "Software has no default credentials; however, if credentials are required, they are created on first install by the installing organisation." - id: ism-2045 class: ISM-control title: "Control: ism-2045" props: - name: sort-id value: "catalog[1].group[19].group[1].group[04].control[20]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2045_smt name: statement prose: Application backwards compatibility does not compromise any security measures or features. - id: ism-2046 class: ISM-control title: "Control: ism-2046" props: - name: sort-id value: "catalog[1].group[19].group[1].group[04].control[21]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2046_smt name: statement prose: "Where software allows user impersonation, sensitive data is not logged and appropriate permissions are set." - id: ism-2047 class: ISM-control title: "Control: ism-2047" props: - name: sort-id value: "catalog[1].group[19].group[1].group[04].control[22]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2047_smt name: statement prose: "Where software allows an authentication factor to be reset for a human user, the human user is notified of the reset through a secondary channel." - id: ism-2048 class: ISM-control title: "Control: ism-2048" props: - name: sort-id value: "catalog[1].group[19].group[1].group[04].control[23]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2048_smt name: statement prose: "Where software supports multiple user roles, non-administrative users are prevented from altering their profile permissions or privileges." - id: ism-2049 class: ISM-control title: "Control: ism-2049" props: - name: sort-id value: "catalog[1].group[19].group[1].group[04].control[24]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2049_smt name: statement prose: "When user permissions or credentials are changed, software forces all impacted users to re-authenticate." - id: ism-2050 class: ISM-control title: "Control: ism-2050" props: - name: sort-id value: "catalog[1].group[19].group[1].group[04].control[25]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2050_smt name: statement prose: "When digital signatures are processed by software, they are validated against a certificate trust chain and checked for revocation using a Certificate Revocation List or with the Online Certificate Status Protocol." - id: ism-2051 class: ISM-control title: "Control: ism-2051" props: - name: sort-id value: "catalog[1].group[19].group[1].group[04].control[26]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2051_smt name: statement prose: Software generates sufficient event logs to support the detection of cyber security events. - id: ism-2052 class: ISM-control title: "Control: ism-2052" props: - name: sort-id value: "catalog[1].group[19].group[1].group[04].control[27]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2052_smt name: statement prose: Event logs produced by software ensure that any sensitive data is protected. - id: ism-1798 class: ISM-control title: "Control: ism-1798" props: - name: sort-id value: "catalog[1].group[19].group[1].group[04].control[28]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1798_smt name: statement prose: "Secure configuration guidance, in the form of a hardening guide or loosening guide, is produced and made available to consumers as part of software development." - id: ism-2053 class: ISM-control title: "Control: ism-2053" props: - name: sort-id value: "catalog[1].group[19].group[1].group[04].control[29]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2053_smt name: statement prose: "End of life procedures for software, including procedures for software removal and the archival or destruction of user accounts and data, are produced and made available to consumers." - title: Software artefacts props: - name: sort-id value: "catalog[1].group[19].group[1].group[05]" parts: - name: overview prose: "Software artefacts can include compiled code, third-party libraries, configuration files and any other files consumed by the software development process. Software artefacts, whether developed internally or externally, may include malicious content or weaknesses designed for exploitation at a later stage. To assist in preventing the introduction of malicious content or weak software artefacts into an authoritative source for software, all software artefacts should be scanned for malicious content and undergo security testing (where appropriate) before being stored in the authoritative source for software. Software artefact dependencies should also be pinned to approved versions to prevent unexpected changes, while being periodically tested for known weaknesses and updated where necessary to address identified vulnerabilities." controls: - id: ism-2026 class: ISM-control title: "Control: ism-2026" props: - name: sort-id value: "catalog[1].group[19].group[1].group[05].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2026_smt name: statement prose: All software artefacts are scanned for malicious content before being imported into the authoritative source for software. - id: ism-2027 class: ISM-control title: "Control: ism-2027" props: - name: sort-id value: "catalog[1].group[19].group[1].group[05].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2027_smt name: statement prose: "All software artefacts are verified by a digital signature, or a secure hash provided over a secure channel, before being imported into the authoritative source for software." - id: ism-2028 class: ISM-control title: "Control: ism-2028" props: - name: sort-id value: "catalog[1].group[19].group[1].group[05].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2028_smt name: statement prose: "All software artefacts are tested to detect known weaknesses using static application security testing (SAST), dynamic application security testing (DAST) or software composition analysis (SCA), depending on the software artefact type, before being imported into the authoritative source for software." - id: ism-2102 class: ISM-control title: "Control: ism-2102" props: - name: sort-id value: "catalog[1].group[19].group[1].group[05].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2102_smt name: statement prose: "Existing software artefacts in the authoritative source for software are periodically tested to detect known weaknesses using SAST, DAST or SCA, depending on the software artefact type, throughout the software development life cycle." - id: ism-2029 class: ISM-control title: "Control: ism-2029" props: - name: sort-id value: "catalog[1].group[19].group[1].group[05].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2029_smt name: statement prose: The authoritative source for software restricts the use and import of third-party libraries and software components to trustworthy sources. - id: ism-2154 class: ISM-control title: "Control: ism-2154" props: - name: sort-id value: "catalog[1].group[19].group[1].group[05].control[6]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2154_smt name: statement prose: Software artefact dependencies are pinned to approved versions in source code. - id: ism-2030 class: ISM-control title: "Control: ism-2030" props: - name: sort-id value: "catalog[1].group[19].group[1].group[05].control[7]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2030_smt name: statement prose: "Scanning is used during commits to identify plain text or encoded credentials, keys and secrets, which are then blocked from being stored in the authoritative source for software." - title: Build solution props: - name: sort-id value: "catalog[1].group[19].group[1].group[06]" parts: - name: overview prose: "The build process for software can unintentionally allow vulnerabilities in software to make it into production environments. This security risk can be reduced by ensuring the build solution uses all available security features and that all automated testing is completed as part of the build process. Furthermore, software should be built in a manner that allows independent verification that release artefacts correspond to their source code." controls: - id: ism-2031 class: ISM-control title: "Control: ism-2031" props: - name: sort-id value: "catalog[1].group[19].group[1].group[06].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2031_smt name: statement prose: "Compilers, interpreters and build tools (including pipelines) that provide security features to improve executable file security are implemented and such security features are used." - id: ism-2155 class: ISM-control title: "Control: ism-2155" props: - name: sort-id value: "catalog[1].group[19].group[1].group[06].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2155_smt name: statement prose: Software is built using reproducible build practices that enable independent verification that release artefacts were produced from the stated source code. - id: ism-2032 class: ISM-control title: "Control: ism-2032" props: - name: sort-id value: "catalog[1].group[19].group[1].group[06].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2032_smt name: statement prose: "The build solution ensures that all automated testing is completed without warnings, alerts or errors before building software artefacts." - title: Software bill of materials props: - name: sort-id value: "catalog[1].group[19].group[1].group[07]" parts: - name: overview prose: A software bill of materials is a list of open source and commercial software components used in software development. This can assist software developers in ensuring they are not using software components with known vulnerabilities. It can also assist in providing greater cyber supply chain transparency for consumers of software by enabling easier identification and management of security risks associated with individual software components used by software. controls: - id: ism-2054 class: ISM-control title: "Control: ism-2054" props: - name: sort-id value: "catalog[1].group[19].group[1].group[07].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2054_smt name: statement prose: "If a software bill of materials is available for imported third-party software components, it is used during software development to ensure such software components have no known vulnerabilities." - id: ism-1730 class: ISM-control title: "Control: ism-1730" props: - name: sort-id value: "catalog[1].group[19].group[1].group[07].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1730_smt name: statement prose: A software bill of materials is produced and made available to consumers of software. - title: Cryptographic bill of materials props: - name: sort-id value: "catalog[1].group[19].group[1].group[08]" parts: - name: overview prose: |- A cryptographic bill of materials acts as an extension of a software bill of materials by communicating information about relevant cryptographic dependencies and implementations that are relied upon by software. At a high level, a cryptographic bill of materials will map the use of cryptography to the security function it performs and where it performs it. In practice, a cryptographic bill of materials will capture details on cryptographic libraries, algorithms, protocols, parameters and configurations. This can be used to ensure software components are providing support for standardised implementations of cryptographic algorithms that are approved by the Australian Signals Directorate (ASD). While the format for a cryptographic bill of materials is not yet subject to formal standardisation, there are emerging tools to assist with their generation and management. This is particularly important for software developers in managing their migration to post-quantum cryptographic standards as part of software development activities. controls: - id: ism-2082 class: ISM-control title: "Control: ism-2082" props: - name: sort-id value: "catalog[1].group[19].group[1].group[08].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2082_smt name: statement prose: "If a cryptographic bill of materials is available for imported third-party software components, it is used during software development to ensure such software components provide support for standardised implementations of ASD-Approved Cryptographic Algorithms." - id: ism-2083 class: ISM-control title: "Control: ism-2083" props: - name: sort-id value: "catalog[1].group[19].group[1].group[08].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2083_smt name: statement prose: A cryptographic bill of materials is produced and made available to consumers of software. - title: Software build provenance props: - name: sort-id value: "catalog[1].group[19].group[1].group[09]" parts: - name: overview prose: |- A software build provenance is a manifest that describes the software components used in the build process, the set of commands executed during the build process, any relevant environmental context for the build process and the materials that were generated by the build process. A software build provenance assists in providing greater cyber supply chain transparency for consumers by enabling the build process to be verified and, if needed, recreated. However, software build provenance does not, by itself, establish that the source code, build process or software artefacts are trustworthy and should be considered alongside other software supply chain security measures. controls: - id: ism-2055 class: ISM-control title: "Control: ism-2055" props: - name: sort-id value: "catalog[1].group[19].group[1].group[09].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2055_smt name: statement prose: "If a software build provenance is available for imported third-party software components, it is used during software development to ensure such software components are built to an appropriate standard." - id: ism-2056 class: ISM-control title: "Control: ism-2056" props: - name: sort-id value: "catalog[1].group[19].group[1].group[09].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2056_smt name: statement prose: A software build provenance is produced and made available to consumers of software. - title: Network application programming interfaces props: - name: sort-id value: "catalog[1].group[19].group[1].group[10]" parts: - name: overview prose: "Network application programming interfaces (APIs) can facilitate the exchange of data between computing devices. As such, common security risks associated with their use should be mitigated during their development, especially for network APIs that are accessible over the internet. This includes mitigating poorly secured network APIs that facilitate unauthorised modification of data or access to data not authorised for release into the public domain. In such cases, ensuring authentication and authorisation of clients is performed when clients call network APIs can assist in mitigating unauthorised modification of, or access to, data. Finally, centrally logging and analysing network API use can assist in detecting malicious behaviour and contributing to investigations following cyber security incidents." controls: - id: ism-1818 class: ISM-control title: "Control: ism-1818" props: - name: sort-id value: "catalog[1].group[19].group[1].group[10].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1818_smt name: statement prose: Authentication and authorisation of clients is performed when clients call network APIs that facilitate modification of data and are accessible over the internet. - id: ism-2013 class: ISM-control title: "Control: ism-2013" props: - name: sort-id value: "catalog[1].group[19].group[1].group[10].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2013_smt name: statement prose: Authentication and authorisation of clients is performed when clients call network APIs that facilitate modification of data but are not accessible over the internet. - id: ism-1817 class: ISM-control title: "Control: ism-1817" props: - name: sort-id value: "catalog[1].group[19].group[1].group[10].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1817_smt name: statement prose: Authentication and authorisation of clients is performed when clients call network APIs that facilitate access to data not authorised for release into the public domain and are accessible over the internet. - id: ism-2014 class: ISM-control title: "Control: ism-2014" props: - name: sort-id value: "catalog[1].group[19].group[1].group[10].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2014_smt name: statement prose: Authentication and authorisation of clients is performed when clients call network APIs that facilitate access to data not authorised for release into the public domain but are not accessible over the internet. - id: ism-1910 class: ISM-control title: "Control: ism-1910" props: - name: sort-id value: "catalog[1].group[19].group[1].group[10].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1910_smt name: statement prose: "Network API calls that facilitate modification of data, or access to data not authorised for release into the public domain, and are accessible over the internet, are centrally logged." - id: ism-2015 class: ISM-control title: "Control: ism-2015" props: - name: sort-id value: "catalog[1].group[19].group[1].group[10].control[6]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2015_smt name: statement prose: "Network API calls that facilitate modification of data, or access to data not authorised for release into the public domain, but are not accessible over the internet, are centrally logged." - title: Software input handling props: - name: sort-id value: "catalog[1].group[19].group[1].group[11]" parts: - name: overview prose: "Many vulnerabilities in software are caused by a lack of secure input handling. As such, it is essential that software does not trust any input, such as website addresses and their parameters, Hypertext Markup Language (HTML) form data, cookie values, or request headers, without performing validation or sanitisation. Examples of validation and sanitisation include ensuring a telephone form field contains only numerals, ensuring data used in a Structured Query Language query is sanitised properly and ensuring Unicode input is handled appropriately." controls: - id: ism-1240 class: ISM-control title: "Control: ism-1240" props: - name: sort-id value: "catalog[1].group[19].group[1].group[11].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1240_smt name: statement prose: Validation and sanitisation are performed on all input received over the internet by software. - id: ism-2016 class: ISM-control title: "Control: ism-2016" props: - name: sort-id value: "catalog[1].group[19].group[1].group[11].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2016_smt name: statement prose: Validation and sanitisation are performed on all input received over a local network by software. - id: ism-2057 class: ISM-control title: "Control: ism-2057" props: - name: sort-id value: "catalog[1].group[19].group[1].group[11].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2057_smt name: statement prose: "All input validation rules are documented, implemented in code, and tested using both positive and negative unit tests and integration tests." - id: ism-2058 class: ISM-control title: "Control: ism-2058" props: - name: sort-id value: "catalog[1].group[19].group[1].group[11].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2058_smt name: statement prose: Data sources and serialised data inputs are validated before being deserialised. - id: ism-2059 class: ISM-control title: "Control: ism-2059" props: - name: sort-id value: "catalog[1].group[19].group[1].group[11].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2059_smt name: statement prose: "File uploads or input are restricted to specific file types, with malicious content scanning occurring prior to file access, file execution or file storage." - title: Software interaction with databases props: - name: sort-id value: "catalog[1].group[19].group[1].group[12]" parts: - name: overview prose: |- Structured Query Language (SQL) injection attacks, facilitated by dynamically generated queries, are a significant threat to the confidentiality, integrity and availability of database contents. Specifically, SQL injection attacks can allow malicious actors to steal database contents, modify database contents, delete an entire database or even in some circumstances gain control of the underlying database server. Furthermore, when database queries from software fail, they may display detailed error information about the structure of databases. This can be used by malicious actors to tailor their SQL injection attacks. Finally, centrally logging and analysing all queries to databases from software can assist in monitoring the security posture of databases, detecting malicious behaviour and contributing to investigations following cyber security incidents. controls: - id: ism-1275 class: ISM-control title: "Control: ism-1275" props: - name: sort-id value: "catalog[1].group[19].group[1].group[12].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1275_smt name: statement prose: All queries to databases from software are filtered for legitimate content and correct syntax. - id: ism-1276 class: ISM-control title: "Control: ism-1276" props: - name: sort-id value: "catalog[1].group[19].group[1].group[12].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1276_smt name: statement prose: "Parameterised queries or stored procedures, instead of dynamically generated queries, are used by software for database interactions." - id: ism-1278 class: ISM-control title: "Control: ism-1278" props: - name: sort-id value: "catalog[1].group[19].group[1].group[12].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1278_smt name: statement prose: Software is designed or configured to provide as little error information as possible about the structure of databases. - id: ism-1536 class: ISM-control title: "Control: ism-1536" props: - name: sort-id value: "catalog[1].group[19].group[1].group[12].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1536_smt name: statement prose: "All queries to databases from software, and any resulting crash or error messages, are centrally logged." - title: Software security testing props: - name: sort-id value: "catalog[1].group[19].group[1].group[13]" parts: - name: overview prose: |- Software security testing can assist software developers to identify vulnerabilities in their software. In doing so, software security testing should be designed to be repeatable and scalable while ensuring vulnerabilities in software are identified and remediated as early as possible. Such software security testing should include peer reviews, code reviews, unit testing, integration testing, SAST, DAST and SCA to achieve comprehensive test coverage. As part of software security testing, software developers may wish to replicate testing within typical consumer environments. Additionally, software developers may choose to use independent testing to assist with removing any potential for bias that might occur when they test their own software. Overall, software needs to be comprehensively tested for vulnerabilities during development, prior to all releases and periodically to help identify any previously unidentified vulnerabilities. Finally, AI models are becoming increasingly capable of supporting software security testing through the identification of potential vulnerabilities, known weaknesses and insecure coding practices. The use of such AI models can be highly beneficial for software security testing provided they supplement, and not replace, traditional software security testing practices and all of their findings are validated by appropriately skilled personnel. controls: - id: ism-2061 class: ISM-control title: "Control: ism-2061" props: - name: sort-id value: "catalog[1].group[19].group[1].group[13].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2061_smt name: statement prose: Peer reviews are conducted on all critical and security-related software components. - id: ism-2060 class: ISM-control title: "Control: ism-2060" props: - name: sort-id value: "catalog[1].group[19].group[1].group[13].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2060_smt name: statement prose: Code reviews are utilised to ensure software components meets Secure by Design principles and practices as well as secure programming practices. - id: ism-2062 class: ISM-control title: "Control: ism-2062" props: - name: sort-id value: "catalog[1].group[19].group[1].group[13].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2062_smt name: statement prose: "Unit testing and integration testing, covering both positive and negative use cases, are used for software components to ensure code quality and correctness." - id: ism-0402 class: ISM-control title: "Control: ism-0402" props: - name: sort-id value: "catalog[1].group[19].group[1].group[13].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "10" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0402_smt name: statement prose: "Software is comprehensively tested for vulnerabilities using SAST, DAST and SCA prior to its initial release, any subsequent release, and periodically to help identify any previously unidentified vulnerabilities." - id: ism-2122 class: ISM-control title: "Control: ism-2122" props: - name: sort-id value: "catalog[1].group[19].group[1].group[13].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2122_smt name: statement prose: Suitable AI models are used to augment software security testing. - title: Vulnerability disclosure program props: - name: sort-id value: "catalog[1].group[19].group[1].group[14]" parts: - name: overview prose: |- Implementing a vulnerability disclosure program, based on responsible disclosure, can assist an organisation to improve the security of their products and services as it provides a way for internal and external parties to responsibly notify the organisation of vulnerabilities in a coordinated manner. Furthermore, following the resolution of reported vulnerabilities, it can assist an organisation in notifying their consumers of vulnerabilities that have been discovered in their products and services, and any patches, updates or vendor mitigations that should be applied. A vulnerability disclosure program should include processes and procedures for receiving, identifying, documenting, validating and prioritising vulnerabilities disclosed by internal and external parties. In support of this, a vulnerability disclosure policy should be made publicly available that covers: - the purpose of the vulnerability disclosure program - types of security research that are and are not allowed - how to report any vulnerabilities and their severities - actions, and associated timeframes, upon notification of vulnerabilities - expectations regarding the public disclosure of vulnerabilities - any recognition or reward for finders of vulnerabilities. Finally, ASD encourages security researchers and other members of the public to report vulnerabilities directly to an organisation. However, ASD recognises that this is not always practical, initial attempts at communication may be unsuccessful or the person making the report may not wish to do so directly. In such cases, vulnerabilities can be reported to ASD as an independent coordinator. Under ASD’s limited use obligation, any information voluntarily provided to ASD about vulnerabilities cannot be used for regulatory purposes. controls: - id: ism-1616 class: ISM-control title: "Control: ism-1616" props: - name: sort-id value: "catalog[1].group[19].group[1].group[14].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Aug-20 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1616_smt name: statement prose: A vulnerability disclosure program is implemented to assist with the secure development and maintenance of products and services. - id: ism-1755 class: ISM-control title: "Control: ism-1755" props: - name: sort-id value: "catalog[1].group[19].group[1].group[14].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1755_smt name: statement prose: "A vulnerability disclosure policy is developed, implemented and maintained." - id: ism-1756 class: ISM-control title: "Control: ism-1756" props: - name: sort-id value: "catalog[1].group[19].group[1].group[14].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1756_smt name: statement prose: "Vulnerability disclosure processes, and supporting vulnerability disclosure procedures, are developed, implemented and maintained." - id: ism-1717 class: ISM-control title: "Control: ism-1717" props: - name: sort-id value: "catalog[1].group[19].group[1].group[14].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1717_smt name: statement prose: A ‘security.txt’ file is hosted for each of an organisation’s internet-facing website domains to assist in the responsible disclosure of vulnerabilities in the organisation’s products and services. - title: Reporting and resolving vulnerabilities props: - name: sort-id value: "catalog[1].group[19].group[1].group[15]" parts: - name: overview prose: |- Following the identification of vulnerabilities in software, via either internal software security testing or external security researchers, it is important that they are publicly disclosed in a responsible and timely manner. This allows organisations using impacted software to determine their risk exposure as part of their own cyber supply chain risk management activities. In doing so, such vulnerabilities should be resolved in a timely manner. In support of this, root cause analysis should be performed and, to the greatest extent possible, entire vulnerability classes should be remediated. If vulnerabilities cannot be resolved in a timely manner via patches or updates, advice should be provided on how, to the greatest extent possible, the likelihood of vulnerabilities being exploited can be reduced, the impact of vulnerabilities being exploited can be reduced or both. controls: - id: ism-1908 class: ISM-control title: "Control: ism-1908" props: - name: sort-id value: "catalog[1].group[19].group[1].group[15].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1908_smt name: statement prose: "Vulnerabilities identified in software are publicly disclosed in a responsible and timely manner, including with Common Weakness Enumeration and Common Platform Enumeration information." - id: ism-1754 class: ISM-control title: "Control: ism-1754" props: - name: sort-id value: "catalog[1].group[19].group[1].group[15].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1754_smt name: statement prose: Vulnerabilities identified in software are resolved in a timely manner. - id: ism-1909 class: ISM-control title: "Control: ism-1909" props: - name: sort-id value: "catalog[1].group[19].group[1].group[15].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1909_smt name: statement prose: "In resolving vulnerabilities, root cause analysis is performed and, to the greatest extent possible, entire vulnerability classes are remediated." - title: Software event logging props: - name: sort-id value: "catalog[1].group[19].group[1].group[16]" parts: - name: overview prose: "Centrally logging and analysing security-relevant usage, error messages and crashes for software can assist in monitoring the security posture of software, detecting malicious behaviour and contributing to investigations following cyber security incidents." controls: - id: ism-1911 class: ISM-control title: "Control: ism-1911" props: - name: sort-id value: "catalog[1].group[19].group[1].group[16].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1911_smt name: statement prose: "Security-relevant usage, error messages and crashes for software are centrally logged." - title: Artificial intelligence application development props: - name: sort-id value: "catalog[1].group[19].group[2]" parts: - name: overview prose: |- # Context This section describes security controls applicable to AI application and AI model development and extends the ‘Software development fundamentals’ section of these guidelines. # Further information Further information on conversational AI application security risks can be found in the [OWASP Top 10 for LLM Applications 2025](#890d202b-ec79-4ea7-b0df-0cf7d7b7ad29) publication. Further information on agentic AI application security risks can be found in the [OWASP Top 10 For Agentic Applications 2026](#9fdb8571-d69e-4fc8-8b6c-1825e48eb340) publication. Further information on AI security risks can be found in the following ASD publications: - [An introduction to artificial intelligence](#e513ac6b-09fa-4d53-951a-a5142208cf12) - [Artificial intelligence and machine learning: Supply chain risks and mitigations](#233c7982-dc01-496e-b761-b24ac06ded49) - [Engaging with artificial intelligence](#0248ace8-2e08-40f8-b19e-117c76909cf1). Further information on AI security risks can also be found in the following publications: - MITRE’s [Adversarial Threat Landscape for Artificial-Intelligence Systems](#1258a1ce-774a-4701-8d47-80940b988a2d) - National Institute of Standards and Technology AI 100-2 E2023, [Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations](#9af7c141-51de-43f0-97bc-547e24e96545) - United Kingdom’s National Cyber Security Centre and United States’ Cybersecurity \& Infrastructure Security Agency’s [Guidelines for secure AI system development](#353dcc1a-23e6-48d5-8047-950cc614bf0b) - United States’ National Security Agency’s [AI Data Security: Best Practices for Securing Data Used to Train \& Operate AI Systems](#6e17dd11-a1c5-4f2b-87df-c5edde5fc8bd) - United States’ National Security Agency’s [Deploying AI Systems Securely: Best Practices for Deploying Secure and Resilient AI Systems](#c5ca2027-161e-4322-9367-7ec736b4846f). groups: - title: Secure artificial intelligence application development props: - name: sort-id value: "catalog[1].group[19].group[2].group[1]" parts: - name: overview prose: "Secure coding resources for software developers should be followed when developing AI applications. In addition, AI applications should be designed to reduce their attack surface with AI models being stored in a non-executable file format that does not allow arbitrary code execution." controls: - id: ism-2084 class: ISM-control title: "Control: ism-2084" props: - name: sort-id value: "catalog[1].group[19].group[2].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2084_smt name: statement prose: "AI-specific documentation, including AI model cards and AI system cards (or equivalent artefacts), is used to document AI model characteristics, system architectures, use cases and security risks." - id: ism-2072 class: ISM-control title: "Control: ism-2072" props: - name: sort-id value: "catalog[1].group[19].group[2].group[1].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2072_smt name: statement prose: AI models are stored in a non-executable file format that does not allow arbitrary code execution. - id: ism-2085 class: ISM-control title: "Control: ism-2085" props: - name: sort-id value: "catalog[1].group[19].group[2].group[1].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2085_smt name: statement prose: The exposure of exact AI model confidence scores in API outputs or user interfaces is prevented. - title: "Data collection, retention and use" props: - name: sort-id value: "catalog[1].group[19].group[2].group[2]" parts: - name: overview prose: "To ensure organisational data is not used to train AI models without explicit data owner consent, organisational data generated, collected or processed by AI applications should not be used for training, fine-tuning or improving AI models unless informed and explicit consent has been obtained in advance. Furthermore, to prevent excessive retention of data, all prompts and outputs associated with chat sessions should be securely deleted when chat sessions are removed from AI applications." controls: - id: ism-2103 class: ISM-control title: "Control: ism-2103" props: - name: sort-id value: "catalog[1].group[19].group[2].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2103_smt name: statement prose: "Organisational data generated, collected or processed by AI applications is not used for training, fine-tuning or improving AI models unless informed and explicit consent has been obtained from data owners in advance." - id: ism-2123 class: ISM-control title: "Control: ism-2123" props: - name: sort-id value: "catalog[1].group[19].group[2].group[2].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2123_smt name: statement prose: All prompts and outputs associated with chat sessions are securely deleted when chat sessions are removed from AI applications. - title: Artificial intelligence model poisoning props: - name: sort-id value: "catalog[1].group[19].group[2].group[3]" parts: - name: overview prose: "AI models, especially when embedded in other applications, risk exposing sensitive data, proprietary algorithms or confidential details through their output. This can result in unauthorised data access, privacy violations and intellectual property breaches." controls: - id: ism-2086 class: ISM-control title: "Control: ism-2086" props: - name: sort-id value: "catalog[1].group[19].group[2].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2086_smt name: statement prose: "The source and integrity of AI models, structures and weights are verified." - id: ism-2087 class: ISM-control title: "Control: ism-2087" props: - name: sort-id value: "catalog[1].group[19].group[2].group[3].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2087_smt name: statement prose: The source and integrity of training data for AI models is verified. - id: ism-2088 class: ISM-control title: "Control: ism-2088" props: - name: sort-id value: "catalog[1].group[19].group[2].group[3].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2088_smt name: statement prose: Data validation and verification techniques are used to ensure the reliability and accuracy of training data used by AI models. - title: Unbounded consumption props: - name: sort-id value: "catalog[1].group[19].group[2].group[4]" parts: - name: overview prose: "Cyber attacks designed to disrupt services, deplete a target’s financial resources or steal intellectual property by cloning an AI model’s behaviour depend on unbounded consumption vulnerabilities to succeed." controls: - id: ism-2089 class: ISM-control title: "Control: ism-2089" props: - name: sort-id value: "catalog[1].group[19].group[2].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2089_smt name: statement prose: AI model performance metrics are monitored and anomalies are investigated. - id: ism-2090 class: ISM-control title: "Control: ism-2090" props: - name: sort-id value: "catalog[1].group[19].group[2].group[4].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2090_smt name: statement prose: Rate limiting is applied to inference queries for AI models. - id: ism-2091 class: ISM-control title: "Control: ism-2091" props: - name: sort-id value: "catalog[1].group[19].group[2].group[4].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2091_smt name: statement prose: Resource limits are enforced for AI models. - title: Excessive agency props: - name: sort-id value: "catalog[1].group[19].group[2].group[5]" parts: - name: overview prose: "Excessive agency vulnerabilities allow for damaging actions to be performed in response to unexpected, ambiguous or manipulated output from AI applications, regardless of the cause of the malfunction. Furthermore, agentic AI applications that can autonomously invoke tools, browse external content, execute code or call other systems introduce risks beyond those of conversational AI applications. In particular, untrusted content retrieved by an agentic AI application, whether via web browsing, email, document processing or retrieval-augmented generation, may contain instructions that the underlying AI model treats as legitimate, allowing malicious actors to indirectly control the agentic AI application’s actions. Validation, sanitisation and delimitation can reduce this security risk but cannot be relied upon to make retrieved content trustworthy or eliminate indirect prompt injection. As such, agentic AI applications should treat retrieved content as untrusted throughout processing and prevent it from modifying or overriding system instructions, security policies, access controls, tool permissions or human approval requirements." controls: - id: ism-2092 class: ISM-control title: "Control: ism-2092" props: - name: sort-id value: "catalog[1].group[19].group[2].group[5].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2092_smt name: statement prose: Access control policies are implemented to enforce fine-grained permissions for AI applications. - id: ism-2093 class: ISM-control title: "Control: ism-2093" props: - name: sort-id value: "catalog[1].group[19].group[2].group[5].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2093_smt name: statement prose: Role-based access controls are implemented for AI applications to restrict access to sensitive data. - id: ism-2156 class: ISM-control title: "Control: ism-2156" props: - name: sort-id value: "catalog[1].group[19].group[2].group[5].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2156_smt name: statement prose: "Agentic AI applications are restricted to the minimum set of tools, functions and permissions required for their intended purpose." - id: ism-2157 class: ISM-control title: "Control: ism-2157" props: - name: sort-id value: "catalog[1].group[19].group[2].group[5].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2157_smt name: statement prose: "Tools invoked by agentic AI applications are subject to both the access controls of the invoking user and agent-specific, task-scoped authorisation, with effective permissions limited to the minimum permitted by both." - id: ism-2158 class: ISM-control title: "Control: ism-2158" props: - name: sort-id value: "catalog[1].group[19].group[2].group[5].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2158_smt name: statement prose: "External content retrieved by agentic AI applications is treated as untrusted data throughout processing, is clearly delimited from system instructions, is subject to validation and sanitisation measures applied to other untrusted input, remains untrusted following such processing, and is prevented from modifying or overriding system instructions, security policies, access controls, tool permissions or human approval requirements." - id: ism-2159 class: ISM-control title: "Control: ism-2159" props: - name: sort-id value: "catalog[1].group[19].group[2].group[5].control[6]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2159_smt name: statement prose: "All tool invocations, external requests and outputs generated by agentic AI applications are centrally logged with sufficient detail to support cyber security incident investigations." - title: Prompt injection props: - name: sort-id value: "catalog[1].group[19].group[2].group[6]" parts: - name: overview prose: "Prompt injection vulnerabilities exist in how AI applications process user prompts, and how such input may force AI models to incorrectly pass prompt data to other parts of the model, potentially causing them to violate guidelines, generate harmful content, enable unauthorised access or influence critical decisions." controls: - id: ism-1924 class: ISM-control title: "Control: ism-1924" props: - name: sort-id value: "catalog[1].group[19].group[2].group[6].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1924_smt name: statement prose: Generative AI applications evaluate user prompts to detect and mitigate adversarial inputs or suffixes designed to elicit unintended behaviour or assist in the generation of sensitive or harmful content. - title: Sensitive data exposure and improper output props: - name: sort-id value: "catalog[1].group[19].group[2].group[7]" parts: - name: overview prose: "AI applications, especially when embedded in other applications, risk exposing sensitive data, proprietary algorithms or confidential details through their output. This can result in unauthorised data access, privacy violations and intellectual property breaches. In addition, improper output handling vulnerabilities can occur when output from AI applications is not sufficiently validated, sanitised or handled before being passed downstream to other applications." controls: - id: ism-2094 class: ISM-control title: "Control: ism-2094" props: - name: sort-id value: "catalog[1].group[19].group[2].group[7].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2094_smt name: statement prose: Content filtering is implemented by AI applications to detect and block sensitive data exposure and improper output. - title: Mobile application development props: - name: sort-id value: "catalog[1].group[19].group[3]" parts: - name: overview prose: |- # Context This section describes security controls applicable to mobile application development and extends the ‘Software development fundamentals’ section of these guidelines. # Further information Further information on mobile application security can be found in the [OWASP Mobile Application Security Verification Standard version 2.1.0](#5935bbd2-883f-45e1-861e-e33a1e279063) publication. groups: - title: Secure mobile application development props: - name: sort-id value: "catalog[1].group[19].group[3].group[1]" parts: - name: overview prose: OWASP provides comprehensive resources for software developers that should be followed when developing mobile applications. controls: - id: ism-1922 class: ISM-control title: "Control: ism-1922" props: - name: sort-id value: "catalog[1].group[19].group[3].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1922_smt name: statement prose: The OWASP Mobile Application Security Verification Standard is used in the development of mobile applications. - title: Web application development props: - name: sort-id value: "catalog[1].group[19].group[4]" parts: - name: overview prose: |- # Context This section describes security controls applicable to web application development and extends the ‘Software development fundamentals’ section of these guidelines. # Further information Further information on web application security can be found in the [OWASP Application Security Verification Standard 5.0.0](#d2f005c5-2ad3-4b5e-9eb1-d0642f3560f4) and [OWASP Top 10 Proactive Controls 2024](#18274424-7086-419e-9fae-a6ba64870459) publications. Further information on web application security risks can be found in the [OWASP Top 10:2025](#b5b7b7fc-d3c7-4861-a036-a037593c575b) publication. Further information on implementing HTTPS can be found in ASD’s [Implementing certificates, TLS, HTTPS and opportunistic TLS](#b8cdbf18-31cb-4e10-bb43-e8488ee8c2f6) publication. Further information on using TLS in HTTPS can be found in the ‘Transport Layer Security’ section of the [Guidelines for cryptography](#195abe87-bb1e-4006-8b42-eaecca4d51f1). Further information on web API security can be found in the [OWASP API Security Top 10 2023](#76087ab6-88d4-4610-9a98-6ddc5f7bd7e6) publication. groups: - title: Secure web application design and development props: - name: sort-id value: "catalog[1].group[19].group[4].group[1]" parts: - name: overview prose: "Web application frameworks can be leveraged by software developers to enhance the security of web applications while decreasing development time. These resources can assist in securely implementing complex software functions, such as session management, input handling and cryptographic operations. In addition, OWASP provides comprehensive resources for software developers that should be followed when developing web applications." controls: - id: ism-1239 class: ISM-control title: "Control: ism-1239" props: - name: sort-id value: "catalog[1].group[19].group[4].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1239_smt name: statement prose: Robust web application frameworks are used in the development of web applications. - id: ism-0971 class: ISM-control title: "Control: ism-0971" props: - name: sort-id value: "catalog[1].group[19].group[4].group[1].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0971_smt name: statement prose: The OWASP Application Security Verification Standard is used in the development of web applications. - id: ism-1849 class: ISM-control title: "Control: ism-1849" props: - name: sort-id value: "catalog[1].group[19].group[4].group[1].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1849_smt name: statement prose: The OWASP Top 10 Proactive Controls are used in the development of web applications. - id: ism-1850 class: ISM-control title: "Control: ism-1850" props: - name: sort-id value: "catalog[1].group[19].group[4].group[1].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1850_smt name: statement prose: The OWASP Top 10 are mitigated in the development of web applications. - id: ism-2063 class: ISM-control title: "Control: ism-2063" props: - name: sort-id value: "catalog[1].group[19].group[4].group[1].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2063_smt name: statement prose: "If supported, web application session cookies set the HttpOnly flag, Secure flag and the SameSite flag by default." - id: ism-2064 class: ISM-control title: "Control: ism-2064" props: - name: sort-id value: "catalog[1].group[19].group[4].group[1].control[6]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2064_smt name: statement prose: Web application session cookies contain only digitally signed opaque bearer tokens. - id: ism-2065 class: ISM-control title: "Control: ism-2065" props: - name: sort-id value: "catalog[1].group[19].group[4].group[1].control[7]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2065_smt name: statement prose: "Web application session cookies using opaque bearer tokens that are not digitally signed use non-sequential random identifiers with a minimum of 128 bits of entropy, preferably 256 bits of entropy." - id: ism-2066 class: ISM-control title: "Control: ism-2066" props: - name: sort-id value: "catalog[1].group[19].group[4].group[1].control[8]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2066_smt name: statement prose: Web application sessions are centrally managed server side. - id: ism-2067 class: ISM-control title: "Control: ism-2067" props: - name: sort-id value: "catalog[1].group[19].group[4].group[1].control[9]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2067_smt name: statement prose: Web applications that support Single Sign On equally support Single Logout. - title: Web security policy response headers props: - name: sort-id value: "catalog[1].group[19].group[4].group[2]" parts: - name: overview prose: "Web security policy response header measures, such as Content-Security-Policy, Hypertext Transfer Protocol Strict Transport Security and X-Frame-Options, can be applied by web browsers to help protect themselves. This is achieved by web server software specifying security policy in response headers that web browsers then apply." controls: - id: ism-1424 class: ISM-control title: "Control: ism-1424" props: - name: sort-id value: "catalog[1].group[19].group[4].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1424_smt name: statement prose: "Content-Security-Policy, Hypertext Transfer Protocol Strict Transport Security and X-Frame-Options are specified by web server software via security policy in response headers." - title: Web application interactions props: - name: sort-id value: "catalog[1].group[19].group[4].group[3]" parts: - name: overview prose: Hypertext Transfer Protocol Secure (HTTPS) is the Hypertext Transfer Protocol secured by Transport Layer Security (TLS) encryption. The use of HTTPS for web applications ensures that interactions with web applications are confidential and that the integrity of such interactions are maintained. controls: - id: ism-1552 class: ISM-control title: "Control: ism-1552" props: - name: sort-id value: "catalog[1].group[19].group[4].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Oct-19 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1552_smt name: statement prose: All web application content is offered exclusively using HTTPS. - title: Web application programming interfaces props: - name: sort-id value: "catalog[1].group[19].group[4].group[4]" parts: - name: overview prose: "Web APIs can facilitate the exchange of data between computing devices. As such, common security risks associated with their use should be mitigated during their development." controls: - id: ism-1851 class: ISM-control title: "Control: ism-1851" props: - name: sort-id value: "catalog[1].group[19].group[4].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1851_smt name: statement prose: The OWASP API Security Top 10 are mitigated in the development of web APIs. - title: Web application output encoding props: - name: sort-id value: "catalog[1].group[19].group[4].group[5]" parts: - name: overview prose: "The likelihood of cross-site scripting and other content injection attacks can be reduced by using output encoding. Output encoding is particularly useful when external data sources, which may not be subject to the same level of input filtering, are output to users. The most common example of output encoding is the conversion of potentially dangerous HTML characters into their encoded equivalents, such as ‘\\<’, ‘\\>’ and ‘\\&’ into ‘\\<’, ‘\\>’ and ‘\\&’." controls: - id: ism-1241 class: ISM-control title: "Control: ism-1241" props: - name: sort-id value: "catalog[1].group[19].group[4].group[5].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1241_smt name: statement prose: Output encoding is performed on all output produced by web applications. - title: Guidelines for database systems props: - name: sort-id value: "catalog[1].group[20]" groups: - title: Database servers props: - name: sort-id value: "catalog[1].group[20].group[1]" parts: - name: overview prose: |- # Further information Further information on the functional separation of operating environments can be found in the ‘Virtualisation hardening’ section of the [Guidelines for system hardening](#de7525f3-a466-40a5-abdd-3ae24a6d1b44). Further information on encrypting communications can be found in the ‘Cryptographic fundamentals’ section of the [Guidelines for cryptography](#195abe87-bb1e-4006-8b42-eaecca4d51f1). Further information on network segmentation and segregation can be found in the ‘Network design and configuration’ section of the [Guidelines for networking](#f145ff5b-d396-4248-8f48-621349d6f0ed). Further information on database management system applications can be found in the ‘Server application hardening’ section of the [Guidelines for system hardening](#de7525f3-a466-40a5-abdd-3ae24a6d1b44). groups: - title: Functional separation between database servers and web servers props: - name: sort-id value: "catalog[1].group[20].group[1].group[1]" parts: - name: overview prose: "Due to the higher threat environment that web servers are typically exposed to, hosting database servers and web servers within the same operating environment increases the likelihood of database servers being compromised by malicious actors. This security risk can be mitigated by ensuring that database servers are functionally separated from web servers." controls: - id: ism-1269 class: ISM-control title: "Control: ism-1269" props: - name: sort-id value: "catalog[1].group[20].group[1].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1269_smt name: statement prose: Database servers and web servers are functionally separated. - title: Communications between database servers and web servers props: - name: sort-id value: "catalog[1].group[20].group[1].group[2]" parts: - name: overview prose: "Data communicated between database servers and web servers, especially over the internet, is susceptible to capture by malicious actors. As such, it is important that all data communicated between database servers and web servers is suitably encrypted using Australian Signals Directorate-approved cryptography." controls: - id: ism-1277 class: ISM-control title: "Control: ism-1277" props: - name: sort-id value: "catalog[1].group[20].group[1].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1277_smt name: statement prose: Data communicated between database servers and web servers is encrypted using Australian Signals Directorate-approved cryptography. - title: Network environment props: - name: sort-id value: "catalog[1].group[20].group[1].group[3]" parts: - name: overview prose: "Placing database servers on the same network segment as workstations can increase the likelihood of database servers being compromised by malicious actors. Additionally, in cases where databases will only be accessed from their own database server, allowing remote access to the database server poses an unnecessary security risk." controls: - id: ism-1270 class: ISM-control title: "Control: ism-1270" props: - name: sort-id value: "catalog[1].group[20].group[1].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1270_smt name: statement prose: Database servers are placed on a different network segment to workstations. - id: ism-1271 class: ISM-control title: "Control: ism-1271" props: - name: sort-id value: "catalog[1].group[20].group[1].group[3].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1271_smt name: statement prose: Network access controls are implemented to restrict database server communications to strictly defined network resources that require access to the database server. - id: ism-1272 class: ISM-control title: "Control: ism-1272" props: - name: sort-id value: "catalog[1].group[20].group[1].group[3].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1272_smt name: statement prose: "If only local access to a database is required, networking functionality of database management system applications is disabled or directed to listen solely to the localhost interface." - title: "Segregation of development, testing, staging and production database servers" props: - name: sort-id value: "catalog[1].group[20].group[1].group[4]" parts: - name: overview prose: "Using database servers across different environments, such as development, testing, staging and production environments, could result in accidental damage to their integrity or exposure of their hosted database contents." controls: - id: ism-1273 class: ISM-control title: "Control: ism-1273" props: - name: sort-id value: "catalog[1].group[20].group[1].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1273_smt name: statement prose: "Database servers for development, testing, staging and production environments are segregated." - title: Databases props: - name: sort-id value: "catalog[1].group[20].group[2]" parts: - name: overview prose: |- # Further information Further information on event logging can be found in the ‘Security monitoring’ section of the [Guidelines for security assurance](#ef60c0e4-acfb-4a8b-b5ed-25675c6e117c). groups: - title: Database register props: - name: sort-id value: "catalog[1].group[20].group[2].group[1]" parts: - name: overview prose: "Without knowledge of all the databases in an organisation, and their contents, an organisation will be unable to protect all of their assets. As such, it is important that a database register is developed, implemented, maintained and regularly verified." controls: - id: ism-1243 class: ISM-control title: "Control: ism-1243" props: - name: sort-id value: "catalog[1].group[20].group[2].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1243_smt name: statement prose: "A database register is developed, implemented, maintained and regularly verified." - title: Protecting databases props: - name: sort-id value: "catalog[1].group[20].group[2].group[2]" parts: - name: overview prose: "Databases can be protected from unauthorised copying, and subsequent offline analysis, by applying file-based access controls to database files." controls: - id: ism-1256 class: ISM-control title: "Control: ism-1256" props: - name: sort-id value: "catalog[1].group[20].group[2].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1256_smt name: statement prose: File-based access controls are applied to database files. - title: Protecting database contents props: - name: sort-id value: "catalog[1].group[20].group[2].group[3]" parts: - name: overview prose: |- The sensitivity or classification associated with databases and their contents should be determined to ensure that they are appropriately protected when administered or accessed by database users. In cases where a database’s contents are all the same sensitivity or classification, an organisation should classify the entire database at this level and protect it as such. Alternatively, in cases where a database’s contents are of varying sensitivities or classifications, and database users have varying levels of access to the database’s contents, an organisation should protect the database’s contents at a more granular level. Restricting database users’ ability to access, insert, modify or remove database contents, based on their duties or functions, ensures that the likelihood of unauthorised access, modification or deletion of database contents is reduced. Furthermore, where concerns exist that the aggregation of separate pieces of content from within a database could lead to malicious actors determining more sensitive or classified content, the need-to-know principle can be enforced by using minimum privileges, database views and database roles. Alternatively, the content of concern could be separated by implementing multiple databases, each with restricted data sets. controls: - id: ism-0393 class: ISM-control title: "Control: ism-0393" props: - name: sort-id value: "catalog[1].group[20].group[2].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0393_smt name: statement prose: Databases and their contents are classified based on the sensitivity or classification of data that they contain. - id: ism-1255 class: ISM-control title: "Control: ism-1255" props: - name: sort-id value: "catalog[1].group[20].group[2].group[3].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1255_smt name: statement prose: "Database users’ ability to access, insert, modify and remove database contents is restricted based on their duties or functions." - id: ism-1268 class: ISM-control title: "Control: ism-1268" props: - name: sort-id value: "catalog[1].group[20].group[2].group[3].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1268_smt name: statement prose: "The need-to-know principle is enforced for database contents through the application of minimum privileges, database views, database roles and data tokenisation." - title: "Segregation of development, testing, staging and production databases" props: - name: sort-id value: "catalog[1].group[20].group[2].group[4]" parts: - name: overview prose: "Using database contents from production environments in non-production environments, such as development, testing or staging environments, could result in inadequate protection being applied to the database contents." controls: - id: ism-1274 class: ISM-control title: "Control: ism-1274" props: - name: sort-id value: "catalog[1].group[20].group[2].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1274_smt name: statement prose: Database contents from production environments are not used in non-production environments unless the non-production environment is secured to at least the same level as the production environment. - title: Database event logging props: - name: sort-id value: "catalog[1].group[20].group[2].group[5]" parts: - name: overview prose: "Centrally logging and analysing security-relevant events, including configuration changes, for databases can assist in monitoring the security posture of databases, detecting malicious behaviour and contributing to investigations following cyber security incidents." controls: - id: ism-1537 class: ISM-control title: "Control: ism-1537" props: - name: sort-id value: "catalog[1].group[20].group[2].group[5].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1537_smt name: statement prose: |- Security-relevant events for databases are centrally logged, including: - access or modification of particularly important content - addition of new users, especially privileged users - changes to user roles or privileges - attempts to elevate user privileges - queries containing comments - queries containing multiple embedded queries - database and query alerts or failures - database structure changes - database administrator actions - use of executable commands - database logons and logoffs. - title: Guidelines for email props: - name: sort-id value: "catalog[1].group[21]" groups: - title: Email usage props: - name: sort-id value: "catalog[1].group[21].group[1]" parts: - name: overview prose: |- # Further information Further information on protective markings for emails, where applicable, can be found in the Department of Home Affairs’ [Protective Security Policy Framework](#92679127-f61d-486a-a93e-df2a26dfb07a) and its associated [Australian Government Email Protective Marking Standard](#11372646-3106-42c6-b3e1-444b3f630462). groups: - title: Email usage policy props: - name: sort-id value: "catalog[1].group[21].group[1].group[1]" parts: - name: overview prose: "As there are many security risks associated with the use of email services, it is important that an organisation develops, implements and maintains an email usage policy governing its use." controls: - id: ism-0264 class: ISM-control title: "Control: ism-0264" props: - name: sort-id value: "catalog[1].group[21].group[1].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0264_smt name: statement prose: "An email usage policy is developed, implemented and maintained." - title: Webmail services props: - name: sort-id value: "catalog[1].group[21].group[1].group[2]" parts: - name: overview prose: "When human users access non-approved webmail services, they often bypass security controls that have been implemented by an organisation, such as email content filtering. To mitigate this security risk, access to non-approved webmail services should be blocked." controls: - id: ism-0267 class: ISM-control title: "Control: ism-0267" props: - name: sort-id value: "catalog[1].group[21].group[1].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-19 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0267_smt name: statement prose: Access to non-approved webmail services is blocked. - title: Protective markings for emails props: - name: sort-id value: "catalog[1].group[21].group[1].group[3]" parts: - name: overview prose: "Implementing protective markings for emails helps to prevent data spills, such as unauthorised data being released into the public domain. In doing so, it is important that protective markings reflect the highest sensitivity or classification of the subject, body and attachments of emails." controls: - id: ism-0270 class: ISM-control title: "Control: ism-0270" props: - name: sort-id value: "catalog[1].group[21].group[1].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0270_smt name: statement prose: "Protective markings are applied to emails and reflect the highest sensitivity or classification of the subject, body and attachments." - title: Protective marking tools props: - name: sort-id value: "catalog[1].group[21].group[1].group[4]" parts: - name: overview prose: |- Requiring human user involvement in the protective marking of emails ensures a conscious decision is made. This lessens the chance of incorrect protective markings being automatically applied to emails. In addition, only allowing the selection of protective markings for which a system is authorised to process, store or communicate lessens the chance of inadvertently over-classifying emails. Email content filters may only check the most recent protective marking applied to emails. Therefore, when responding to or forwarding emails, requiring protective markings that are at least as high as that of emails that are received will help email content filters prevent emails being sent to systems that are not authorised to handle their original sensitivity or classification. controls: - id: ism-0271 class: ISM-control title: "Control: ism-0271" props: - name: sort-id value: "catalog[1].group[21].group[1].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-19 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0271_smt name: statement prose: Protective marking tools do not automatically insert protective markings into emails. - id: ism-0272 class: ISM-control title: "Control: ism-0272" props: - name: sort-id value: "catalog[1].group[21].group[1].group[4].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0272_smt name: statement prose: "Protective marking tools do not allow the selection of protective markings that a system has not been authorised to process, store or communicate." - id: ism-1089 class: ISM-control title: "Control: ism-1089" props: - name: sort-id value: "catalog[1].group[21].group[1].group[4].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1089_smt name: statement prose: "When replying to or forwarding emails, protective marking tools do not allow the selection of protective markings lower than previously used." - title: "Handling emails with inappropriate, invalid or missing protective markings" props: - name: sort-id value: "catalog[1].group[21].group[1].group[5]" parts: - name: overview prose: |- It is important that email servers are configured to block emails with inappropriate protective markings. For example, blocking inbound and outbound emails with protective markings higher than the sensitivity or classification of the receiving system, as this will help prevent a data spill from occurring. In doing so, it is important to inform the intended recipients of blocked inbound emails, and the senders of blocked outbound emails, that this has occurred. If emails are received with invalid or missing protective markings, they may still be passed to their intended recipients. However, the recipients will have an obligation to determine appropriate protective markings if emails are to be responded to, forwarded or printed. If unsure, original senders of emails should be contacted to provide guidance on appropriate protective markings. controls: - id: ism-0565 class: ISM-control title: "Control: ism-0565" props: - name: sort-id value: "catalog[1].group[21].group[1].group[5].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-19 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0565_smt name: statement prose: "Email servers are configured to block, log and report emails with inappropriate protective markings." - id: ism-1023 class: ISM-control title: "Control: ism-1023" props: - name: sort-id value: "catalog[1].group[21].group[1].group[5].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1023_smt name: statement prose: "The intended recipients of blocked inbound emails, and the senders of blocked outbound emails, are notified." - title: Email distribution lists props: - name: sort-id value: "catalog[1].group[21].group[1].group[6]" parts: - name: overview prose: "In some cases, the membership and nationality of members of email distribution lists will be unknown. As such, emails containing Australian Eyes Only, Australian Government Access Only or Releasable To data that are sent to email distribution lists could accidentally cause a data spill." controls: - id: ism-0269 class: ISM-control title: "Control: ism-0269" props: - name: sort-id value: "catalog[1].group[21].group[1].group[6].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0269_smt name: statement prose: "Emails containing Australian Eyes Only, Australian Government Access Only or Releasable To data are not sent to email distribution lists unless the nationality of all members of email distribution lists can be confirmed." - title: Email gateways and servers props: - name: sort-id value: "catalog[1].group[21].group[2]" parts: - name: overview prose: |- # Further information Further information on hardening Microsoft Exchange can be found in the United States’ National Security Agency’s [Microsoft Exchange Server Security Best Practices](#bb5eee70-5b74-4ea2-bc27-32aceeee9b2f) publication. Further information on implementing opportunistic TLS encryption for email servers can be found in the Australian Signals Directorate’s (ASD) [Implementing certificates, TLS, HTTPS and opportunistic TLS](#b8cdbf18-31cb-4e10-bb43-e8488ee8c2f6) publication. Further information on implementing SPF, DKIM and DMARC can be found in ASD’s [How to combat fake emails](#d3572f80-d9d6-4023-b6e6-23720bb0d618) publication. Further information on engaging the services of email service providers for marketing or filtering purposes can be found in ASD’s [Marketing and filtering email service providers](#e4eee462-f6e5-4921-a8fe-26f3de6c6f45) publication. Further information on email content filtering can be found in the ‘Content filtering’ section of the [Guidelines for gateways](#e8bde527-526c-4a6a-b66f-05228f09dd7b). Further information on email content filtering can be found in ASD’s [Malicious email mitigation strategies](#6136b137-0cc9-4d21-94ee-0abfac2b4e18) publication. Further information on email security can be found in the following National Institute of Standards and Technology (NIST) publications: - NIST Special Publication (SP) 800-45 Version 2, [Guidelines on Electronic Mail Security](#b383a647-7627-4450-99b6-640ae554c2f1) - NIST SP 800-177 Rev. 1, [Trustworthy Email](#4b0f2fa7-f9d6-48d8-b14c-527939808882) - NIST SP 1800-6, [Domain Name System-Based Electronic Mail Security](#55038d94-7587-4234-a18c-fb459fcdb295). groups: - title: Centralised email gateways props: - name: sort-id value: "catalog[1].group[21].group[2].group[01]" parts: - name: overview prose: "When routing emails via centralised email gateways, it will be easier for an organisation to deploy Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), Domain-based Message Authentication, Reporting and Conformance (DMARC) and protective marking checks." controls: - id: ism-0569 class: ISM-control title: "Control: ism-0569" props: - name: sort-id value: "catalog[1].group[21].group[2].group[01].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0569_smt name: statement prose: Emails are routed via centralised email gateways. - id: ism-0571 class: ISM-control title: "Control: ism-0571" props: - name: sort-id value: "catalog[1].group[21].group[2].group[01].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0571_smt name: statement prose: "When users send or receive emails, an authenticated and encrypted channel is used to route emails via their organisation’s centralised email gateways." - title: Email gateway maintenance activities props: - name: sort-id value: "catalog[1].group[21].group[2].group[02]" parts: - name: overview prose: "As backup and alternative email gateways are often poorly maintained in terms of patches and email content filtering, malicious actors will often seek to exploit this when sending malicious emails to an organisation. As such, it is important that backup and alternative email gateways are maintained at the same standard as an organisation’s primary email gateway." controls: - id: ism-0570 class: ISM-control title: "Control: ism-0570" props: - name: sort-id value: "catalog[1].group[21].group[2].group[02].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0570_smt name: statement prose: "Where backup or alternative email gateways are in place, they are maintained at the same standard as the primary email gateway." - title: Open relay email servers props: - name: sort-id value: "catalog[1].group[21].group[2].group[03]" parts: - name: overview prose: An open relay email server (or open mail relay) is an email server that is configured to allow anyone on the internet to send emails through it. Such configurations are highly undesirable as spammers and worms can exploit them. controls: - id: ism-0567 class: ISM-control title: "Control: ism-0567" props: - name: sort-id value: "catalog[1].group[21].group[2].group[03].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0567_smt name: statement prose: Email servers only relay emails destined for or originating from their domains (including subdomains). - title: Email server transport encryption props: - name: sort-id value: "catalog[1].group[21].group[2].group[04]" parts: - name: overview prose: |- Emails can be intercepted anywhere between originating email servers and destination email servers. Implementing opportunistic Transport Layer Security (TLS) encryption can mitigate this security risk. However, opportunistic TLS encryption is susceptible to downgrade attacks. To mitigate this security risk, Mail Transfer Agent Strict Transport Security (MTA-STS) allows domain owners to indicate that email transfers should only occur if satisfactory TLS encryption is negotiated beforehand. In support of MTA-STS implementations, TLS Reporting provides a mechanism for a domain owner to publish a location where reports can be submitted regarding the success or failure of attempts to initiate encrypted connections when sending emails to a specified domain. controls: - id: ism-0572 class: ISM-control title: "Control: ism-0572" props: - name: sort-id value: "catalog[1].group[21].group[2].group[04].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0572_smt name: statement prose: Opportunistic TLS encryption is enabled on email servers that make incoming or outgoing email connections over public network infrastructure. - id: ism-1589 class: ISM-control title: "Control: ism-1589" props: - name: sort-id value: "catalog[1].group[21].group[2].group[04].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1589_smt name: statement prose: MTA-STS is enabled to prevent the unencrypted transfer of emails between email servers. - title: Sender Policy Framework props: - name: sort-id value: "catalog[1].group[21].group[2].group[05]" parts: - name: overview prose: "SPF aids in the detection of spoofed emails by specifying a list of hosts or Internet Protocol (IP) addresses that are allowed to send emails on behalf of a specified domain or subdomain. If an email server is not in the SPF record for a domain or subdomain, SPF verification will not pass. In specifying SPF records, domain owners should ensure that they delegate the minimum necessary set of hosts or IP addresses necessary for sending emails. In addition, extra care should be taken when delegating to hosts or IP addresses not under an organisation’s control." controls: - id: ism-0574 class: ISM-control title: "Control: ism-0574" props: - name: sort-id value: "catalog[1].group[21].group[2].group[05].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0574_smt name: statement prose: SPF is used to specify authorised email servers (or lack thereof) for an organisation’s domains (including subdomains). - id: ism-1183 class: ISM-control title: "Control: ism-1183" props: - name: sort-id value: "catalog[1].group[21].group[2].group[05].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1183_smt name: statement prose: A hard fail SPF record is used when specifying authorised email servers (or lack thereof) for an organisation’s domains (including subdomains). - id: ism-1151 class: ISM-control title: "Control: ism-1151" props: - name: sort-id value: "catalog[1].group[21].group[2].group[05].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Oct-19 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1151_smt name: statement prose: SPF is used to verify the authenticity of incoming emails. - title: DomainKeys Identified Mail props: - name: sort-id value: "catalog[1].group[21].group[2].group[06]" parts: - name: overview prose: "DKIM enables the detection of spoofed email contents. This is achieved by DKIM records specifying the public key used to verify the digital signature in an email. Specifically, if the signed digest in an email header does not match the signed contents of the email, verification will not pass." controls: - id: ism-0861 class: ISM-control title: "Control: ism-0861" props: - name: sort-id value: "catalog[1].group[21].group[2].group[06].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0861_smt name: statement prose: DKIM signing is enabled on emails originating from an organisation’s domains (including subdomains). - id: ism-1026 class: ISM-control title: "Control: ism-1026" props: - name: sort-id value: "catalog[1].group[21].group[2].group[06].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1026_smt name: statement prose: DKIM signatures on incoming emails are verified. - id: ism-1027 class: ISM-control title: "Control: ism-1027" props: - name: sort-id value: "catalog[1].group[21].group[2].group[06].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1027_smt name: statement prose: Email distribution list applications used by external senders is configured such that it does not break the validity of the sender’s DKIM signature. - title: "Domain-based Message Authentication, Reporting and Conformance" props: - name: sort-id value: "catalog[1].group[21].group[2].group[07]" parts: - name: overview prose: |- DMARC enables a domain owner to specify what action receiving email servers should take as a result of domain alignment, SPF and DKIM checks. For emails that do not pass DMARC checks, this includes ‘reject’ (emails are rejected), ‘quarantine’ (emails are marked as spam) or ‘none’ (no action is taken). DMARC also provides a reporting feature that enables a domain owner to receive reports on the actions taken by receiving email servers. While this feature does not mitigate malicious emails sent to the domain owner’s organisation, it can give the domain owner some visibility of attempts by malicious actors to spoof their organisation’s domains. controls: - id: ism-1540 class: ISM-control title: "Control: ism-1540" props: - name: sort-id value: "catalog[1].group[21].group[2].group[07].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1540_smt name: statement prose: DMARC records are configured for an organisation’s domains (including subdomains) such that emails are rejected if they do not pass DMARC checks. - id: ism-1799 class: ISM-control title: "Control: ism-1799" props: - name: sort-id value: "catalog[1].group[21].group[2].group[07].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1799_smt name: statement prose: Incoming emails are rejected if they do not pass DMARC checks. - title: Email content filtering props: - name: sort-id value: "catalog[1].group[21].group[2].group[08]" parts: - name: overview prose: Content filtering performed on email bodies and attachments provides a defence-in-depth approach to preventing malicious code being introduced into networks. controls: - id: ism-1234 class: ISM-control title: "Control: ism-1234" props: - name: sort-id value: "catalog[1].group[21].group[2].group[08].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1234_smt name: statement prose: Email content filtering is implemented to filter potentially harmful content in email bodies and attachments. - title: Blocking suspicious emails props: - name: sort-id value: "catalog[1].group[21].group[2].group[09]" parts: - name: overview prose: "Blocking specific types of suspicious emails, such as where the email source address uses an internal domain, or internal subdomain, reduces the likelihood of phishing emails entering an organisation’s network." controls: - id: ism-1502 class: ISM-control title: "Control: ism-1502" props: - name: sort-id value: "catalog[1].group[21].group[2].group[09].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1502_smt name: statement prose: "Emails arriving via an external connection where the email source address uses an internal domain, or internal subdomain, are blocked at the email gateway." - title: Notifications of undeliverable emails props: - name: sort-id value: "catalog[1].group[21].group[2].group[10]" parts: - name: overview prose: "Notifications of undeliverable emails are commonly sent by receiving email servers when emails cannot be delivered, usually because destination addresses are invalid. Due to the common spamming practice of spoofing sender addresses, this often results in many undeliverable email notifications being sent to innocent third parties. Sending notifications of undeliverable emails only to senders that can be verified via SPF, or other trusted means, avoids contributing to this problem while allowing legitimate senders to be notified." controls: - id: ism-1024 class: ISM-control title: "Control: ism-1024" props: - name: sort-id value: "catalog[1].group[21].group[2].group[10].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1024_smt name: statement prose: Notifications of undeliverable emails are only sent to senders that can be verified via SPF or other trusted means. - title: Guidelines for networking props: - name: sort-id value: "catalog[1].group[22]" groups: - title: Network design and configuration props: - name: sort-id value: "catalog[1].group[22].group[1]" parts: - name: overview prose: |- # Further information Further information on secure network design can be found in ASD’s [Foundations for modern defensible architecture](#8a67ffd7-61a4-4773-a1e7-e6b146f51d62) publication. Further information on wired networks can be found in the ‘Wired networks’ section of these guidelines. Further information on wireless networks can be found in the ‘Wireless networks’ section of these guidelines. Further information on gateways can be found in the ‘Gateways’ section of the [Guidelines for gateways](#e8bde527-526c-4a6a-b66f-05228f09dd7b). Further information on encrypting communications can be found in the ‘Cryptographic fundamentals’ section of the [Guidelines for cryptography](#195abe87-bb1e-4006-8b42-eaecca4d51f1). Further information on network segmentation and segregation can be found in ASD’s [Implementing network segmentation and segregation](#23d977b2-e64e-4ebc-a59f-cd95212045c5) publication. Further information on network security zones can be found in Canada’s Canadian Centre for Cyber Security’s [Baseline security requirements for network security zones (version 2.0)](#b43b0377-c2e4-4cdc-acec-a9ece7371e36) publication. Further information on implementing network segmentation and segregation for system administration purposes can be found in the ‘System administration’ section of the [Guidelines for system management](#c6ca6620-ccd5-4c5d-b97c-9d92f1162948). Further information on functional separation of servers using virtualisation can be found in the ‘Virtualisation hardening’ section of the [Guidelines for system hardening](#de7525f3-a466-40a5-abdd-3ae24a6d1b44). Further information on cyber supply chain risk management can be found in the ‘Cyber supply chain risk management’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on evaluated products can be found in the ‘Evaluated product procurement’ section of the [Guidelines for evaluated products](#a699a3aa-828d-479b-b50b-98127bb19437). Further information on blocking anonymity network traffic can be found in ASD’s [Defending against the malicious use of the Tor network](#ded13757-3c76-40cb-b46e-f84e46a1c1c7) publication. Further information on DNS services can be found in ASD’s [Domain Name System security for domain owners](#b66f8d23-4209-4775-a1fd-bd4dc299a027) and [Domain Name System security for domain resolvers](#b13cb68a-a94a-4a69-b094-b1b68d10239e) publications. Further information on implementing encrypted DNS can be can be found in the United States’ National Security Agency’s [Adopting Encrypted DNS in Enterprise Environments](#e2205e57-2bf0-4696-8bd8-94a5a5d5c4f2) publication and the Cybersecurity \& Infrastructure Security Agency’s [Encrypted DNS Implementation Guidance](#fba4bdb9-82be-47a4-8198-3d47d5786932) publication. Further information on selecting a protective DNS service can be found in the United States’ National Security Agency and Cybersecurity \& Infrastructure Security Agency’s [Selecting a Protective DNS Service](#63b0d043-b6b3-4e2b-bca8-99b42cfd9904) publication. Further information on network device hardening, particularly for internet-facing network devices, can be found in the following publications: - ASD’s [Mitigation strategies for edge devices: Executive guidance](#b79c4fe8-4541-401f-a32e-87fd83021c98) - ASD’s [Mitigation strategies for edge devices: Practitioner guidance](#0cae2aee-3762-482f-8ffe-850e98d7d605) - Canada’s Canadian Centre for Cyber Security’s [Security considerations for edge devices](#c47ab307-e25d-43e7-9700-7b26d9c229c3) - United Kingdom’s National Cyber Security Centre’s [Guidance on digital forensics and protective monitoring specifications for producers of network devices and appliances](#53d281fa-1f25-4d33-9d6b-a5831851df50). Further information on network device hardening can also be found in the United States’ National Security Agency’s [Network Infrastructure Security Guide](#1ecfc41e-f6a8-4c96-ac41-1587718ca459) publication. Further information on event logging can be found in the ‘Security monitoring’ section of the [Guidelines for security assurance](#ef60c0e4-acfb-4a8b-b5ed-25675c6e117c). Further information on event logging for network devices can also be found in ASD’s [Priority logs for SIEM ingestion: Practitioner guidance](#1dbda98a-4e8b-4a52-b4f7-9d1a895fd324) publication. groups: - title: Network documentation props: - name: sort-id value: "catalog[1].group[22].group[1].group[01]" parts: - name: overview prose: "It is important that accurate and sufficiently detailed network documentation is developed as this can assist in troubleshooting network problems as well as responding to and recovering from cyber security incidents. As such, network documentation should include high-level network diagrams showing all connections into networks; logical network diagrams showing all critical servers, high-value servers, network devices and network security appliances; and device settings for all critical servers, high-value servers, network devices and network security appliances. Finally, as network documentation could be used by malicious actors to assist in compromising networks, it is important that it is appropriately protected." controls: - id: ism-0518 class: ISM-control title: "Control: ism-0518" props: - name: sort-id value: "catalog[1].group[22].group[1].group[01].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0518_smt name: statement prose: "Network documentation is developed, implemented and maintained." - id: ism-0516 class: ISM-control title: "Control: ism-0516" props: - name: sort-id value: "catalog[1].group[22].group[1].group[01].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0516_smt name: statement prose: "Network documentation includes high-level network diagrams showing all connections into networks and logical network diagrams showing all critical servers, high-value servers, network devices and network security appliances." - id: ism-1912 class: ISM-control title: "Control: ism-1912" props: - name: sort-id value: "catalog[1].group[22].group[1].group[01].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1912_smt name: statement prose: "Network documentation includes device settings for all critical servers, high-value servers, network devices and network security appliances." - id: ism-1178 class: ISM-control title: "Control: ism-1178" props: - name: sort-id value: "catalog[1].group[22].group[1].group[01].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1178_smt name: statement prose: "Network documentation provided to a third party, or published in public tender documentation, only contains details necessary for other parties to undertake contractual services." - title: Network segmentation and segregation props: - name: sort-id value: "catalog[1].group[22].group[1].group[02]" parts: - name: overview prose: "Network segmentation and segregation is one of the most effective security controls in preventing malicious actors from easily propagating throughout networks once initial access has been gained. To achieve this, networks can be segregated into multiple network zones to protect servers, services and data. For example, administrative infrastructure used for managing critical servers, high-value servers and regular servers should be segregated from each other. In addition, all administrative infrastructure should be segregated from other assets on networks." controls: - id: ism-1181 class: ISM-control title: "Control: ism-1181" props: - name: sort-id value: "catalog[1].group[22].group[1].group[02].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1181_smt name: statement prose: "Networks are segregated into multiple network zones according to the criticality of servers, services and data." - id: ism-1577 class: ISM-control title: "Control: ism-1577" props: - name: sort-id value: "catalog[1].group[22].group[1].group[02].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1577_smt name: statement prose: An organisation’s networks are segregated from their service providers’ networks. - title: Using virtual local area networks props: - name: sort-id value: "catalog[1].group[22].group[1].group[03]" parts: - name: overview prose: |- Virtual local area networks (VLANs) can be used to implement network segmentation and segregation when networks belong to the same security domain. In such cases, if a data spill occurs the impact will be less than if a data spill occurred between two networks of different classifications or between an organisation’s network and public network infrastructure. Should an organisation choose to risk manage implementing VLANs between networks belonging to different security domains, such as at the same classification, additional security controls for network devices will apply, such as not sharing VLAN trunks and terminating VLANs on separate physical network interfaces. For the purposes of this topic, Multiprotocol Label Switching is considered equivalent to VLANs and subject to the same security controls. controls: - id: ism-1532 class: ISM-control title: "Control: ism-1532" props: - name: sort-id value: "catalog[1].group[22].group[1].group[03].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1532_smt name: statement prose: VLANs are not used to separate network traffic between an organisation’s networks and public network infrastructure. - id: ism-0529 class: ISM-control title: "Control: ism-0529" props: - name: sort-id value: "catalog[1].group[22].group[1].group[03].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0529_smt name: statement prose: VLANs are not used to separate network traffic between networks belonging to different security domains. - id: ism-0530 class: ISM-control title: "Control: ism-0530" props: - name: sort-id value: "catalog[1].group[22].group[1].group[03].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0530_smt name: statement prose: Network devices managing VLANs are administered from the most trusted security domain. - id: ism-0535 class: ISM-control title: "Control: ism-0535" props: - name: sort-id value: "catalog[1].group[22].group[1].group[03].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0535_smt name: statement prose: Network devices managing VLANs belonging to different security domains do not share VLAN trunks. - id: ism-1364 class: ISM-control title: "Control: ism-1364" props: - name: sort-id value: "catalog[1].group[22].group[1].group[03].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1364_smt name: statement prose: Network devices managing VLANs terminate VLANs belonging to different security domains on separate physical network interfaces. - title: Functional separation between networked devices and the internet props: - name: sort-id value: "catalog[1].group[22].group[1].group[04]" parts: - name: overview prose: Implementing functional separation between networked devices and the internet reduces the exposure of such devices to attacks originating from the internet. controls: - id: ism-2068 class: ISM-control title: "Control: ism-2068" props: - name: sort-id value: "catalog[1].group[22].group[1].group[04].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2068_smt name: statement prose: Internet connectivity for networked devices is strictly limited to those that require access. - title: Networked management interfaces props: - name: sort-id value: "catalog[1].group[22].group[1].group[05]" parts: - name: overview prose: "To assist in reducing the attack surface of networks, IT equipment residing on networks (such as servers) or constituting the makeup of network infrastructure (such as network devices) should not directly expose their networked management interfaces to the internet. In situations where this is not possible, such as for some cloud services and web applications, alternative measures will need to be implemented to protect weak or vulnerable networked management interfaces from being exploited by malicious actors to remotely compromise networks. Ideally, IT equipment on networks, or constituting the makeup of network infrastructure, should be managed via a dedicated management network that is segregated from the wider network and the internet." controls: - id: ism-1863 class: ISM-control title: "Control: ism-1863" props: - name: sort-id value: "catalog[1].group[22].group[1].group[05].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1863_smt name: statement prose: Networked management interfaces for IT equipment are not directly exposed to the internet. - id: ism-2160 class: ISM-control title: "Control: ism-2160" props: - name: sort-id value: "catalog[1].group[22].group[1].group[05].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2160_smt name: statement prose: Networked management interfaces for IT equipment are only accessible from a dedicated management network that is segregated from the wider network and the internet. - title: Functional separation between servers props: - name: sort-id value: "catalog[1].group[22].group[1].group[06]" parts: - name: overview prose: Implementing functional separation between servers reduces the likelihood that a server compromised by malicious actors will pose an increased security risk to other servers. controls: - id: ism-0385 class: ISM-control title: "Control: ism-0385" props: - name: sort-id value: "catalog[1].group[22].group[1].group[06].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0385_smt name: statement prose: Servers maintain effective functional separation from each other. - id: ism-1479 class: ISM-control title: "Control: ism-1479" props: - name: sort-id value: "catalog[1].group[22].group[1].group[06].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1479_smt name: statement prose: Servers minimise communications with other servers at the network and file system level. - title: Network encryption props: - name: sort-id value: "catalog[1].group[22].group[1].group[07]" parts: - name: overview prose: "While physical security can provide a degree of protection against unauthorised physical access to network infrastructure, unauthorised access to unencrypted data can still be gained via other means, such as compromised network devices. For this reason, all data communicated over network infrastructure should be suitably encrypted, even within appropriately secure areas. As such, it is critical that Australian Signals Directorate (ASD)-approved cryptography is used. However, where protocols do not have encrypted equivalents, an organisation should consider transitioning to alternative protocols that support suitable encryption where practical and feasible." controls: - id: ism-1781 class: ISM-control title: "Control: ism-1781" props: - name: sort-id value: "catalog[1].group[22].group[1].group[07].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1781_smt name: statement prose: All data communicated over network infrastructure is encrypted using ASD-approved cryptography. - title: Using Internet Protocol version 6 props: - name: sort-id value: "catalog[1].group[22].group[1].group[08]" parts: - name: overview prose: |- The use of Internet Protocol version 6 (IPv6) can introduce additional security risks to networks if not managed appropriately. As such, IPv6 capable network security appliances should be used on IPv6 and dual-stack networks to ensure security coverage equivalent to that provided for Internet Protocol version 4 (IPv4) networks while assisting in ensuring that IPv6 cannot be exploited by malicious actors. To aid in the transition from IPv4 to IPv6, numerous tunnelling protocols have been developed to enable interoperability between IPv4 and IPv6. Disabling IPv6 tunnelling protocols on networks that do not require such functionality will prevent malicious actors from bypassing traditional network defences by encapsulating IPv6 data inside IPv4 packets. Stateless Address Autoconfiguration is a method of stateless Internet Protocol (IP) address configuration in IPv6 networks. It reduces the ability of an organisation to maintain effective logs of IP address assignments on networks. For this reason, stateless IP addressing should be avoided. controls: - id: ism-1186 class: ISM-control title: "Control: ism-1186" props: - name: sort-id value: "catalog[1].group[22].group[1].group[08].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1186_smt name: statement prose: IPv6 capable network security appliances are used on IPv6 and dual-stack networks. - id: ism-1428 class: ISM-control title: "Control: ism-1428" props: - name: sort-id value: "catalog[1].group[22].group[1].group[08].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1428_smt name: statement prose: "Unless explicitly required, IPv6 tunnelling is disabled on all network devices." - id: ism-1429 class: ISM-control title: "Control: ism-1429" props: - name: sort-id value: "catalog[1].group[22].group[1].group[08].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1429_smt name: statement prose: IPv6 tunnelling is blocked by network security appliances at externally connected network boundaries. - id: ism-1430 class: ISM-control title: "Control: ism-1430" props: - name: sort-id value: "catalog[1].group[22].group[1].group[08].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1430_smt name: statement prose: Dynamically assigned IPv6 addresses are configured with Dynamic Host Configuration Protocol version 6 in a stateful manner with lease data stored in a centralised event logging facility. - title: Network access controls props: - name: sort-id value: "catalog[1].group[22].group[1].group[09]" parts: - name: overview prose: "If malicious actors have reduced opportunities to connect unauthorised network devices, or networked information technology (IT) equipment, to networks, they also have reduced opportunities to compromise such networks. Network access controls can not only prevent unauthorised access to networks, but also prevent personnel from carelessly bridging networks by connecting one network to another network. Furthermore, network access controls can also be useful for limiting the flow of network traffic between network segments." controls: - id: ism-0520 class: ISM-control title: "Control: ism-0520" props: - name: sort-id value: "catalog[1].group[22].group[1].group[09].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "9" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0520_smt name: statement prose: Network access controls are implemented on networks to prevent the connection of unauthorised network devices and networked IT equipment. - id: ism-1182 class: ISM-control title: "Control: ism-1182" props: - name: sort-id value: "catalog[1].group[22].group[1].group[09].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1182_smt name: statement prose: Network access controls are implemented to limit the flow of network traffic within and between network segments to only that required for business purposes. - title: 802.1X authentication and key exchange props: - name: sort-id value: "catalog[1].group[22].group[1].group[10]" parts: - name: overview prose: |- 802.1X authentication requires the use of an Extensible Authentication Protocol (EAP), of which multiple EAP methods are available. Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) is considered one of the most secure EAP methods for 802.1X authentication and is widely supported. It uses a public key infrastructure to secure communications between devices and a Remote Authentication Dial-In User Service (RADIUS) server by using X.509 certificates. While EAP-TLS provides strong mutual authentication, it requires an organisation to have established a public key infrastructure. This involves deploying their own certificate authority and issuing X.509 certificates, or sourcing them from a commercial certificate authority, for every device that accesses their network. While this introduces additional costs and management overheads, the security advantages are significant. controls: - id: ism-1321 class: ISM-control title: "Control: ism-1321" props: - name: sort-id value: "catalog[1].group[22].group[1].group[10].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1321_smt name: statement prose: 802.1X with EAP-TLS is used for mutual authentication and key exchange; with all other EAP methods disabled on supplicants and authentication servers. - id: ism-1711 class: ISM-control title: "Control: ism-1711" props: - name: sort-id value: "catalog[1].group[22].group[1].group[10].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1711_smt name: statement prose: User identity confidentiality is used if available with EAP-TLS implementations. - title: Evaluation of 802.1X implementations props: - name: sort-id value: "catalog[1].group[22].group[1].group[11]" parts: - name: overview prose: "The security of 802.1X authentication is dependent on three main elements and how they interact. These three elements include supplicants, authenticators and authentication servers. To provide assurance that these elements have been implemented correctly, they should have completed an evaluation." controls: - id: ism-1322 class: ISM-control title: "Control: ism-1322" props: - name: sort-id value: "catalog[1].group[22].group[1].group[11].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1322_smt name: statement prose: "Evaluated supplicants, authenticators and authentication servers are used for 802.1X authentication implementations." - title: Generating and issuing X.509 certificates for authentication props: - name: sort-id value: "catalog[1].group[22].group[1].group[12]" parts: - name: overview prose: |- When issuing X.509 certificates to devices to access networks, an organisation should be aware that they could be stolen by malicious code. Once compromised, X.509 certificates could be used on other devices to gain unauthorised access to networks. An organisation should also be aware that in only issuing X.509 certificates to devices, any actions taken by human users will only be attributable to specific devices. When issuing X.509 certificates to human users to access networks, they can either be stored on devices or stored on smart cards. While issuing X.509 certificates that are stored on smart cards provides increased security, it comes at a higher cost. However, human users are more likely to notice missing smart cards and alert their security team, who are then able to revoke their credentials, which can minimise the time malicious actors have access to networks. In addition, to reduce the likelihood of stolen smart cards from being used to gain unauthorised access to networks, multi-factor authentication can be implemented by requiring the use of passwords to access X.509 certificates stored on smart cards. This is particularly important when smart cards grant human users any form of administrative access. controls: - id: ism-1323 class: ISM-control title: "Control: ism-1323" props: - name: sort-id value: "catalog[1].group[22].group[1].group[12].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1323_smt name: statement prose: X.509 certificates are required for devices and human users authenticating to networks using 802.1X. - id: ism-1324 class: ISM-control title: "Control: ism-1324" props: - name: sort-id value: "catalog[1].group[22].group[1].group[12].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1324_smt name: statement prose: X.509 certificates are generated using an evaluated certificate authority or hardware security module. - id: ism-1327 class: ISM-control title: "Control: ism-1327" props: - name: sort-id value: "catalog[1].group[22].group[1].group[12].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1327_smt name: statement prose: "X.509 certificates are protected by logical and physical access controls and encryption, with those issued to human users requiring authentication before use." - title: Remote Authentication Dial-In User Service authentication props: - name: sort-id value: "catalog[1].group[22].group[1].group[13]" parts: - name: overview prose: "Separate to the 802.1X authentication process is the RADIUS authentication process that occurs between authenticators and a RADIUS server. RADIUS is what is known as an authentication, authorisation and accounting protocol, and is intended to mediate network access. However, RADIUS is not secure enough to be used without protection. To protect credentials communicated between authenticators and a RADIUS server, communications should be encapsulated with an additional layer of encryption, such as RADIUS over Internet Protocol Security or RADIUS over Transport Layer Security." controls: - id: ism-1454 class: ISM-control title: "Control: ism-1454" props: - name: sort-id value: "catalog[1].group[22].group[1].group[13].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1454_smt name: statement prose: Communications between authenticators and a RADIUS server are encapsulated with an additional layer of encryption using RADIUS over Internet Protocol Security or RADIUS over Transport Layer Security. - title: Network management traffic props: - name: sort-id value: "catalog[1].group[22].group[1].group[14]" parts: - name: overview prose: "Implementing security measures specifically for network management traffic provides another layer of defence should malicious actors find an opportunity to connect to networks. In addition, this also makes it more difficult for malicious actors to enumerate networks." controls: - id: ism-1006 class: ISM-control title: "Control: ism-1006" props: - name: sort-id value: "catalog[1].group[22].group[1].group[14].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1006_smt name: statement prose: Security measures are implemented to prevent unauthorised access to network management traffic. - title: Using the Server Message Block protocol props: - name: sort-id value: "catalog[1].group[22].group[1].group[15]" parts: - name: overview prose: "The Server Message Block (SMB) protocol is used to share files and printers across networks. Unfortunately, multiple weaknesses exist in SMB version 1 that can be used by malicious actors to gain access to resources on networks, including Microsoft Active Directory Domain Services domain controllers." controls: - id: ism-1962 class: ISM-control title: "Control: ism-1962" props: - name: sort-id value: "catalog[1].group[22].group[1].group[15].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1962_smt name: statement prose: SMB version 1 is not used on networks. - title: Using the Simple Network Management Protocol props: - name: sort-id value: "catalog[1].group[22].group[1].group[16]" parts: - name: overview prose: "The Simple Network Management Protocol (SNMP) can be used to monitor the status of network devices. The first two iterations of SNMP were inherently insecure as they used trivial authentication methods. Furthermore, changing all default SNMP community strings on network devices, and limiting their access to read-only, is strongly encouraged." controls: - id: ism-1311 class: ISM-control title: "Control: ism-1311" props: - name: sort-id value: "catalog[1].group[22].group[1].group[16].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1311_smt name: statement prose: SNMP version 1 and SNMP version 2 are not used on networks. - id: ism-1312 class: ISM-control title: "Control: ism-1312" props: - name: sort-id value: "catalog[1].group[22].group[1].group[16].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1312_smt name: statement prose: All default SNMP community strings on network devices are changed and write access is disabled. - title: Using network-based intrusion detection and prevention systems props: - name: sort-id value: "catalog[1].group[22].group[1].group[17]" parts: - name: overview prose: "A network-based intrusion detection system (NIDS) or network-based intrusion prevention system (NIPS) can be an effective way of identifying and responding to network intrusions. In addition, generating event logs and alerts for network traffic that contravenes any rule in a firewall ruleset can help identify suspicious or malicious network traffic entering networks due to a failure of, or configuration change to, firewalls." controls: - id: ism-1028 class: ISM-control title: "Control: ism-1028" props: - name: sort-id value: "catalog[1].group[22].group[1].group[17].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1028_smt name: statement prose: A NIDS or NIPS is deployed in gateways between an organisation’s networks and other networks they do not manage. - id: ism-1030 class: ISM-control title: "Control: ism-1030" props: - name: sort-id value: "catalog[1].group[22].group[1].group[17].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1030_smt name: statement prose: A NIDS or NIPS is located immediately inside the outermost firewall for gateways and configured to generate event logs and alerts for network traffic that contravenes any rule in a firewall ruleset. - title: Blocking anonymity network traffic props: - name: sort-id value: "catalog[1].group[22].group[1].group[18]" parts: - name: overview prose: "Inbound network connections from anonymity networks, such as the Tor network, can be used by malicious actors for reconnaissance and malicious code delivery purposes with minimal risk of detection and attribution. As such, this network traffic should be blocked. However, an organisation might choose to support anonymous connections to their websites to cater for individuals who want to remain anonymous for privacy reasons. In such cases, it is suggested that network traffic from anonymity networks be logged and monitored instead. Additionally, outbound network connections to anonymity networks can be used by malicious code for command and control or data exfiltration purposes and should be blocked." controls: - id: ism-1627 class: ISM-control title: "Control: ism-1627" props: - name: sort-id value: "catalog[1].group[22].group[1].group[18].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1627_smt name: statement prose: Inbound network connections from anonymity networks are blocked. - id: ism-1628 class: ISM-control title: "Control: ism-1628" props: - name: sort-id value: "catalog[1].group[22].group[1].group[18].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Nov-20 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1628_smt name: statement prose: Outbound network connections to anonymity networks are blocked. - title: Encrypted Domain Name System Services props: - name: sort-id value: "catalog[1].group[22].group[1].group[19]" parts: - name: overview prose: "Domain Name System (DNS) is a hierarchical naming system built on a distributed database for resources connected to the internet. In performing this service, DNS maps human-readable domain names to their associated IP addresses. Unfortunately, malicious actors can surveil standard DNS requests for intelligence gathering. As such, it is important that DNS traffic is suitably encrypted by clients and servers using ASD-approved cryptography, such as via DNS over Hypertext Transfer Protocol Secure or DNS over Transport Layer Security." controls: - id: ism-2017 class: ISM-control title: "Control: ism-2017" props: - name: sort-id value: "catalog[1].group[22].group[1].group[19].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2017_smt name: statement prose: DNS traffic is encrypted by clients and servers using ASD-approved cryptography. - title: Protective Domain Name System Services props: - name: sort-id value: "catalog[1].group[22].group[1].group[20]" parts: - name: overview prose: |- A protective DNS service can be an effective way of blocking requests made by an organisation’s users, or malicious actors on an organisation’s network, to known malicious domain names – either as part of an initial compromise or subsequent command and control activities. DNS event logs captured by a protective DNS service can also be useful for investigating any exploitation attempt or successful compromise of a network by malicious actors. In selecting a protective DNS service, many commercial offerings exist. In addition, ASD offers a free protective DNS service for Australia’s most critical systems. controls: - id: ism-1782 class: ISM-control title: "Control: ism-1782" props: - name: sort-id value: "catalog[1].group[22].group[1].group[20].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1782_smt name: statement prose: A protective DNS service is used to block access to known malicious domain names. - title: Network device integrity props: - name: sort-id value: "catalog[1].group[22].group[1].group[21]" parts: - name: overview prose: "Flashing network devices with trusted firmware, obtained from vendors via trusted means, before network devices are used for the first time can assist in reducing cyber supply chain risks, such as the introduction of malicious firmware resulting from a cyber supply chain interdiction attack or a compromised vendor development environment or authoritative source for software. Furthermore, to maintain the ongoing integrity of network devices, their firmware and running configurations should be verified against an approved known-good baseline following patching, on detection of anomalous behaviour and at least monthly. This is especially important for internet-facing network devices." controls: - id: ism-1800 class: ISM-control title: "Control: ism-1800" props: - name: sort-id value: "catalog[1].group[22].group[1].group[21].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1800_smt name: statement prose: Network devices are flashed with trusted firmware before they are used for the first time. - id: ism-2161 class: ISM-control title: "Control: ism-2161" props: - name: sort-id value: "catalog[1].group[22].group[1].group[21].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2161_smt name: statement prose: "The integrity of network device firmware and running configurations is verified against an approved known-good baseline following patching, on detection of anomalous behaviour and at least monthly." - title: Network device hardening props: - name: sort-id value: "catalog[1].group[22].group[1].group[22]" parts: - name: overview prose: "Network devices can come pre-configured with default user accounts and credentials. For example, wireless access points with a user account named ‘admin’ and a password of ‘admin’. Ensuring that default user accounts or credentials are changed, disabled or removed during initial setup can assist in reducing the likelihood of network devices being exploited by malicious actors. Furthermore, any unneeded components, services and functionality of network devices should also be disabled to reduce their attack surface. This is especially important for internet-facing network devices." controls: - id: ism-1304 class: ISM-control title: "Control: ism-1304" props: - name: sort-id value: "catalog[1].group[22].group[1].group[22].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1304_smt name: statement prose: "Default user accounts or credentials for network devices, including for any pre-configured user accounts, are changed, disabled or removed during initial setup." - id: ism-2162 class: ISM-control title: "Control: ism-2162" props: - name: sort-id value: "catalog[1].group[22].group[1].group[22].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2162_smt name: statement prose: "Unneeded components, services and functionality of network devices are disabled or removed." - title: Disabling unused physical ports on network devices props: - name: sort-id value: "catalog[1].group[22].group[1].group[23]" parts: - name: overview prose: Disabling unused physical ports on network devices reduces the opportunity for malicious actors to connect to networks if they can gain physical access to network devices. controls: - id: ism-0534 class: ISM-control title: "Control: ism-0534" props: - name: sort-id value: "catalog[1].group[22].group[1].group[23].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0534_smt name: statement prose: Unused physical ports on network devices are disabled. - title: Regularly restarting network devices props: - name: sort-id value: "catalog[1].group[22].group[1].group[24]" parts: - name: overview prose: Implementing measures to restart network devices at least monthly can assist in maintaining network device performance as well as removing malicious actors that may have compromised a network device but failed to gain persistence. controls: - id: ism-1801 class: ISM-control title: "Control: ism-1801" props: - name: sort-id value: "catalog[1].group[22].group[1].group[24].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1801_smt name: statement prose: Network devices are restarted at least monthly. - title: Network device event logging props: - name: sort-id value: "catalog[1].group[22].group[1].group[25]" parts: - name: overview prose: "Centrally logging and analysing security-relevant events, including configuration changes, for network devices, especially for internet-facing network devices, can assist in monitoring the security posture of systems, detecting malicious behaviour and contributing to investigations following cyber security incidents." controls: - id: ism-1963 class: ISM-control title: "Control: ism-1963" props: - name: sort-id value: "catalog[1].group[22].group[1].group[25].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1963_smt name: statement prose: Security-relevant events for internet-facing network devices are centrally logged. - id: ism-1964 class: ISM-control title: "Control: ism-1964" props: - name: sort-id value: "catalog[1].group[22].group[1].group[25].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1964_smt name: statement prose: Security-relevant events for non-internet-facing network devices are centrally logged. - title: Wired networks props: - name: sort-id value: "catalog[1].group[22].group[2]" parts: - name: overview prose: |- # Context This section describes security controls applicable to wired networks and extends the ‘Network design and configuration’ section of these guidelines. # Further information Further information on encrypting communications can be found in the ‘Cryptographic fundamentals’ section of the [Guidelines for cryptography](#195abe87-bb1e-4006-8b42-eaecca4d51f1). Further information on 802.1X authentication and key exchange can be found in the ‘Network design and configuration’ section of these guidelines. groups: - title: Media Access Control Security props: - name: sort-id value: "catalog[1].group[22].group[2].group[1]" parts: - name: overview prose: |- An implementation of Media Access Control Security (MACsec) that fully conforms to its standard must implement at least the GCM-AES-128 cipher suite and may optionally implement the GCM-AES-256, GCM-AES-XPN-128 and GCM-AES-XPN-256 cipher suites, with 256-bit key sizes providing more bits of effective security. These cipher suites may be used to provide only data integrity (integrity-only mode) or both data integrity and data confidentiality (confidentiality protection mode). Using a connectivity association lifetime of less than 24 hours (86400 seconds) and a secure association lifetime of less than four hours (14400 seconds) can provide a balance between security and usability. The use of a Pre-Shared Key as a fallback authentication method if EAP-TLS authentication attempts fail can limit the effective strength of the EAP authentication. For interoperability and maintainability reasons, the GCM-AES-128 and GCM-AES-XPN-128 cipher suites will not be approved beyond 2030. controls: - id: ism-2163 class: ISM-control title: "Control: ism-2163" props: - name: sort-id value: "catalog[1].group[22].group[2].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2163_smt name: statement prose: "When using MACsec, confidentiality protection mode is enabled using GCM-AES-128, GCM-AES-256, GCM-AES-XPN-128 or GCM-AES-XPN-256, preferably GCM-AES-256 or GCM-AES-XPN-256." - id: ism-2164 class: ISM-control title: "Control: ism-2164" props: - name: sort-id value: "catalog[1].group[22].group[2].group[1].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2164_smt name: statement prose: A connectivity association lifetime of less than 24 hours (86400 seconds) is used for MACsec connections. - id: ism-2165 class: ISM-control title: "Control: ism-2165" props: - name: sort-id value: "catalog[1].group[22].group[2].group[1].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2165_smt name: statement prose: "When using EAP-TLS, each device performs a fresh EAP-TLS authentication each time a new Connectivity Association Key is required." - id: ism-2166 class: ISM-control title: "Control: ism-2166" props: - name: sort-id value: "catalog[1].group[22].group[2].group[1].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2166_smt name: statement prose: A secure association lifetime of less than four hours (14400 seconds) is used for MACsec connections. - id: ism-2167 class: ISM-control title: "Control: ism-2167" props: - name: sort-id value: "catalog[1].group[22].group[2].group[1].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2167_smt name: statement prose: The use of a Pre-Shared Key as a fallback authentication method for MACsec is disabled. - title: Wireless networks props: - name: sort-id value: "catalog[1].group[22].group[3]" parts: - name: overview prose: |- # Context This section describes security controls applicable to wireless networks and extends the ‘Network design and configuration’ section of these guidelines. # Further information Further information on [Wi-Fi technologies and associated testing and certification programs](#a9b6660b-fc4c-4a08-8db6-1130370b6b09) is available from the Wi-Fi Alliance. Further information on encrypting communications can be found in the ‘Cryptographic fundamentals’ section of the [Guidelines for cryptography](#195abe87-bb1e-4006-8b42-eaecca4d51f1). Further information on 802.1X authentication and key exchange can be found in the ‘Network design and configuration’ section of these guidelines. Further information on cyber supply chain risk management can be found in the ‘Cyber supply chain risk management’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on evaluated products can be found in the ‘Evaluated product procurement’ section of the [Guidelines for evaluated products](#a699a3aa-828d-479b-b50b-98127bb19437). groups: - title: Choosing wireless devices props: - name: sort-id value: "catalog[1].group[22].group[3].group[01]" parts: - name: overview prose: "Using wireless devices, such as wireless access points, wireless adapters and wireless network cards, which have been certified against a Wi-Fi Alliance certification program, provides an organisation with the assurance that they conform to wireless standards and are guaranteed to be interoperable with other wireless devices on wireless networks." controls: - id: ism-1314 class: ISM-control title: "Control: ism-1314" props: - name: sort-id value: "catalog[1].group[22].group[3].group[01].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1314_smt name: statement prose: All wireless devices are Wi-Fi Alliance certified. - title: Public wireless networks props: - name: sort-id value: "catalog[1].group[22].group[3].group[02]" parts: - name: overview prose: "When an organisation provides a public wireless network for public use, connecting the public wireless network to, or sharing infrastructure with, any other organisation networks can create an entry point for malicious actors enabling them to target organisation networks to steal data or disrupt services." controls: - id: ism-0536 class: ISM-control title: "Control: ism-0536" props: - name: sort-id value: "catalog[1].group[22].group[3].group[02].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0536_smt name: statement prose: Public wireless networks provided for public use are segregated from all other organisation networks. - title: Administrative interfaces for wireless access points props: - name: sort-id value: "catalog[1].group[22].group[3].group[03]" parts: - name: overview prose: "Administrative interfaces allow users to modify the configuration and security settings of wireless access points. Often, by default, wireless access points allow users to access administrative interfaces over fixed network connections or wireless network connections. To assist in reducing the attack surface for wireless access points, the administrative interface should be disabled for wireless network connections." controls: - id: ism-1315 class: ISM-control title: "Control: ism-1315" props: - name: sort-id value: "catalog[1].group[22].group[3].group[03].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1315_smt name: statement prose: The administrative interface on wireless access points is disabled for wireless network connections. - title: Default settings props: - name: sort-id value: "catalog[1].group[22].group[3].group[04]" parts: - name: overview prose: |- Some wireless access points come pre-configured with weak default settings. As such, it is important to harden the settings of wireless access points prior to their deployment in networks. In addition, some wireless access points come with default Service Set Identifiers (SSIDs). As default SSIDs are often documented on the internet, it is important to change default SSIDs of wireless access points. When changing default SSIDs, it is important that new SSIDs do not bring undue attention to an organisation’s wireless networks. In doing so, SSIDs of wireless networks should not be readily associated with an organisation, the location of their premises or the functionality of wireless networks. A method commonly recommended to lower the profile of wireless networks is disabling SSID broadcasting. While this ensures that the existence of wireless networks is not broadcast overtly using beacon frames, SSIDs are still broadcast in probe requests, probe responses, association requests and re-association requests. As such, it is easy to determine SSIDs of wireless networks by capturing these requests and responses. By disabling SSID broadcasting, an organisation will make it more difficult for human users to connect to wireless networks. Furthermore, malicious actors could configure a malicious wireless access point to broadcast the same SSID as a hidden SSID used by a legitimate wireless network, fooling human users into connecting, or devices into automatically connecting, to the malicious wireless access point instead. In doing so, malicious actors could steal authentication credentials to gain access to the legitimate wireless network. controls: - id: ism-1710 class: ISM-control title: "Control: ism-1710" props: - name: sort-id value: "catalog[1].group[22].group[3].group[04].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1710_smt name: statement prose: Settings for wireless access points are hardened. - id: ism-1316 class: ISM-control title: "Control: ism-1316" props: - name: sort-id value: "catalog[1].group[22].group[3].group[04].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1316_smt name: statement prose: Default SSIDs of wireless access points are changed. - id: ism-1317 class: ISM-control title: "Control: ism-1317" props: - name: sort-id value: "catalog[1].group[22].group[3].group[04].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1317_smt name: statement prose: "SSIDs of non-public wireless networks are not readily associated with an organisation, the location of their premises or the functionality of wireless networks." - id: ism-1318 class: ISM-control title: "Control: ism-1318" props: - name: sort-id value: "catalog[1].group[22].group[3].group[04].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1318_smt name: statement prose: SSID broadcasting is not disabled on wireless access points. - title: Media Access Control address filtering props: - name: sort-id value: "catalog[1].group[22].group[3].group[05]" parts: - name: overview prose: "Devices that connect to wireless networks generally have a unique Media Access Control (MAC) address. Using MAC address filtering can prevent rogue devices from connecting to wireless networks. However, malicious actors may be able to determine MAC addresses of legitimate devices and use this information to gain access to wireless networks. As such, MAC address filtering introduces management overhead without any tangible security benefit." controls: - id: ism-1320 class: ISM-control title: "Control: ism-1320" props: - name: sort-id value: "catalog[1].group[22].group[3].group[05].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1320_smt name: statement prose: MAC address filtering is not used to restrict which devices can connect to wireless networks. - title: Static addressing props: - name: sort-id value: "catalog[1].group[22].group[3].group[06]" parts: - name: overview prose: "Assigning static IP addresses for devices accessing wireless networks can prevent rogue devices connecting to wireless networks from being assigned routable IP addresses. However, malicious actors may be able to determine IP addresses of legitimate devices and use this information to gain access to wireless networks. As such, configuring devices to use static IP addresses introduces management overhead without any tangible security benefit." controls: - id: ism-1319 class: ISM-control title: "Control: ism-1319" props: - name: sort-id value: "catalog[1].group[22].group[3].group[06].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1319_smt name: statement prose: Static addressing is not used for assigning IP addresses on wireless networks. - title: Confidentiality and integrity of wireless network traffic props: - name: sort-id value: "catalog[1].group[22].group[3].group[07]" parts: - name: overview prose: |- As wireless networks are often capable of being accessed from outside the perimeter of secured spaces, all wireless network traffic requires suitable cryptographic protection. For this purpose, it is recommended that Wi-Fi Protected Access 3 (WPA3) be used as it provides equivalent or greater security than Wi-Fi Protected Access 2 (WPA2). WPA3 has also prohibited the use of various outdated and insecure cipher suites. WPA3-Enterprise supports three enterprise modes of operation: enterprise only mode, transition mode and 192-bit mode. Preference is given to WPA3-Enterprise 192-bit mode as this mode ensures no cryptographic algorithms with known weaknesses are used. However, if any other WPA3-Enterprise modes are used then Authentication and Key Management suite 00-0F-AC:1 should be disabled (if this option is available). controls: - id: ism-1332 class: ISM-control title: "Control: ism-1332" props: - name: sort-id value: "catalog[1].group[22].group[3].group[07].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1332_smt name: statement prose: WPA3-Enterprise 192-bit mode is used to protect the confidentiality and integrity of all wireless network traffic. - title: Caching 802.1X authentication outcomes props: - name: sort-id value: "catalog[1].group[22].group[3].group[08]" parts: - name: overview prose: "When 802.1X authentication is used as part of WPA3-Enterprise, a shared secret key known as the Pairwise Master Key (PMK) is generated upon successful authentication of devices. This PMK is then capable of being cached to assist with fast roaming between wireless access points. For example, when devices roam away from wireless access points they have authenticated to, they will not need to perform a full re-authentication should they roam back while the cached PMK remains valid. To further assist with roaming, wireless access points can be configured to pre-authenticate devices to neighbouring wireless access points that devices might roam to. Although requiring full authentication for devices each time they roam between wireless access points is ideal, an organisation can choose to use PMK caching and pre-authentication if they have a business requirement for fast roaming. If PMK caching is used, the PMK caching period should not be set to greater than 1440 minutes (24 hours)." controls: - id: ism-1330 class: ISM-control title: "Control: ism-1330" props: - name: sort-id value: "catalog[1].group[22].group[3].group[08].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1330_smt name: statement prose: The PMK caching period is not set to greater than 1440 minutes (24 hours). - title: Fast Basic Service Set Transition props: - name: sort-id value: "catalog[1].group[22].group[3].group[09]" parts: - name: overview prose: "The WPA3 standard specifies support for Fast Basic Service Set Transition (FT) (802.11r). FT is a feature designed to improve user mobility and combat lag introduced by the need to authenticate to each wireless access point. However, FT requires authenticators to request and send keys to other authenticators within a security domain. If any of these keys are intercepted, all security properties are lost. Therefore, it is imperative that communications are appropriately secured. As such, FT should be disabled unless it can be confirmed that authenticator-to-authenticator communications are secured by a suitable ASD-Approved Cryptographic Protocol that provides confidentiality, integrity and mutual authentication." controls: - id: ism-1712 class: ISM-control title: "Control: ism-1712" props: - name: sort-id value: "catalog[1].group[22].group[3].group[09].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1712_smt name: statement prose: The use of FT (802.11r) is disabled unless authenticator-to-authenticator communications are secured by an ASD-Approved Cryptographic Protocol. - title: Interference between wireless networks props: - name: sort-id value: "catalog[1].group[22].group[3].group[10]" parts: - name: overview prose: "When wireless networks are deployed in proximity, there is the potential for interference to impact their availability, especially when operating on commonly used 802.11b/g (2.4 GHz) default channels of 1 and 11. Sufficiently separating wireless networks by using frequency separation can help reduce this security risk. This can be achieved by using wireless networks that are configured to operate on channels that minimise overlapping frequencies, such as using 802.11b/g (2.4 GHz) channels and 802.11n (5 GHz) channels. It is important to note though, if implementing a mix of 2.4 GHz and 5 GHz channels, not all devices may be compatible with 802.11n and able to connect to 5 GHz channels." controls: - id: ism-1334 class: ISM-control title: "Control: ism-1334" props: - name: sort-id value: "catalog[1].group[22].group[3].group[10].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1334_smt name: statement prose: Wireless networks implement sufficient frequency separation from other wireless networks. - title: Protecting management frames on wireless networks props: - name: sort-id value: "catalog[1].group[22].group[3].group[11]" parts: - name: overview prose: "An effective denial-of-service attack can be performed by exploiting unprotected management frames using inexpensive commercial hardware. The 802.11 standard provides no protection for management frames and therefore does not protect against spoofing or denial-of-service attacks. However, the 802.11w amendment specifically addresses the protection of management frames on wireless networks and should be enabled for WPA2. In WPA3, this feature is built into the standard." controls: - id: ism-1335 class: ISM-control title: "Control: ism-1335" props: - name: sort-id value: "catalog[1].group[22].group[3].group[11].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1335_smt name: statement prose: Wireless access points enable the use of the 802.11w amendment to protect management frames. - title: Wireless network footprint props: - name: sort-id value: "catalog[1].group[22].group[3].group[12]" parts: - name: overview prose: |- Instead of deploying a small number of wireless access points that broadcast on high power, a greater number of wireless access points that use less broadcast power can be deployed to achieve the desired footprint for wireless networks. This has the benefit of providing service continuity should wireless access points become unserviceable. In such cases, the output power of nearby wireless access points can be increased to cover the footprint gap until the unserviceable wireless access points can be replaced. In addition to minimising the output power of wireless access points to reduce the footprint of wireless networks, the use of radio frequency (RF) shielding can be used for an organisation’s facilities. While expensive, this will limit wireless communications to areas under the control of an organisation. RF shielding on an organisation’s facilities also has the added benefit of preventing the jamming of wireless networks from outside of the facilities in which wireless networks are operating. controls: - id: ism-1338 class: ISM-control title: "Control: ism-1338" props: - name: sort-id value: "catalog[1].group[22].group[3].group[12].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1338_smt name: statement prose: "Instead of deploying a small number of wireless access points that broadcast on high power, a greater number of wireless access points that use less broadcast power are deployed to achieve the desired footprint for wireless networks." - id: ism-1013 class: ISM-control title: "Control: ism-1013" props: - name: sort-id value: "catalog[1].group[22].group[3].group[12].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1013_smt name: statement prose: The effective range of wireless communications outside an organisation’s area of control is limited by implementing RF shielding on facilities in which SECRET or TOP SECRET wireless networks are used. - title: Service continuity for online services props: - name: sort-id value: "catalog[1].group[22].group[4]" parts: - name: overview prose: |- # Further information Further information on cyber supply chain risk management can be found in the ‘Cyber supply chain risk management’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on the use of cloud service providers can be found in the ‘Managed services and cloud services’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on business continuity and disaster recovery planning can be found in the ‘Chief information security officer’ section of the [Guidelines for cyber security roles](#626dab35-81ab-45fe-8c12-0faff1c23c07). Further information on mitigating denial-of-service attacks can be found in ASD’s [Preparing for and responding to denial-of-service attacks](#c54cc4db-22f4-4d10-8977-2ce62b647bd2) publication. groups: - title: Cloud-based hosting of online services props: - name: sort-id value: "catalog[1].group[22].group[4].group[1]" parts: - name: overview prose: "Using cloud service providers can enable an organisation to build highly resilient online services due to the increased computing resources, bandwidth and multiple separate physical sites made available by cloud service providers. An organisation can attempt to achieve the same results using their own infrastructure; however, doing so may require significant upfront costs and may still result in a limited capability to scale resources dynamically to meet genuine spikes in demand. In cases of denial-of-service attacks, cloud-based hosting can also provide segregation from self-hosted or other cloud-hosted services ensuring that other systems, such as email, are not affected." controls: - id: ism-1437 class: ISM-control title: "Control: ism-1437" props: - name: sort-id value: "catalog[1].group[22].group[4].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1437_smt name: statement prose: Cloud service providers are used for hosting online services. - title: Capacity and availability planning and monitoring for online services props: - name: sort-id value: "catalog[1].group[22].group[4].group[2]" parts: - name: overview prose: |- It is important that connectivity between an organisation and their cloud service providers meets requirements for bandwidth, latency and availability. In support of this, an organisation and their cloud service providers should discuss the ability to scale resources dynamically in response to genuine spikes in demand. This should include any authorised activities that can be undertaken to verify measures implemented to support such requirements, especially where high availability is required. For example, an organisation and their cloud service providers may discuss whether dedicated communication links or internet connections will be used, and whether secondary communications links will provide sufficient capacity to maintain operational requirements if the primary communication link becomes unavailable. Furthermore, capacity and availability monitoring should be performed to manage workloads and monitor the health of online services. This can be achieved through continuous real-time monitoring of metrics, such as latency, jitter, packet loss, throughput and availability. In addition, feedback should be provided to cloud service providers when performance does not meet service level agreement targets. To assist with this, anomaly detection can be performed through network telemetry that is integrated into security monitoring tools. controls: - id: ism-1579 class: ISM-control title: "Control: ism-1579" props: - name: sort-id value: "catalog[1].group[22].group[4].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1579_smt name: statement prose: Cloud service providers’ ability to scale resources dynamically in response to genuine spikes in demand is discussed and verified as part of capacity and availability planning for online services. - id: ism-1580 class: ISM-control title: "Control: ism-1580" props: - name: sort-id value: "catalog[1].group[22].group[4].group[2].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1580_smt name: statement prose: "Where a high availability requirement exists for online services, the services are architected to automatically transition between availability zones." - id: ism-1581 class: ISM-control title: "Control: ism-1581" props: - name: sort-id value: "catalog[1].group[22].group[4].group[2].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1581_smt name: statement prose: Continuous real-time monitoring of the capacity and availability of online services is performed. - title: Using content delivery networks props: - name: sort-id value: "catalog[1].group[22].group[4].group[3]" parts: - name: overview prose: |- Similar to cloud-based hosting, the use of content delivery networks (CDNs) can allow an organisation to create highly resilient online services by leveraging the large bandwidth, geographically dispersed hosting locations, traffic scrubbing and other security controls offered by CDNs. The use of CDNs is particularly effective when serving static bandwidth intensive media, such as images, sound or video files. However, the services offered by CDNs can include more than basic content hosting, such as web response caching, load balancing, web application security and denial-of-service attack mitigations. In using CDNs, care should be taken with their configuration to ensure that the IP addresses of an organisation’s web servers (referred to as origin servers) are not identifiable by malicious actors, as knowledge of origin server IP addresses could allow for protections provided by CDNs to be bypassed. Additionally, appropriate security controls should be applied to only enable communication between origin servers, CDNs and authorised management networks. controls: - id: ism-1438 class: ISM-control title: "Control: ism-1438" props: - name: sort-id value: "catalog[1].group[22].group[4].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1438_smt name: statement prose: "Where a high availability requirement exists for website hosting, CDNs that cache websites are used." - id: ism-1439 class: ISM-control title: "Control: ism-1439" props: - name: sort-id value: "catalog[1].group[22].group[4].group[3].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1439_smt name: statement prose: "If using CDNs, disclosing the IP addresses of web servers under an organisation’s control (referred to as origin servers) is avoided and access to the origin servers is restricted to the CDNs and authorised management networks." - title: Denial-of-service attack mitigation strategies props: - name: sort-id value: "catalog[1].group[22].group[4].group[4]" parts: - name: overview prose: |- Denial-of-service attacks are designed to disrupt or degrade online services, such as website, email and Domain Name System services. To achieve this goal, malicious actors may use multiple methods to deny access to legitimate users of online services. This includes using multiple computers to direct a large volume of unwanted network traffic at online services to consume all available network bandwidth, using multiple computers to direct tailored network traffic at online services to consume all processing resources, or hijacking online services to redirect legitimate users away from those services to other services that malicious actors control. As an organisation often cannot avoid being targeted by denial-of-service attacks, they should discuss with their cloud service providers any denial-of-service attack detection and monitoring services that may be available for their use. For example, reporting dashboards that provide out-of-band and real-time alerts based on organisation-defined notification thresholds. Furthermore, an organisation should discuss with their cloud service providers what mitigation strategies they can implement to prepare for, and reduce the impact of, being targeted by a denial-of-service attack. Finally, with the express consent of their cloud service providers, an organisation may seek to test the effectiveness of any denial-of-service attack mitigation strategies that have been implemented. Overall, preparing for denial-of-service attacks before they occur, such as by identifying critical online services and implementing preventative denial-of-service attack mitigation strategies, is by far the best approach as it is very difficult to respond to denial-of-service attacks once they begin and efforts at that stage are unlikely to be effective. controls: - id: ism-1431 class: ISM-control title: "Control: ism-1431" props: - name: sort-id value: "catalog[1].group[22].group[4].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1431_smt name: statement prose: |- Denial-of-service attack mitigation strategies are discussed with cloud service providers, specifically: - their capacity to withstand denial-of-service attacks - costs likely to be incurred as a result of denial-of-service attacks - availability monitoring and thresholds for notification of denial-of-service attacks - thresholds for turning off any online services or functionality during denial-of-service attacks - pre-approved actions that can be undertaken during denial-of-service attacks - any arrangements with upstream service providers to block malicious network traffic as far upstream as possible. - id: ism-1436 class: ISM-control title: "Control: ism-1436" props: - name: sort-id value: "catalog[1].group[22].group[4].group[4].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1436_smt name: statement prose: Critical online services are segregated from other online services that are more likely to be targeted as part of denial-of-service attacks. - id: ism-1432 class: ISM-control title: "Control: ism-1432" props: - name: sort-id value: "catalog[1].group[22].group[4].group[4].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1432_smt name: statement prose: Domain names for online services are protected via registrar locking and confirming that domain registration details are correct. - title: Guidelines for cryptography props: - name: sort-id value: "catalog[1].group[23]" groups: - title: Cryptographic fundamentals props: - name: sort-id value: "catalog[1].group[23].group[1]" parts: - name: overview prose: |- # Context The purpose of cryptography is to provide confidentiality, integrity, authentication and non-repudiation of data. In doing so, confidentiality protects data by making it unreadable to all but authorised entities, integrity protects data from accidental or deliberate manipulation by entities, authentication ensures that an entity is who they claim to be, and non-repudiation provides proof that an entity performed a particular action. In employing cryptography, data at rest can be encrypted to protect sensitive or classified data stored on information technology (IT) equipment and media. Similarly, data in transit can be encrypted to protect sensitive or classified data communicated over public network infrastructure. However, while cryptography can protect data at rest and in transit, it does not reduce the sensitivity or classification of the data; it only reduces the immediate consequences of the data being accessed by malicious actors. # Further information Further information on the design and validation of hardware and software cryptographic modules can be found in International Organization for Standardization (ISO)/International Electrotechnical Commission (IEC) 19790:2025, [Information security, cybersecurity and privacy protection – Security requirements for cryptographic modules](#a07c439d-b2f4-4ee2-b56e-f17000f3722f) and ISO/IEC 24759:2025, [Information security, cybersecurity and privacy protection – Test requirements for cryptographic modules](#aaf83df2-02e3-4f9f-bdf5-33fbff42842d). Further information on United States standards based upon earlier versions of ISO/IEC 19790 and ISO/IEC 24759 can be found in FIPS 140-3, [Security Requirements for Cryptographic Modules](#32c8fa3a-45bb-4f88-baee-73a7696aa2ad) and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-140, [FIPS 140-3 Derived Test Requirements (DTR): CMVP Validation Authority Updates to ISO/IEC 24759](#197db872-c6a9-4b29-9888-1552e908252c). Further information on cryptographic key management practices can be found in ASD’s [Managing cryptographic keys and secrets](#58589044-8b34-4d46-bf70-103ee8d10bc9) publication. Further information on cryptographic key management practices for HACE is available from ASD. Further information on general cryptographic key management practices can be found in NIST SP 800-57 Part 1 Rev. 5, [Recommendation for Key Management: Part 1 – General](#ffc8a1f6-f4e3-4ff5-a7f9-f41f766274eb). Further information on cyber supply chain risk management can be found in the ‘Cyber supply chain risk management’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on evaluated products can be found in the ‘Evaluated product procurement’ section of the [Guidelines for evaluated products](#a699a3aa-828d-479b-b50b-98127bb19437). Further information on the evaluation of cryptographic modules, including testing requirements, is available as part of the [Cryptographic Module Validation Program](#28cd91d2-e5cb-4896-bcfc-abb32e05e61d) which is jointly operated by NIST and the Canadian Centre for Cyber Security. Further information on the evaluation of the implementation of cryptographic algorithms, including testing requirements, is available as part of the [Cryptographic Algorithm Validation Program](#42e7d99d-9709-4355-a54d-98959c552aa1) which is jointly operated by NIST and the Canadian Centre for Cyber Security. Further information on the protection of IT equipment and media can be found in the Department of Home Affairs’ [Protective Security Policy Framework](#92679127-f61d-486a-a93e-df2a26dfb07a). groups: - title: Communications security doctrine props: - name: sort-id value: "catalog[1].group[23].group[1].group[1]" parts: - name: overview prose: "The Australian Signals Directorate (ASD) specifies additional communications security requirements in Australian Communications Security Instructions and ASD Broadcasts that must be complied with when operating High Assurance Cryptographic Equipment (HACE). Such requirements supplement these guidelines and, where conflicts occur, take precedence." controls: - id: ism-0499 class: ISM-control title: "Control: ism-0499" props: - name: sort-id value: "catalog[1].group[23].group[1].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "12" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0499_smt name: statement prose: Communications security doctrine and policy produced by ASD for the management and operation of HACE is complied with. - title: High Assurance Cryptographic Equipment props: - name: sort-id value: "catalog[1].group[23].group[1].group[2]" parts: - name: overview prose: "To ensure interoperability and maintain trust, all HACE must be issued an Approval for Use by ASD and be operated in accordance with the latest version of their associated Australian Communications Security Instructions." controls: - id: ism-1802 class: ISM-control title: "Control: ism-1802" props: - name: sort-id value: "catalog[1].group[23].group[1].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1802_smt name: statement prose: HACE are issued an Approval for Use by ASD and operated in accordance with the latest version of their associated Australian Communications Security Instructions. - title: Cryptographic key management processes and procedures props: - name: sort-id value: "catalog[1].group[23].group[1].group[3]" parts: - name: overview prose: "Well-documented cryptographic key management processes and procedures can assist in the secure use and management of cryptographic keys and associated hardware and software. In doing so, cryptographic key management processes and procedures should cover cryptographic key generation, registration, distribution, installation, usage, protection, storage, access, recovery and destruction." controls: - id: ism-0507 class: ISM-control title: "Control: ism-0507" props: - name: sort-id value: "catalog[1].group[23].group[1].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0507_smt name: statement prose: "Cryptographic key management processes, and supporting cryptographic key management procedures, are developed, implemented and maintained." - title: Cryptographic implementation assurance props: - name: sort-id value: "catalog[1].group[23].group[1].group[4]" parts: - name: overview prose: |- Securely implementing cryptographic algorithms and protocols is a difficult task that requires expertise and diligence. In doing so, suppliers, and their cyber supply chains, need to carry out their duties competently and honestly as small flaws in cryptographic equipment, applications or libraries can be catastrophic and difficult to detect. Therefore, to provide a degree of cryptographic implementation assurance, cryptographic equipment, applications and libraries should be assessed by one of the following processes, listed in order of preference: - a Common Criteria evaluation against an ASD-endorsed Protection Profile - a Federal Information Processing Standard (FIPS) 140-3 cryptographic evaluation via the United States and Canada’s Cryptographic Module Validation Program - a cryptographic evaluation via the United States and Canada’s Cryptographic Algorithm Validation Program - a Common Criteria evaluation against an Evaluation Assurance Level - an independent security review by a reputable process or body. Where a suitable Common Criteria evaluated product does not exist, an alternate product capable of securely implementing ASD-Approved Cryptographic Algorithms (AACAs) and ASD-Approved Cryptographic Protocols (AACPs) may be used. However, cyber supply chain security risks still need to be considered to ensure the product does not present a high risk. For example, an organisation should still follow robust and secure procurement processes by selecting a product from a supplier with: - a history of undertaking Common Criteria evaluations for their other products - a demonstrated commitment to the security of their products and services, including by adopting Secure by Design principles and practices, responsively resolving known vulnerabilities, and providing clear end of life advice for consumers - a demonstrated commitment to transparency for their products - a strong track record of maintaining the security of their own systems - sufficient information on how to securely configure their products. controls: - id: ism-0457 class: ISM-control title: "Control: ism-0457" props: - name: sort-id value: "catalog[1].group[23].group[1].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "11" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P parts: - id: ism-0457_smt name: statement prose: "Cryptographic equipment, applications or libraries that have completed a Common Criteria evaluation against an ASD-endorsed Protection Profile are used when encrypting media that contains OFFICIAL: Sensitive or PROTECTED data." - id: ism-0460 class: ISM-control title: "Control: ism-0460" props: - name: sort-id value: "catalog[1].group[23].group[1].group[4].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "13" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0460_smt name: statement prose: HACE is used when encrypting media that contains SECRET or TOP SECRET data. - id: ism-0465 class: ISM-control title: "Control: ism-0465" props: - name: sort-id value: "catalog[1].group[23].group[1].group[4].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "11" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P parts: - id: ism-0465_smt name: statement prose: "Cryptographic equipment, applications or libraries that have completed a Common Criteria evaluation against an ASD-endorsed Protection Profile are used to protect OFFICIAL: Sensitive or PROTECTED data when communicated over insufficiently secure networks, outside of appropriately secure areas or via public network infrastructure." - id: ism-0467 class: ISM-control title: "Control: ism-0467" props: - name: sort-id value: "catalog[1].group[23].group[1].group[4].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "12" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0467_smt name: statement prose: "HACE is used to protect SECRET and TOP SECRET data when communicated over insufficiently secure networks, outside of appropriately secure areas or via public network infrastructure." - title: Data recovery props: - name: sort-id value: "catalog[1].group[23].group[1].group[5]" parts: - name: overview prose: "To ensure that access to encrypted data is not lost due to the loss, damage or failure of an encryption key, it is important that where practical cryptographic equipment, applications and libraries provide a means of data recovery." controls: - id: ism-0455 class: ISM-control title: "Control: ism-0455" props: - name: sort-id value: "catalog[1].group[23].group[1].group[5].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0455_smt name: statement prose: "Where practical, cryptographic equipment, applications and libraries provide a means of data recovery to allow for circumstances where the encryption key is unavailable due to loss, damage or failure." - title: Handling encrypted IT equipment and media props: - name: sort-id value: "catalog[1].group[23].group[1].group[6]" parts: - name: overview prose: "When a user authenticates to the encryption functionality of IT equipment or media, encrypted data is made available. At such a time, the IT equipment or media should be handled according to its original sensitivity or classification. Once the user deauthenticates from the encryption functionality, such as by locking encrypted media, shutting down a device or activating a lock screen, the IT equipment or media can be considered protected by the encryption functionality again." controls: - id: ism-0462 class: ISM-control title: "Control: ism-0462" props: - name: sort-id value: "catalog[1].group[23].group[1].group[6].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0462_smt name: statement prose: "When a user authenticates to the encryption functionality of IT equipment or media, it is treated in accordance with its original sensitivity or classification until the user deauthenticates from the encryption functionality." - title: Transporting cryptographic equipment props: - name: sort-id value: "catalog[1].group[23].group[1].group[7]" parts: - name: overview prose: "Transporting cryptographic equipment in a keyed state may expose its keying material to potential compromise. Therefore, if cryptographic equipment is transported in a keyed state, it should be done based on the sensitivity or classification of its keying material." controls: - id: ism-0501 class: ISM-control title: "Control: ism-0501" props: - name: sort-id value: "catalog[1].group[23].group[1].group[7].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0501_smt name: statement prose: Keyed cryptographic equipment is transported based on the sensitivity or classification of its keying material. - title: Reporting cryptographic-related cyber security incidents props: - name: sort-id value: "catalog[1].group[23].group[1].group[8]" parts: - name: overview prose: "If cryptographic equipment or associated keying material is compromised, or suspected of being compromised, then the confidentiality and integrity of previous and future communications may also be compromised. In such cases, the cyber security incident should be reported to the chief information security officer, or one of their delegates, as soon as possible after it occurs, and all keying material should be changed." controls: - id: ism-0142 class: ISM-control title: "Control: ism-0142" props: - name: sort-id value: "catalog[1].group[23].group[1].group[8].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0142_smt name: statement prose: "The compromise or suspected compromise of cryptographic equipment or associated keying material is reported to the chief information security officer, or one of their delegates, as soon as possible after it occurs." - id: ism-1091 class: ISM-control title: "Control: ism-1091" props: - name: sort-id value: "catalog[1].group[23].group[1].group[8].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1091_smt name: statement prose: Keying material is changed when compromised or suspected of being compromised. - title: Cryptographic algorithms props: - name: sort-id value: "catalog[1].group[23].group[2]" parts: - name: overview prose: |- # Context There is no guarantee of a cryptographic algorithm’s resistance to currently unknown attacks. However, the cryptographic algorithms listed in this section have been extensively scrutinised by industry and academic communities in a practical and theoretical setting. Approval for the use of the cryptographic algorithms listed in this section is limited to cases where they are implemented in accordance with these guidelines. The approved asymmetric cryptographic algorithms are: - Diffie-Hellman (DH) for agreeing on encryption session keys - Elliptic Curve Diffie-Hellman (ECDH) for agreeing on encryption session keys - Elliptic Curve Digital Signature Algorithm (ECDSA) for digital signatures - Module-Lattice-Based Digital Signature Algorithm (ML-DSA) for digital signatures - Module-Lattice-Based Key Encapsulation Mechanism (ML-KEM) for encapsulating encryption session keys (and similar keys) - Rivest-Shamir-Adleman (RSA) for digital signatures and transporting encryption session keys (and similar keys). The only approved hashing algorithm for general-purpose use is Secure Hashing Algorithm 2 (SHA-2). However, Secure Hashing Algorithm 3 (SHA-3), including its extendable-output functions, is approved exclusively for use within ML-DSA and ML-KEM. The only approved symmetric cryptographic algorithm is Advanced Encryption Standard (AES). Where there is a range of key sizes for a cryptographic algorithm, some key sizes are not approved as they are insecure against current attacks or do not provide an adequate safety margin against possible future attacks. For example, advances in integer factorisation methods have rendered some RSA moduli sizes vulnerable and could render other RSA moduli vulnerable in the future. The minimum targets used for the effective security strength of cryptographic algorithms listed within this section are: - 112 bits for non-classified data - 112 bits for OFFICIAL: Sensitive data - 112 bits for PROTECTED data - 128 bits for SECRET data - 192 bits for TOP SECRET data. Certain key sizes and parameters, such as specific elliptic curves, are preferred to promote interoperability with the United States’ National Security Agency’s [Commercial National Security Algorithm Suite 2.0](#e8a28fa5-4ea1-4ef5-a870-4d59e40fab37). High assurance cryptographic algorithms, which are not covered in this section, can be used for the protection of SECRET and TOP SECRET data if they are suitably implemented in HACE. Further information on high assurance cryptographic algorithms can be obtained from ASD. # Further information Further information on planning for the transition to post-quantum cryptography can be found in ASD’s [Planning for post-quantum cryptography](#0b1a477d-b08a-4491-9cfc-c9d435b28dc8) and [Post-quantum questions to ask your vendors](#905f3bc8-e4ae-4532-9873-2d1430cabc48) publications. Further information on post-quantum traditional hybrid schemes can be found in the United Kingdom’s National Cyber Security Centre’s [Next steps in preparing for post-quantum cryptography](#b54cf0d1-d275-426e-98aa-9c678b9d55a5) guidance. Further information on how to combine the different components of a post-quantum traditional hybrid scheme used for key encapsulation can be found in NIST SP 800-56C Rev. 2, [Recommendation for Key-Derivation Methods in Key-Establishment Schemes](#a75de67b-9502-47e9-b48b-5e2a45d528e1). This publication does not pertain to post-quantum traditional hybrid schemes used for digital signatures. groups: - title: Using cryptographic algorithms props: - name: sort-id value: "catalog[1].group[23].group[2].group[01]" parts: - name: overview prose: "When encryption is applied to data at rest, it provides an additional layer of defence against unauthorised access by malicious actors. In doing so, it is critical that an AACA or high assurance cryptographic algorithm is used. Furthermore, if cryptographic equipment, applications or libraries implement unapproved cryptographic algorithms, it is possible that these cryptographic algorithms could be used without a human user’s knowledge. In combination with an assumed level of security confidence, this can represent a security risk. As such, an organisation should ensure that only AACAs or high assurance cryptographic algorithms can be used by disabling all unapproved cryptographic algorithms (preferred) or by advising human users not to use the unapproved cryptographic algorithms via usage policies." controls: - id: ism-1080 class: ISM-control title: "Control: ism-1080" props: - name: sort-id value: "catalog[1].group[23].group[2].group[01].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1080_smt name: statement prose: An AACA or high assurance cryptographic algorithm is used when encrypting data at rest. - id: ism-0471 class: ISM-control title: "Control: ism-0471" props: - name: sort-id value: "catalog[1].group[23].group[2].group[01].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "9" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0471_smt name: statement prose: "Only AACAs or high assurance cryptographic algorithms are used by cryptographic equipment, applications and libraries." - title: Asymmetric cryptographic algorithms props: - name: sort-id value: "catalog[1].group[23].group[2].group[02]" parts: - name: overview prose: "ECDH is vulnerable to different types of attacks than DH. Consequently, ECDH offers more effective security per bit increase in key size than DH. This leads to smaller data requirements, which in turn means that the elliptic curve variants have become de facto global standards. For reduced data cost, and to promote interoperability, ECDH should be used in preference to DH where possible." controls: - id: ism-0994 class: ISM-control title: "Control: ism-0994" props: - name: sort-id value: "catalog[1].group[23].group[2].group[02].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0994_smt name: statement prose: ECDH is used in preference to DH. - title: Using Diffie-Hellman props: - name: sort-id value: "catalog[1].group[23].group[2].group[03]" parts: - name: overview prose: |- A modulus of 2048 bits for correctly implemented DH provides 112 bits of effective security strength, with larger modulus sizes providing more bits of effective security strength. When DH in a prime field is used, the prime modulus impacts the security of the cryptographic algorithm. The security considerations when creating such a prime modulus can be found in NIST SP 800-56A Rev. 3, along with a collection of commonly used secure moduli. Taking into account projected technological advances in quantum computing, DH will not be approved beyond 2030. controls: - id: ism-0472 class: ISM-control title: "Control: ism-0472" props: - name: sort-id value: "catalog[1].group[23].group[2].group[03].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P parts: - id: ism-0472_smt name: statement prose: "When using DH for agreeing on encryption session keys, a modulus of at least 2048 bits is used, preferably 3072 bits." - id: ism-1759 class: ISM-control title: "Control: ism-1759" props: - name: sort-id value: "catalog[1].group[23].group[2].group[03].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1759_smt name: statement prose: "When using DH for agreeing on encryption session keys, a modulus of at least 3072 bits is used, preferably 3072 bits." - id: ism-1629 class: ISM-control title: "Control: ism-1629" props: - name: sort-id value: "catalog[1].group[23].group[2].group[03].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1629_smt name: statement prose: "When using DH for agreeing on encryption session keys, a modulus and associated parameters are selected according to NIST SP 800-56A Rev. 3." - title: Using Elliptic Curve Cryptography props: - name: sort-id value: "catalog[1].group[23].group[2].group[04]" parts: - name: overview prose: "The curve used within an elliptic curve cryptographic algorithm impacts the security of the cryptographic algorithm. As such, only suitable curves from NIST SP 800-186 should be used." controls: - id: ism-1446 class: ISM-control title: "Control: ism-1446" props: - name: sort-id value: "catalog[1].group[23].group[2].group[04].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1446_smt name: statement prose: "When using elliptic curve cryptography, a suitable curve from NIST SP 800-186 is used." - title: Using Elliptic Curve Diffie-Hellman props: - name: sort-id value: "catalog[1].group[23].group[2].group[05]" parts: - name: overview prose: |- When identifying a suitable curve from NIST SP 800-186, a base point order and key size of at least 224 bits for correctly implemented ECDH provides 112 bits of effective security strength, with larger key sizes providing more bits of effective security strength. Security of a curve selected from another source cannot be assumed to have the same security using base point order and key size alone. Taking into account projected technological advances in quantum computing, ECDH will not be approved beyond 2030. controls: - id: ism-0474 class: ISM-control title: "Control: ism-0474" props: - name: sort-id value: "catalog[1].group[23].group[2].group[05].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P parts: - id: ism-0474_smt name: statement prose: "When using ECDH for agreeing on encryption session keys, a base point order and key size of at least 224 bits is used, preferably the NIST P-384 curve." - id: ism-1761 class: ISM-control title: "Control: ism-1761" props: - name: sort-id value: "catalog[1].group[23].group[2].group[05].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S parts: - id: ism-1761_smt name: statement prose: "When using ECDH for agreeing on encryption session keys, NIST P-256, P-384 or P-521 curves are used, preferably the NIST P-384 curve." - id: ism-1762 class: ISM-control title: "Control: ism-1762" props: - name: sort-id value: "catalog[1].group[23].group[2].group[05].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1762_smt name: statement prose: "When using ECDH for agreeing on encryption session keys, NIST P-384 or P-521 curves are used, preferably the NIST P-384 curve." - title: Using the Elliptic Curve Digital Signature Algorithm props: - name: sort-id value: "catalog[1].group[23].group[2].group[06]" parts: - name: overview prose: |- When identifying a suitable curve from NIST SP 800-186, a base point order and key size of 224 bits for correctly implemented ECDSA provides 112 bits of effective security strength, with larger key sizes providing more bits of effective security strength. Security of a curve selected from another source cannot be assumed to have the same security using base point order and key size alone. Taking into account projected technological advances in quantum computing, ECDSA will not be approved beyond 2030. controls: - id: ism-0475 class: ISM-control title: "Control: ism-0475" props: - name: sort-id value: "catalog[1].group[23].group[2].group[06].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P parts: - id: ism-0475_smt name: statement prose: "When using ECDSA for digital signatures, a base point order and key size of at least 224 bits is used, preferably the P-384 curve." - id: ism-1763 class: ISM-control title: "Control: ism-1763" props: - name: sort-id value: "catalog[1].group[23].group[2].group[06].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S parts: - id: ism-1763_smt name: statement prose: "When using ECDSA for digital signatures, NIST P-256, P-384 or P-521 curves are used, preferably the NIST P-384 curve." - id: ism-1764 class: ISM-control title: "Control: ism-1764" props: - name: sort-id value: "catalog[1].group[23].group[2].group[06].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1764_smt name: statement prose: "When using ECDSA for digital signatures, NIST P-384 or P-521 curves are used, preferably the NIST P-384 curve." - title: Using post-quantum cryptographic algorithms props: - name: sort-id value: "catalog[1].group[23].group[2].group[07]" parts: - name: overview prose: "Post-quantum cryptographic algorithms are more complex than their traditional counterparts. To reduce the risk that vulnerabilities are introduced via implementation errors, approval is given to specific post-quantum cryptographic standards. In doing so, FIPS 204 and FIPS 203 state that other foundational standards must also be adhered to, including the required use of FIPS 140-3 validated cryptographic modules. However, while the use of FIPS 140-3 validated modules is preferred, it is not required." controls: - id: ism-1990 class: ISM-control title: "Control: ism-1990" props: - name: sort-id value: "catalog[1].group[23].group[2].group[07].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1990_smt name: statement prose: "When using ML-DSA and ML-KEM, as per FIPS 204 and FIPS 203 respectively, adherence to pre-requisite FIPS 140-3 validation is preferred." - title: Using the Module-Lattice-Based Digital Signature Algorithm props: - name: sort-id value: "catalog[1].group[23].group[2].group[08]" parts: - name: overview prose: |- The effective security strength of ML-DSA has a complex dependency on numerous parameters with different effective security strengths targeted by different standardised parameter sets. The ML-DSA standard contains three different parameter sets: ML-DSA-44, ML-DSA-65 and ML-DSA-87. The use of ML-DSA-65 and ML-DSA-87 are approved. When using ML-DSA for digital signing, it may be either hedged or deterministic, with the hedged variant providing effective protection from certain side-channel attacks that apply to the deterministic variant. For this reason, the hedged variant should be used whenever possible. The deterministic variant should not be used unless the nature of the digital signing platform renders the creation of random data infeasible, which is a mandatory step for the hedged variant. When using ML-DSA for digital signing, signing a message first involves hashing the message using SHAKE128 or SHAKE256. In environments where the message being hashed is large, and the digital signing platform lacks hardware support for SHAKE128 and SHAKE256, pre-hashed variants of ML-DSA might be used to reduce computational overheads. In such cases, pre-hashed variants of ML-DSA take as their input a hash of the message as computed by an alternative, and less computationally expensive, hashing algorithm. In such cases, care should be taken to ensure that an appropriate alternative hashing algorithm is being used, such as a SHA-2 hashing algorithm. In such cases, the hash used should be twice as long as the desired effective security strength. In practice, this requires the use of at least SHA-384 for the pre-hashed variant of ML-DSA-65 and at the use of at least SHA-512 for the pre-hashed variant of ML-DSA-87. For interoperability and maintainability reasons, ML-DSA-65 will not be approved beyond 2030. controls: - id: ism-1991 class: ISM-control title: "Control: ism-1991" props: - name: sort-id value: "catalog[1].group[23].group[2].group[08].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1991_smt name: statement prose: "When using ML-DSA for digital signatures, ML-DSA-65 or ML-DSA-87 is used, preferably ML-DSA-87." - id: ism-1992 class: ISM-control title: "Control: ism-1992" props: - name: sort-id value: "catalog[1].group[23].group[2].group[08].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1992_smt name: statement prose: "When using ML-DSA for digital signatures, the hedged variant is used whenever possible." - id: ism-1993 class: ISM-control title: "Control: ism-1993" props: - name: sort-id value: "catalog[1].group[23].group[2].group[08].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1993_smt name: statement prose: Pre-hashed variants of ML-DSA-65 and ML-DSA-87 are only used when the performance of default variants is unacceptable. - id: ism-1994 class: ISM-control title: "Control: ism-1994" props: - name: sort-id value: "catalog[1].group[23].group[2].group[08].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1994_smt name: statement prose: "When the pre-hashed variants of ML-DSA-65 and ML-DSA-87 are used, at least SHA-384 and SHA-512 respectively are used for pre-hashing." - title: Using the Module-Lattice-Based Key Encapsulation Mechanism props: - name: sort-id value: "catalog[1].group[23].group[2].group[09]" parts: - name: overview prose: |- The effective security strength of ML-KEM has a complex dependency on numerous parameters with different effective security strengths targeted by different standardised parameter sets. The ML-KEM standard contains three different parameter sets: ML-KEM-512, ML-KEM-768 and ML-KEM-1024. The use of ML-KEM-768 and ML-KEM-1024 are approved. For interoperability and maintainability reasons, ML-KEM-768 will not be approved beyond 2030. controls: - id: ism-1995 class: ISM-control title: "Control: ism-1995" props: - name: sort-id value: "catalog[1].group[23].group[2].group[09].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1995_smt name: statement prose: "When using ML-KEM for encapsulating encryption session keys (and similar keys), ML-KEM-768 or ML-KEM-1024 is used, preferably ML-KEM-1024." - title: Using Rivest-Shamir-Adleman props: - name: sort-id value: "catalog[1].group[23].group[2].group[10]" parts: - name: overview prose: |- A modulus of 2048 bits for correctly implemented RSA provides 112 bits of effective security strength, with larger modulus sizes providing more bits of effective security strength. Taking into account projected technological advances in quantum computing, RSA will not be approved beyond 2030. controls: - id: ism-0476 class: ISM-control title: "Control: ism-0476" props: - name: sort-id value: "catalog[1].group[23].group[2].group[10].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P parts: - id: ism-0476_smt name: statement prose: "When using RSA for digital signatures, and transporting encryption session keys (and similar keys), a modulus of at least 2048 bits is used, preferably 3072 bits." - id: ism-1765 class: ISM-control title: "Control: ism-1765" props: - name: sort-id value: "catalog[1].group[23].group[2].group[10].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1765_smt name: statement prose: "When using RSA for digital signatures, and transporting encryption session keys (and similar keys), a modulus of at least 3072 bits is used, preferably 3072 bits." - id: ism-0477 class: ISM-control title: "Control: ism-0477" props: - name: sort-id value: "catalog[1].group[23].group[2].group[10].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "9" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0477_smt name: statement prose: "When using RSA for digital signatures, and for transporting encryption session keys (and similar keys), a different key pair is used for digital signatures and transporting encryption session keys." - title: Using Secure Hashing Algorithms props: - name: sort-id value: "catalog[1].group[23].group[2].group[11]" parts: - name: overview prose: |- For most purposes, a hashing algorithm with an output size of 224 bits provides 112 bits of effective security strength, with larger output sizes providing more bits of effective security strength. Only SHA-2 hashing algorithms are approved for general-purpose use. Approval of SHA-3 and extendable-output functions (i.e. SHA3-256, SHA3-512, SHAKE128 and SHAKE256) is restricted to use within internal steps of ML-DSA and ML-KEM. For interoperability and maintainability reasons, SHA-224 and SHA-256 will not be approved beyond 2030. controls: - id: ism-1766 class: ISM-control title: "Control: ism-1766" props: - name: sort-id value: "catalog[1].group[23].group[2].group[11].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P parts: - id: ism-1766_smt name: statement prose: "When using SHA-2 for hashing, an output size of at least 224 bits is used, preferably SHA-384 or SHA-512." - id: ism-1767 class: ISM-control title: "Control: ism-1767" props: - name: sort-id value: "catalog[1].group[23].group[2].group[11].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S parts: - id: ism-1767_smt name: statement prose: "When using SHA-2 for hashing, an output size of at least 256 bits is used, preferably SHA-384 or SHA-512." - id: ism-1768 class: ISM-control title: "Control: ism-1768" props: - name: sort-id value: "catalog[1].group[23].group[2].group[11].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1768_smt name: statement prose: "When using SHA-2 for hashing, an output size of at least 384 bits is used, preferably SHA-384 or SHA-512." - title: Using symmetric cryptographic algorithms props: - name: sort-id value: "catalog[1].group[23].group[2].group[12]" parts: - name: overview prose: |- When using AES, a key size of 128 bits provides 128 bits of effective security strength, with larger key sizes providing more bits of effective security strength. The use of Electronic Codebook Mode with block ciphers allows repeated patterns in plaintext to appear as repeated patterns in ciphertext. Most plaintext, including written language and formatted files, contains significant repeated patterns. As such, malicious actors can use this to deduce possible meanings of ciphertext. The use of other modes, such as Cipher Block Chaining, Cipher Feedback, Galois/Counter Mode or Output Feedback, can prevent such attacks, although each has different properties that can make them inappropriate for certain use cases. AES is the only approved symmetric cryptographic algorithm. For interoperability and maintainability reasons, AES-128 and AES-192 will not be approved beyond 2030. controls: - id: ism-1769 class: ISM-control title: "Control: ism-1769" props: - name: sort-id value: "catalog[1].group[23].group[2].group[12].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S parts: - id: ism-1769_smt name: statement prose: "When using AES for encryption, AES-128, AES-192 or AES-256 is used, preferably AES-256." - id: ism-1770 class: ISM-control title: "Control: ism-1770" props: - name: sort-id value: "catalog[1].group[23].group[2].group[12].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1770_smt name: statement prose: "When using AES for encryption, AES-192 or AES-256 is used, preferably AES-256." - id: ism-0479 class: ISM-control title: "Control: ism-0479" props: - name: sort-id value: "catalog[1].group[23].group[2].group[12].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-21 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0479_smt name: statement prose: Symmetric cryptographic algorithms are not used in Electronic Codebook Mode. - title: Transitioning to post-quantum cryptography props: - name: sort-id value: "catalog[1].group[23].group[2].group[13]" parts: - name: overview prose: |- The consensus model for quantum computing allows for different types of quantum attacks against traditional cryptography. While the direct impact of these quantum attacks varies across different cryptographic algorithms, there is a stark difference in impact between asymmetric cryptographic algorithms and symmetric cryptographic algorithms. One known quantum attack (using Shor’s algorithm) effectively defeats all traditional cryptography that relies upon asymmetric cryptographic algorithms such as DH, ECDH, ECDSA or RSA. The efficiency of this is such that it is infeasible to securely use these AACAs in the presence of a cryptographically relevant quantum computer (CRQC). While a CRQC does not currently exist, the trajectory of technological advances in quantum computing means that these AACAs will need to be phased out in favour of alternative AACAs that offer greater protection. As such, the development or procurement of new cryptographic equipment, applications and libraries, which are intended to be used beyond 2030, should be undertaken with the goal of supporting ASD-approved post-quantum cryptographic algorithms by 2030. The impact of quantum attacks on hashing algorithms and symmetric cryptographic algorithms, such as SHA-2 and AES, is unlikely to be felt for some time. However, for interoperability reasons, the design and provision of new cryptographic equipment, applications and libraries, which are intended to be used beyond 2030, should support SHA-384, SHA-512 and AES-256. controls: - id: ism-2073 class: ISM-control title: "Control: ism-2073" props: - name: sort-id value: "catalog[1].group[23].group[2].group[13].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2073_smt name: statement prose: "A post-quantum cryptography transition plan is developed, implemented and maintained." - id: ism-1917 class: ISM-control title: "Control: ism-1917" props: - name: sort-id value: "catalog[1].group[23].group[2].group[13].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1917_smt name: statement prose: "The development and procurement of new cryptographic equipment, applications and libraries ensures support for the use of ML-DSA-87, ML-KEM-1024, SHA-384, SHA-512 and AES-256 by no later than 2030." - title: Post-quantum traditional hybrid schemes props: - name: sort-id value: "catalog[1].group[23].group[2].group[14]" parts: - name: overview prose: |- A post-quantum traditional hybrid scheme is a multi-algorithm scheme where at least one cryptographic algorithm is a post-quantum cryptographic algorithm (e.g. ML-KEM) and at least one cryptographic algorithm is a traditional cryptographic algorithm (e.g. RSA). Generally, such schemes have the advantage of the security offered by the traditional cryptographic algorithm if the post-quantum cryptographic algorithm is vulnerable to an implementation flaw or new attack. This advantage comes at the cost of increased complexity, making maintenance, analysis and secure implementation more difficult, as well as having greater computational and bandwidth overheads. The use of post-quantum traditional hybrid schemes is not recommended; however, it is not prohibited. If such schemes are to be used, at least one of the post-quantum or traditional cryptographic algorithms, or both, should be an AACA. It is important to note though, that in the presence of a CRQC, the security of such schemes is reduced to that provided by the post-quantum cryptographic algorithm. As such, there is no practical value in the use of such schemes in the presence of a CRQC. An organisation choosing to implement a post-quantum traditional hybrid scheme should also keep in mind the eventual additional cost of transitioning to a pure post-quantum scheme in the future. controls: - id: ism-1996 class: ISM-control title: "Control: ism-1996" props: - name: sort-id value: "catalog[1].group[23].group[2].group[14].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1996_smt name: statement prose: "When a post-quantum traditional hybrid scheme is used, either the post-quantum cryptographic algorithm, the traditional cryptographic algorithm or both are AACAs." - title: Cryptographic protocols props: - name: sort-id value: "catalog[1].group[23].group[3]" parts: - name: overview prose: |- # Context There is no guarantee of a cryptographic protocol’s resistance to currently unknown attacks. However, the cryptographic protocols listed in this section have been extensively scrutinised by industry and academic communities in a practical and theoretical setting. Approval for the use of the cryptographic protocols listed in this section is limited to cases where they are implemented in accordance with these guidelines. The AACPs are: - Internet Protocol Security (IPsec) - Media Access Control Security - OpenPGP Message Format - Secure Shell (SSH) - Secure/Multipurpose Internet Mail Extensions (S/MIME) - Transport Layer Security (TLS) - Wi-Fi Protected Access 2 - Wi-Fi Protected Access 3. High assurance cryptographic protocols, which are not covered in this section, can be used for the protection of SECRET and TOP SECRET data if they are suitably implemented in HACE. Further information on high assurance cryptographic protocols can be obtained from ASD. # Further information Further information on AACPs can be found in the following sections of these guidelines. Further information on the use of Media Access Control Security can be found in the ‘Wired networks’ section of the [Guidelines for networking](#f145ff5b-d396-4248-8f48-621349d6f0ed). Further information on the use of Wi-Fi Protected Access 2 and Wi-Fi Protected Access 3 can be found in the ‘Wireless networks’ section of the [Guidelines for networking](#f145ff5b-d396-4248-8f48-621349d6f0ed). groups: - title: Using cryptographic protocols props: - name: sort-id value: "catalog[1].group[23].group[3].group[1]" parts: - name: overview prose: "When encryption is applied to data in transit, it provides an additional layer of defence against unauthorised access or manipulation by malicious actors. In doing so, it is critical that an AACP or high assurance cryptographic protocol is used. Furthermore, if cryptographic equipment, applications or libraries implement unapproved cryptographic protocols, it is possible that these cryptographic protocols could be used without a human user’s knowledge. In combination with an assumed level of security confidence, this can represent a security risk. As such, an organisation should ensure that only AACPs or high assurance cryptographic protocols can be used by disabling all unapproved cryptographic protocols (preferred) or by advising human users not to use the unapproved cryptographic protocols via usage policies." controls: - id: ism-0469 class: ISM-control title: "Control: ism-0469" props: - name: sort-id value: "catalog[1].group[23].group[3].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0469_smt name: statement prose: An AACP or high assurance cryptographic protocol is used when encrypting data in transit. - id: ism-0481 class: ISM-control title: "Control: ism-0481" props: - name: sort-id value: "catalog[1].group[23].group[3].group[1].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0481_smt name: statement prose: "Only AACPs or high assurance cryptographic protocols are used by cryptographic equipment, applications and libraries." - title: Internet Protocol Security props: - name: sort-id value: "catalog[1].group[23].group[4]" parts: - name: overview prose: |- # Context When using IT equipment or applications that implement IPsec, security controls for using AACAs and AACPs in the ‘Cryptographic algorithms’ and ‘Cryptographic protocols’ sections of these guidelines will also need to be consulted. groups: - title: Mode of operation props: - name: sort-id value: "catalog[1].group[23].group[4].group[1]" parts: - name: overview prose: IPsec can be operated in tunnel mode or transport mode. The tunnel mode of operation is preferred as it provides full encapsulation of IP packets while the transport mode of operation only encapsulates the payload of IP packets. controls: - id: ism-0494 class: ISM-control title: "Control: ism-0494" props: - name: sort-id value: "catalog[1].group[23].group[4].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0494_smt name: statement prose: "Tunnel mode is used for IPsec connections; however, if using transport mode, an IP tunnel is used." - title: Protocol selection props: - name: sort-id value: "catalog[1].group[23].group[4].group[2]" parts: - name: overview prose: |- IPsec contains two major protocols, the Authentication Header (AH) protocol and the Encapsulating Security Payload (ESP) protocol. To provide a secure virtual private network style connection, authentication and encryption are needed. While the AH and ESP protocols can provide authentication, for the IP packet and the payload respectively, only the ESP protocol can provide encryption. As the combined use of the AH protocol and the ESP protocol is not supported by Internet Key Exchange (IKE) version 2, the ESP protocol should be used for authentication and encryption of IPsec connections. controls: - id: ism-0496 class: ISM-control title: "Control: ism-0496" props: - name: sort-id value: "catalog[1].group[23].group[4].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0496_smt name: statement prose: The ESP protocol is used for authentication and encryption of IPsec connections. - title: Key exchange props: - name: sort-id value: "catalog[1].group[23].group[4].group[3]" parts: - name: overview prose: "There are several methods for establishing shared keying material for IPsec connections, including manual keying and the IKE protocol. As the IKE protocol addresses several security risks associated with manual keying, it is the preferred method for key establishment. As IKE version 1 has been deprecated, IKE version 2 should be used." controls: - id: ism-1233 class: ISM-control title: "Control: ism-1233" props: - name: sort-id value: "catalog[1].group[23].group[4].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1233_smt name: statement prose: IKE version 2 is used for key exchange when establishing IPsec connections. - title: Encryption algorithms props: - name: sort-id value: "catalog[1].group[23].group[4].group[4]" parts: - name: overview prose: "The only approved encryption algorithm for IPsec connections is AES. IKE version 2 supports the use of AES with Cipher Block Chaining, Counter Mode, Counter with Cipher Block Chaining Message Authentication Code, and Galois/Counter Mode. However, supported modes may vary between different cryptographic equipment, applications and libraries." controls: - id: ism-1771 class: ISM-control title: "Control: ism-1771" props: - name: sort-id value: "catalog[1].group[23].group[4].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1771_smt name: statement prose: "AES is used for encrypting IPsec connections, preferably ENCR_AES_GCM_16." - title: Pseudorandom function props: - name: sort-id value: "catalog[1].group[23].group[4].group[5]" parts: - name: overview prose: |- IKE version 2 requires the use of a PRF to generate random data for cryptographic operations. The approved hashing algorithms that can be used for the PRF are HMAC-SHA256, HMAC-SHA384 and HMAC-SHA512. For interoperability and maintainability reasons, HMAC-SHA256 will not be approved beyond 2030. controls: - id: ism-1772 class: ISM-control title: "Control: ism-1772" props: - name: sort-id value: "catalog[1].group[23].group[4].group[5].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1772_smt name: statement prose: "PRF_HMAC_SHA2_256, PRF_HMAC_SHA2_384 or PRF_HMAC_SHA2_512 is used for IPsec connections, preferably PRF_HMAC_SHA2_512." - title: Integrity algorithms props: - name: sort-id value: "catalog[1].group[23].group[4].group[6]" parts: - name: overview prose: |- The approved integrity algorithms for IPsec connections are HMAC-SHA256, HMAC-SHA384 and HMAC-SHA512. However, if using AES with Galois/Counter Mode as the encryption algorithm, it can also be used for authentication purposes. In such cases, the integrity algorithm should be configured as NONE. For interoperability and maintainability reasons, HMAC-SHA256 will not be approved beyond 2030. controls: - id: ism-0998 class: ISM-control title: "Control: ism-0998" props: - name: sort-id value: "catalog[1].group[23].group[4].group[6].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0998_smt name: statement prose: "AUTH_HMAC_SHA2_256_128, AUTH_HMAC_SHA2_384_192, AUTH_HMAC_SHA2_512_256 or NONE (only with AES-GCM) is used for authenticating IPsec connections, preferably NONE." - title: Diffie-Hellman groups props: - name: sort-id value: "catalog[1].group[23].group[4].group[7]" parts: - name: overview prose: |- A sufficiently large DH modulus provides greater security for key exchanges when establishing IPsec connections. Taking into account projected technological advances in quantum computing, DH and ECDH will not be approved beyond 2030. controls: - id: ism-0999 class: ISM-control title: "Control: ism-0999" props: - name: sort-id value: "catalog[1].group[23].group[4].group[7].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0999_smt name: statement prose: "DH or ECDH is used for key establishment of IPsec connections, preferably 384-bit random ECP group, 3072-bit MODP Group or 4096-bit MODP Group." - title: Security association lifetimes props: - name: sort-id value: "catalog[1].group[23].group[4].group[8]" parts: - name: overview prose: Using a security association lifetime of less than four hours (14400 seconds) for IKE version 2 can provide a balance between security and usability. controls: - id: ism-0498 class: ISM-control title: "Control: ism-0498" props: - name: sort-id value: "catalog[1].group[23].group[4].group[8].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0498_smt name: statement prose: A security association lifetime of less than four hours (14400 seconds) is used for IPsec connections. - title: Perfect Forward Secrecy props: - name: sort-id value: "catalog[1].group[23].group[4].group[9]" parts: - name: overview prose: Using PFS reduces the impact of the compromise of a security association. controls: - id: ism-1000 class: ISM-control title: "Control: ism-1000" props: - name: sort-id value: "catalog[1].group[23].group[4].group[9].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1000_smt name: statement prose: PFS is used for IPsec connections. - title: Secure Shell props: - name: sort-id value: "catalog[1].group[23].group[5]" parts: - name: overview prose: |- # Context When using IT equipment or applications that implement SSH, security controls for using AACAs and AACPs in the ‘Cryptographic algorithms’ and ‘Cryptographic protocols’ sections of these guidelines will also need to be consulted. # Further information Further information on [configuring OpenSSH](#f832363c-d81e-4908-afd9-cf45047dd19c) is available from the OpenSSH project. groups: - title: Configuring Secure Shell props: - name: sort-id value: "catalog[1].group[23].group[5].group[1]" parts: - name: overview prose: |- SSH version 1 was found to have multiple vulnerabilities and was subsequently replaced by SSH version 2. As such, an organisation implementing SSH should disable the use of SSH version 1. In addition, several security risks exist when SSH is configured in an insecure manner. To mitigate these security risks, SSH should be configured as per the settings below. The settings below are based on OpenSSH. An organisation using other implementations of SSH should adapt these settings to suit their SSH implementation. controls: - id: ism-1506 class: ISM-control title: "Control: ism-1506" props: - name: sort-id value: "catalog[1].group[23].group[5].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1506_smt name: statement prose: The use of SSH version 1 is disabled for SSH connections. - id: ism-0484 class: ISM-control title: "Control: ism-0484" props: - name: sort-id value: "catalog[1].group[23].group[5].group[1].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0484_smt name: statement prose: |- The SSH daemon is configured to: - only listen on the required interfaces (ListenAddress xxx.xxx.xxx.xxx) - have a suitable login banner (Banner x) - have a login authentication timeout of no more than 60 seconds (LoginGraceTime 60) - disable host-based authentication (HostbasedAuthentication no) - disable rhosts-based authentication (IgnoreRhosts yes) - disable the ability to log in directly as root (PermitRootLogin no) - disable empty passwords (PermitEmptyPasswords no) - disable connection forwarding (AllowTCPForwarding no) - disable gateway ports (GatewayPorts no) - disable X11 forwarding (X11Forwarding no). - title: Authentication mechanisms props: - name: sort-id value: "catalog[1].group[23].group[5].group[2]" parts: - name: overview prose: "As public key-based authentication schemes offer stronger authentication than password-based authentication schemes, due to being much less susceptible to brute-force attacks, they should be used for SSH connections. Furthermore, to protect SSH private keys, access to such keys should be protected via the use of passwords or key encryption keys." controls: - id: ism-0485 class: ISM-control title: "Control: ism-0485" props: - name: sort-id value: "catalog[1].group[23].group[5].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0485_smt name: statement prose: Public key-based authentication is used for SSH connections. - id: ism-1449 class: ISM-control title: "Control: ism-1449" props: - name: sort-id value: "catalog[1].group[23].group[5].group[2].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1449_smt name: statement prose: SSH private keys are protected with a password or a key encryption key. - title: Automated remote access props: - name: sort-id value: "catalog[1].group[23].group[5].group[3]" parts: - name: overview prose: |- If using logins without a password for automated purposes, several security risks may arise, specifically: - if access from unknown Internet Protocol (IP) addresses is not restricted, malicious actors could automatically authenticate to systems without needing to know any passwords - if port forwarding is not disabled, or it is not configured securely, access may be gained to forwarded ports, creating a communication channel between malicious actors and a host - if agent credential forwarding is enabled, malicious actors could connect to the stored authentication credentials and use them to connect to other trusted hosts, or even intranet hosts if port forwarding has been allowed as well - if X11 forwarding is not disabled, malicious actors could gain control of displays as well as keyboard and mouse control functions - if console access is allowed, every user who logs in to the console could run applications that are normally restricted to authenticated users. To assist in mitigating these security risks, it is essential that the ‘forced command’ option is used to specify what command is executed and parameter checking is enabled. controls: - id: ism-0487 class: ISM-control title: "Control: ism-0487" props: - name: sort-id value: "catalog[1].group[23].group[5].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0487_smt name: statement prose: |- When using logins without a password for SSH connections, the following are disabled: - access from IP addresses that do not require access - port forwarding - agent credential forwarding - X11 forwarding - console access. - id: ism-0488 class: ISM-control title: "Control: ism-0488" props: - name: sort-id value: "catalog[1].group[23].group[5].group[3].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0488_smt name: statement prose: "If using remote access without the use of a password for SSH connections, the ‘forced command’ option is used to specify what command is executed and parameter checking is enabled." - title: SSH-agent props: - name: sort-id value: "catalog[1].group[23].group[5].group[4]" parts: - name: overview prose: "SSH-agent and similar key caching applications manage private keys stored on workstations and servers. Once a private key has been unlocked and loaded into a key cache, subsequent access to remote systems can occur without the private key being unlocked again. When such functionality is used, screen locks, where applicable, and expiring cached private keys can be used to ensure that private keys are not available for use for extended periods." controls: - id: ism-0489 class: ISM-control title: "Control: ism-0489" props: - name: sort-id value: "catalog[1].group[23].group[5].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0489_smt name: statement prose: "When SSH-agent or similar key caching applications are used, cached private keys have a maximum lifetime of four hours and, where applicable, screen locks are used on workstations and servers." - title: Secure/Multipurpose Internet Mail Extensions props: - name: sort-id value: "catalog[1].group[23].group[6]" parts: - name: overview prose: |- # Context When using IT equipment or applications that implement S/MIME, security controls for using AACAs and AACPs in the ‘Cryptographic algorithms’ and ‘Cryptographic protocols’ sections of these guidelines will also need to be consulted. groups: - title: Configuring Secure/Multipurpose Internet Mail Extensions props: - name: sort-id value: "catalog[1].group[23].group[6].group[1]" parts: - name: overview prose: "S/MIME version 2.0 required the use of weaker cryptography than approved for use in these guidelines. As such, S/MIME version 3.0 was the first version to be approved for use as an AACP." controls: - id: ism-0490 class: ISM-control title: "Control: ism-0490" props: - name: sort-id value: "catalog[1].group[23].group[6].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0490_smt name: statement prose: Versions of S/MIME earlier than S/MIME version 3.0 are not used for S/MIME connections. - title: Transport Layer Security props: - name: sort-id value: "catalog[1].group[23].group[7]" parts: - name: overview prose: |- # Context When using IT equipment or applications that implement TLS, security controls for using AACAs and AACPs in the ‘Cryptographic algorithms’ and ‘Cryptographic protocols’ sections of these guidelines will also need to be consulted. # Further information Further information on implementing TLS can be found in ASD’s [Implementing certificates, TLS, HTTPS and opportunistic TLS](#b8cdbf18-31cb-4e10-bb43-e8488ee8c2f6) publication. Further information on TLS filtering in gateways can be found in the ‘Web content filters’ section of the [Guidelines for gateways](#e8bde527-526c-4a6a-b66f-05228f09dd7b). groups: - title: Configuring Transport Layer Security props: - name: sort-id value: "catalog[1].group[23].group[7].group[1]" parts: - name: overview prose: "The terms Secure Sockets Layer and TLS have traditionally been used interchangeably. However, Secure Sockets Layer and TLS version 1.2 and earlier are no longer considered suitable for use as an AACP. As such, an organisation implementing TLS should use only the latest version of TLS (i.e. TLS version 1.3). In addition, several security risks exist when TLS is configured in an insecure manner. To mitigate these security risks, TLS clients and servers should be configured to enforce secure settings at the time of the TLS handshake. In situations where this is not possible, such as for some multi-tenancy environments (e.g. content delivery networks), additional security controls will need to be implemented. For example, by further restricting the permitted TLS configuration within Layer 7 authorisation logic." controls: - id: ism-1139 class: ISM-control title: "Control: ism-1139" props: - name: sort-id value: "catalog[1].group[23].group[7].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1139_smt name: statement prose: Only the latest version of TLS is used for TLS connections. - id: ism-1369 class: ISM-control title: "Control: ism-1369" props: - name: sort-id value: "catalog[1].group[23].group[7].group[1].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1369_smt name: statement prose: AES-GCM is used for encryption of TLS connections. - id: ism-1370 class: ISM-control title: "Control: ism-1370" props: - name: sort-id value: "catalog[1].group[23].group[7].group[1].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1370_smt name: statement prose: Only server-initiated secure renegotiation is used for TLS connections. - id: ism-1372 class: ISM-control title: "Control: ism-1372" props: - name: sort-id value: "catalog[1].group[23].group[7].group[1].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1372_smt name: statement prose: The ephemeral variant of DH or ECDH is used for key establishment of TLS connections. - id: ism-1373 class: ISM-control title: "Control: ism-1373" props: - name: sort-id value: "catalog[1].group[23].group[7].group[1].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1373_smt name: statement prose: Anonymous DH is not used for TLS connections. - id: ism-1374 class: ISM-control title: "Control: ism-1374" props: - name: sort-id value: "catalog[1].group[23].group[7].group[1].control[6]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1374_smt name: statement prose: SHA-2-based certificates are used for TLS connections. - id: ism-1375 class: ISM-control title: "Control: ism-1375" props: - name: sort-id value: "catalog[1].group[23].group[7].group[1].control[7]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1375_smt name: statement prose: SHA-2 is used for the Hash-based Message Authentication Code (HMAC) and pseudorandom function (PRF) for TLS connections. - id: ism-1553 class: ISM-control title: "Control: ism-1553" props: - name: sort-id value: "catalog[1].group[23].group[7].group[1].control[8]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1553_smt name: statement prose: TLS compression is disabled for TLS connections. - id: ism-1453 class: ISM-control title: "Control: ism-1453" props: - name: sort-id value: "catalog[1].group[23].group[7].group[1].control[9]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-18 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1453_smt name: statement prose: Perfect Forward Secrecy (PFS) is used for TLS connections. - title: Guidelines for gateways props: - name: sort-id value: "catalog[1].group[24]" groups: - title: Gateways props: - name: sort-id value: "catalog[1].group[24].group[1]" parts: - name: overview prose: |- # Context Gateways securely manage data flows between connected networks from different security domains. In doing so, gateways take on the highest sensitivity or classification of connected security domains. This section describes security controls applicable to all types of gateways. Additional sections of these guidelines should also be consulted depending on the types of gateways being deployed and the security domains involved. For example, the ‘Cross domain solutions’ section of these guidelines should be consulted for gateways between different security domains where at least one security domain is classified SECRET or TOP SECRET. Personnel involved in the planning, design, implementation or assessment of gateways should also refer to the Australian Signals Directorate’s (ASD) [Gateway security guidance package](#3df21b72-0559-4bbf-a990-5ee509f70747) and, where applicable, the Department of Home Affairs’ [Protective Security Policy Framework](#92679127-f61d-486a-a93e-df2a26dfb07a) and its associated [Australian Government Gateway Security Standard](#2d003129-793e-4263-92ee-f6d02d016023). # Further information Further information on cyber supply chain risk management can be found in the ‘Cyber supply chain risk management’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on the procurement of outsourced services can be found in the ‘Managed services and cloud services’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on designing, configuring and managing networks can be found in the ‘Network design and configuration’ section of the [Guidelines for networking](#f145ff5b-d396-4248-8f48-621349d6f0ed). Further information on privileged access to systems can be found in the ‘Identity and access management’ section of the [Guidelines for system access](#76d68682-44dd-4e97-98c8-66db2cce1fda). Further information on cyber security awareness training can be found in the ‘Cyber security awareness training’ section of the [Guidelines for personnel security](#7d16ae67-87a7-4861-b939-e13ec279b5a2). Further information on authenticating users can be found in the ‘Identity and access management’ section of the [Guidelines for system access](#76d68682-44dd-4e97-98c8-66db2cce1fda). Further information on authenticating IT equipment can be found in the ‘Network design and configuration’ section of the [Guidelines for networking](#f145ff5b-d396-4248-8f48-621349d6f0ed). Further information on [RPKI](#7da35efd-7196-4aba-bd79-30c19e8ef48b) and [ROA records](#355b47b5-6253-4be5-ba7c-274833d84b75) is available from the Asia Pacific Network Information Centre. Further information on event logging can be found in the ‘Security monitoring’ section of the [Guidelines for security assurance](#ef60c0e4-acfb-4a8b-b5ed-25675c6e117c). Further information on event logging for network devices in gateways can also be found in ASD’s [Priority logs for SIEM ingestion: Practitioner guidance](#1dbda98a-4e8b-4a52-b4f7-9d1a895fd324) publication. Further information on [the purpose of IRAP](#84d3cbab-ab84-4981-a4f7-2bd469c8deaf) is available from ASD. groups: - title: Implementing gateways props: - name: sort-id value: "catalog[1].group[24].group[1].group[1]" parts: - name: overview prose: |- Gateways are critical for an organisation to reduce the security risks associated with providing external parties with access to their networks. In doing so, it is important that gateways are used not only between an organisation’s networks and public network infrastructure, but also between an organisation’s networks that belong to different security domains and between an organisation’s networks and other organisations’ networks that are connected via means other than public network infrastructure. When implementing gateways between an organisation’s networks and public network infrastructure, an organisation should place any services that external parties require access to within a demilitarised zone. This can mitigate security risks for an organisation when hosting such services in an internet-accessible manner. Finally, in architecting gateways, it is important that they only allow explicitly authorised data flows. In support of this, gateways should inspect and filter data flows at the transport and above network layers. Furthermore, gateways should be capable of performing ingress traffic filtering to detect and prevent Internet Protocol (IP) source address spoofing. controls: - id: ism-0628 class: ISM-control title: "Control: ism-0628" props: - name: sort-id value: "catalog[1].group[24].group[1].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0628_smt name: statement prose: Gateways are implemented between networks belonging to different security domains. - id: ism-0637 class: ISM-control title: "Control: ism-0637" props: - name: sort-id value: "catalog[1].group[24].group[1].group[1].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0637_smt name: statement prose: Gateways implement a demilitarised zone if external parties require access to an organisation’s services. - id: ism-0631 class: ISM-control title: "Control: ism-0631" props: - name: sort-id value: "catalog[1].group[24].group[1].group[1].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0631_smt name: statement prose: Gateways only allow explicitly authorised data flows. - id: ism-1192 class: ISM-control title: "Control: ism-1192" props: - name: sort-id value: "catalog[1].group[24].group[1].group[1].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1192_smt name: statement prose: Gateways inspect and filter data flows at the transport and above network layers. - id: ism-1427 class: ISM-control title: "Control: ism-1427" props: - name: sort-id value: "catalog[1].group[24].group[1].group[1].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1427_smt name: statement prose: Gateways perform ingress traffic filtering to detect and prevent IP source address spoofing. - title: System administrators for gateways props: - name: sort-id value: "catalog[1].group[24].group[1].group[2]" parts: - name: overview prose: |- In identifying suitable system administrators for gateways, it is important that individuals comply with any citizenship requirements, undergo appropriate employment screening, and where necessary hold an appropriate security clearance, based on the sensitivity or classification of gateways. For example, all systems administrators for gateways between OFFICIAL: Sensitive and PROTECTED networks will need to hold baseline security clearances. In addition, when creating privileged user accounts for performing administrative activities, it is important that the principle of least privilege is followed. In turn, this should be supported by the principle of separation of duties. Adhering to these two principles can ensure that system administrators for gateways are not given enough privileges to abuse gateways on their own. Finally, providing system administrators for gateways with formal training on the operation and management of gateways will ensure that they are fully aware of, and accept, their roles and responsibilities. In doing so, formal training should be conducted through tailored privileged user training. controls: - id: ism-1520 class: ISM-control title: "Control: ism-1520" props: - name: sort-id value: "catalog[1].group[24].group[1].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1520_smt name: statement prose: "System administrators for gateways undergo appropriate employment screening, and where necessary hold an appropriate security clearance, based on the sensitivity or classification of gateways." - id: ism-0613 class: ISM-control title: "Control: ism-0613" props: - name: sort-id value: "catalog[1].group[24].group[1].group[2].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0613_smt name: statement prose: System administrators for gateways that connect to Australian Eyes Only or Releasable To networks are Australian nationals. - id: ism-1773 class: ISM-control title: "Control: ism-1773" props: - name: sort-id value: "catalog[1].group[24].group[1].group[2].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1773_smt name: statement prose: System administrators for gateways that connect to Australian Government Access Only networks are Australian nationals or seconded foreign nationals. - id: ism-0611 class: ISM-control title: "Control: ism-0611" props: - name: sort-id value: "catalog[1].group[24].group[1].group[2].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0611_smt name: statement prose: System administrators for gateways are assigned the minimum privileges required to perform their duties. - id: ism-0616 class: ISM-control title: "Control: ism-0616" props: - name: sort-id value: "catalog[1].group[24].group[1].group[2].control[5]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0616_smt name: statement prose: Separation of duties is implemented in performing administrative activities for gateways. - id: ism-0612 class: ISM-control title: "Control: ism-0612" props: - name: sort-id value: "catalog[1].group[24].group[1].group[2].control[6]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0612_smt name: statement prose: System administrators for gateways are formally trained on the operation and management of gateways. - title: System administration of gateways props: - name: sort-id value: "catalog[1].group[24].group[1].group[3]" parts: - name: overview prose: "In performing administrative activities for gateways, it is important that they are conducted via a secure path isolated from all connected networks. In doing so, this will minimise threats should a connected network be compromised by malicious actors. Furthermore, where gateways exist between networks belonging to different security domains, any shared components should be managed by system administrators for the higher security domain, alternatively, it may be more appropriate to use system administrators from a mutually agreed upon third party." controls: - id: ism-1774 class: ISM-control title: "Control: ism-1774" props: - name: sort-id value: "catalog[1].group[24].group[1].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1774_smt name: statement prose: Gateways are managed via a secure path isolated from all connected networks. - id: ism-0629 class: ISM-control title: "Control: ism-0629" props: - name: sort-id value: "catalog[1].group[24].group[1].group[3].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0629_smt name: statement prose: "For gateways between networks belonging to different security domains, any shared components are managed by system administrators for the higher security domain or by system administrators from a mutually agreed upon third party." - title: Authenticating to networks accessed via gateways props: - name: sort-id value: "catalog[1].group[24].group[1].group[4]" parts: - name: overview prose: Ensuring users and information technology (IT) equipment are authenticated to other networks accessed via gateways can reduce the likelihood of unauthorised access. controls: - id: ism-0619 class: ISM-control title: "Control: ism-0619" props: - name: sort-id value: "catalog[1].group[24].group[1].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0619_smt name: statement prose: Users authenticate to other networks accessed via gateways. - id: ism-0622 class: ISM-control title: "Control: ism-0622" props: - name: sort-id value: "catalog[1].group[24].group[1].group[4].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0622_smt name: statement prose: IT equipment authenticates to other networks accessed via gateways. - title: Border Gateway Protocol routing security props: - name: sort-id value: "catalog[1].group[24].group[1].group[5]" parts: - name: overview prose: |- Resource Public Key Infrastructure (RPKI) uses asymmetric cryptography to authenticate routing data on the internet. This allows an organisation, particularly a telecommunications carrier or cloud service provider, to verify routing data they receive, transmit and process to determine routing calculations for internet traffic. By using RPKI, an organisation may reduce Border Gateway Protocol (BGP)-related cyber threats, such as some types of denial-of-service attacks, accidental or deliberate rerouting of internet traffic, and opportunities for the undermining of IP address-based reputational services. RPKI Route Origin Authorization (ROA) records, which describe routes in terms of network/prefix and Autonomous Systems from which they are expected to originate, should be configured for the public IP addresses controlled by, or used by, an organisation. ROA records should also be configured for the unannounced IP address space controlled by an organisation. Route Origin Validation (ROV) is a mechanism that enables the validation of ROA covered IP addresses received via BGP. For increased BGP security, ROV should be implemented with all routing data received from transit providers being filtered. In doing so, any routes received that are invalid, or have multiple transit providers where one of them does not implement ROV, should be rejected or deprioritised. In cases where an organisation chooses to deprioritise invalid routes to meet specific operational requirements, as opposed to rejecting them, such decisions should be regularly reviewed, with valid routes always being prioritised over invalid routes. Finally, an organisation should consider the inclusion of routing security measures as part of procurement and contract requirements to ensure such functionality is available for their use. controls: - id: ism-1783 class: ISM-control title: "Control: ism-1783" props: - name: sort-id value: "catalog[1].group[24].group[1].group[5].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1783_smt name: statement prose: "Public IP addresses controlled by, or used by, an organisation are signed by valid ROA records." - id: ism-2018 class: ISM-control title: "Control: ism-2018" props: - name: sort-id value: "catalog[1].group[24].group[1].group[5].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2018_smt name: statement prose: "Routes for RPKI-registered IP addresses that are advertised from invalid Autonomous Systems, or that are longer than allowed, are rejected or deprioritised by routers that exchange routes via BGP." - title: Gateway event logging props: - name: sort-id value: "catalog[1].group[24].group[1].group[6]" parts: - name: overview prose: "Centrally logging and analysing security-relevant events, including configuration changes, for gateways can assist in monitoring the security posture of gateways, detecting malicious behaviour and contributing to investigations following cyber security incidents." controls: - id: ism-0634 class: ISM-control title: "Control: ism-0634" props: - name: sort-id value: "catalog[1].group[24].group[1].group[6].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "11" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0634_smt name: statement prose: |- Security-relevant events for gateways are centrally logged, including: - data packets and data flows permitted through gateways - data packets and data flows attempting to leave gateways - real-time alerts for attempted intrusions. - title: Assessment of gateways props: - name: sort-id value: "catalog[1].group[24].group[1].group[7]" parts: - name: overview prose: "Testing of gateways following configuration changes, and at regular intervals no more than six months apart, can assist in validating that gateways conform to expected security configurations. In addition, gateways will need to undergo regular security control assessments by an Infosec Registered Assessor Program (IRAP) assessor, or an ASD assessor (or their delegate), to determine their security posture and security risks associated with their use. Following an initial security control assessment, subsequent security control assessments should focus on any new services that are being offered as well as any security-related changes that have occurred since the previous security control assessment." controls: - id: ism-1037 class: ISM-control title: "Control: ism-1037" props: - name: sort-id value: "catalog[1].group[24].group[1].group[7].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1037_smt name: statement prose: "Gateways undergo testing following configuration changes, and at regular intervals no more than six months apart, to validate that they conform to expected security configurations." - id: ism-0100 class: ISM-control title: "Control: ism-0100" props: - name: sort-id value: "catalog[1].group[24].group[1].group[7].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "12" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S parts: - id: ism-0100_smt name: statement prose: "Non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET gateways undergo an IRAP assessment, using the latest release of the ISM available prior to the beginning of the IRAP assessment (or a subsequent release), at least every 24 months." - id: ism-2019 class: ISM-control title: "Control: ism-2019" props: - name: sort-id value: "catalog[1].group[24].group[1].group[7].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-2019_smt name: statement prose: "TOP SECRET gateways undergo a security control assessment by ASD assessors (or their delegates), using the latest release of the ISM available prior to the beginning of the assessment (or a subsequent release), at least every 24 months." - title: Cross domain solutions props: - name: sort-id value: "catalog[1].group[24].group[2]" parts: - name: overview prose: |- # Context A cross domain solution (CDS) is a system comprised of security-enforcing functions tailored to mitigate specific security risks associated with accessing or transferring data between different security domains. CDSs may be an integrated appliance or, more commonly, composed of discrete technologies or sub-systems, with each sub-system consisting of hardware or software components. This section defines two types of CDSs, Transfer CDSs and Access CDSs. Transfer CDSs facilitate the transfer of data in one direction (unidirectional) or multiple directions (bi-directional) between different security domains. In comparison, Access CDSs provide users with access to multiple security domains from a single device; however, they do not allow users to move data between the different security domains. This section describes security controls applicable to CDSs and extends the ‘Gateways’ section of these guidelines. Additional sections of these guidelines should also be consulted depending on the types of CDSs being deployed. Personnel involved in the planning, design, implementation or assessment of CDSs should also refer to ASD’s [Introduction to Cross Domain Solutions](#86847be4-3a06-4d2f-9952-447158593e0d) and [Fundamentals of Cross Domain Solutions](#f32020e9-4cb3-486b-bcbb-6fb6719f58a5) publications. # Further information Further information on cyber supply chain risk management can be found in the ‘Cyber supply chain risk management’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on evaluated products can be found in the ‘Evaluated product procurement’ section of the [Guidelines for evaluated products](#a699a3aa-828d-479b-b50b-98127bb19437). Further information on designing, configuring and managing networks can be found in the ‘Network design and configuration’ section of the [Guidelines for networking](#f145ff5b-d396-4248-8f48-621349d6f0ed). Further information on event logging can be found in the ‘Security monitoring’ section of the [Guidelines for security assurance](#ef60c0e4-acfb-4a8b-b5ed-25675c6e117c). Further information on event logging for network devices in CDSs can also be found in ASD’s [Priority logs for SIEM ingestion: Practitioner guidance](#1dbda98a-4e8b-4a52-b4f7-9d1a895fd324) publication. Further information on cyber security awareness training can be found in the ‘Cyber security awareness training’ section of the [Guidelines for personnel security](#7d16ae67-87a7-4861-b939-e13ec279b5a2). groups: - title: Implementing cross domain solutions props: - name: sort-id value: "catalog[1].group[24].group[2].group[1]" parts: - name: overview prose: "As there are significant security risks associated with connecting SECRET or TOP SECRET networks to other networks in different security domains, CDSs will need to be implemented." controls: - id: ism-0626 class: ISM-control title: "Control: ism-0626" props: - name: sort-id value: "catalog[1].group[24].group[2].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0626_smt name: statement prose: CDSs are implemented between SECRET or TOP SECRET networks and any other networks belonging to different security domains. - title: Consultation on cross domain solutions props: - name: sort-id value: "catalog[1].group[24].group[2].group[2]" parts: - name: overview prose: "As CDSs can be complex to implement and manage securely, it is critical that when an organisation is planning, designing, implementing or introducing additional connectivity to CDSs that ASD is consulted and any directions provided by ASD are complied with." controls: - id: ism-0597 class: ISM-control title: "Control: ism-0597" props: - name: sort-id value: "catalog[1].group[24].group[2].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0597_smt name: statement prose: "When planning, designing, implementing or introducing additional connectivity to CDSs, ASD is consulted and any directions provided by ASD are complied with." - title: Separation of data flows props: - name: sort-id value: "catalog[1].group[24].group[2].group[3]" parts: - name: overview prose: "To ensure that data flows are appropriately controlled within CDSs, it is important that isolated upward and downward network paths are implemented. This, in turn, should be supported by independent security-enforcing functions and protocol breaks at each network layer." controls: - id: ism-0635 class: ISM-control title: "Control: ism-0635" props: - name: sort-id value: "catalog[1].group[24].group[2].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0635_smt name: statement prose: CDSs implement isolated upward and downward network paths. - id: ism-1522 class: ISM-control title: "Control: ism-1522" props: - name: sort-id value: "catalog[1].group[24].group[2].group[3].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1522_smt name: statement prose: CDSs implement independent security-enforcing functions for upward and downward network paths. - id: ism-1521 class: ISM-control title: "Control: ism-1521" props: - name: sort-id value: "catalog[1].group[24].group[2].group[3].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1521_smt name: statement prose: CDSs implement protocol breaks at each network layer. - title: Cross domain solution use props: - name: sort-id value: "catalog[1].group[24].group[2].group[4]" parts: - name: overview prose: "To assist in preventing cyber security incidents, it is important that human users know how to use CDSs securely. This can be achieved by training human users on the secure use of CDSs before access is granted." controls: - id: ism-0610 class: ISM-control title: "Control: ism-0610" props: - name: sort-id value: "catalog[1].group[24].group[2].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "9" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0610_smt name: statement prose: Human users are trained on the secure use of CDSs before access is granted. - title: Cross domain solution event logging props: - name: sort-id value: "catalog[1].group[24].group[2].group[5]" parts: - name: overview prose: |- CDSs should have comprehensive event logging capabilities to support attribution of activities to users and ensure accountability of human users for activities they undertake. Furthermore, effective security monitoring practices can increase the likelihood that operational failures will be detected. In addition, centrally logging and analysing security-relevant events, including configuration changes, for CDSs can assist in monitoring the security posture of CDSs, detecting malicious behaviour and contributing to investigations following cyber security incidents. controls: - id: ism-0670 class: ISM-control title: "Control: ism-0670" props: - name: sort-id value: "catalog[1].group[24].group[2].group[5].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0670_smt name: statement prose: Security-relevant events for CDSs are centrally logged. - id: ism-1523 class: ISM-control title: "Control: ism-1523" props: - name: sort-id value: "catalog[1].group[24].group[2].group[5].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "1" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1523_smt name: statement prose: A sample of security-relevant events relating to data transfer policies are taken at least every three months and assessed against security policies for CDSs to identify any operational failures. - title: Firewalls props: - name: sort-id value: "catalog[1].group[24].group[3]" parts: - name: overview prose: |- # Further information Further information on cyber supply chain risk management can be found in the ‘Cyber supply chain risk management’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on evaluated products can be found in the ‘Evaluated product procurement’ section of the [Guidelines for evaluated products](#a699a3aa-828d-479b-b50b-98127bb19437). groups: - title: Using firewalls props: - name: sort-id value: "catalog[1].group[24].group[3].group[1]" parts: - name: overview prose: "When implementing gateways between an organisation’s networks and public network infrastructure, an organisation should implement firewalls to protect themselves from intrusions that may originate from the public network infrastructure. In addition, when an organisation’s networks connect to another organisation’s networks, both organisations should implement independent firewalls to protect themselves from intrusions that may originate from each other’s networks. This requirement may not be necessary in cases where shared network infrastructure is used only as a transport medium and encryption is applied to all network traffic." controls: - id: ism-1528 class: ISM-control title: "Control: ism-1528" props: - name: sort-id value: "catalog[1].group[24].group[3].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1528_smt name: statement prose: Evaluated firewalls are used between an organisation’s networks and public network infrastructure. - id: ism-0639 class: ISM-control title: "Control: ism-0639" props: - name: sort-id value: "catalog[1].group[24].group[3].group[1].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "9" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0639_smt name: statement prose: Evaluated firewalls are used between networks belonging to different security domains. - title: Web application firewalls props: - name: sort-id value: "catalog[1].group[24].group[4]" parts: - name: overview prose: |- # Further information Further information on cyber supply chain risk management can be found in the ‘Cyber supply chain risk management’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on evaluated products can be found in the ‘Evaluated product procurement’ section of the [Guidelines for evaluated products](#a699a3aa-828d-479b-b50b-98127bb19437). groups: - title: Using web application firewalls props: - name: sort-id value: "catalog[1].group[24].group[4].group[1]" parts: - name: overview prose: "When using a web application firewall (WAF), care should be taken with their configuration to ensure that the IP addresses of an organisation’s web servers (referred to as origin servers) are not identifiable by malicious actors, as knowledge of origin server IP addresses could allow for protections provided by a WAF to be bypassed. Additionally, appropriate security controls should be applied to only enable communication between origin servers, the WAF and authorised management networks." controls: - id: ism-1862 class: ISM-control title: "Control: ism-1862" props: - name: sort-id value: "catalog[1].group[24].group[4].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1862_smt name: statement prose: "If using a WAF, disclosing the IP addresses of web servers under an organisation’s control (referred to as origin servers) is avoided and access to the origin servers is restricted to the WAF and authorised management networks." - title: Diodes props: - name: sort-id value: "catalog[1].group[24].group[5]" parts: - name: overview prose: |- # Further information Further information on cyber supply chain risk management can be found in the ‘Cyber supply chain risk management’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on evaluated products can be found in the ‘Evaluated product procurement’ section of the [Guidelines for evaluated products](#a699a3aa-828d-479b-b50b-98127bb19437). groups: - title: Using diodes props: - name: sort-id value: "catalog[1].group[24].group[5].group[1]" parts: - name: overview prose: "Diodes enforce one-way data flows, making it more difficult for malicious actors to use the same network path to launch an intrusion and exfiltrate data afterwards. As such, diodes should be used for controlling the data flow of unidirectional gateways." controls: - id: ism-0643 class: ISM-control title: "Control: ism-0643" props: - name: sort-id value: "catalog[1].group[24].group[5].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0643_smt name: statement prose: Evaluated diodes are used for controlling the data flow of unidirectional gateways between an organisation’s networks and public network infrastructure. - id: ism-0645 class: ISM-control title: "Control: ism-0645" props: - name: sort-id value: "catalog[1].group[24].group[5].group[1].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0645_smt name: statement prose: Evaluated diodes used for controlling the data flow of unidirectional gateways between SECRET or TOP SECRET networks and public network infrastructure complete a high assurance evaluation. - id: ism-1157 class: ISM-control title: "Control: ism-1157" props: - name: sort-id value: "catalog[1].group[24].group[5].group[1].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1157_smt name: statement prose: Evaluated diodes are used for controlling the data flow of unidirectional gateways between networks. - id: ism-1158 class: ISM-control title: "Control: ism-1158" props: - name: sort-id value: "catalog[1].group[24].group[5].group[1].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1158_smt name: statement prose: Evaluated diodes used for controlling the data flow of unidirectional gateways between SECRET or TOP SECRET networks and any other networks complete a high assurance evaluation. - title: Web proxies props: - name: sort-id value: "catalog[1].group[24].group[6]" parts: - name: overview prose: |- # Further information Further information on cyber supply chain risk management can be found in the ‘Cyber supply chain risk management’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on event logging can be found in the ‘Security monitoring’ section of the [Guidelines for security assurance](#ef60c0e4-acfb-4a8b-b5ed-25675c6e117c). groups: - title: Using web proxies props: - name: sort-id value: "catalog[1].group[24].group[6].group[1]" parts: - name: overview prose: Web proxies are a key component in enforcing web usage policies and preventing cyber security incidents. controls: - id: ism-0260 class: ISM-control title: "Control: ism-0260" props: - name: sort-id value: "catalog[1].group[24].group[6].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0260_smt name: statement prose: "All web access, including that by internal servers, is conducted through web proxies." - title: Web proxy event logging props: - name: sort-id value: "catalog[1].group[24].group[6].group[2]" parts: - name: overview prose: "Centrally logging and analysing web proxy events can assist in monitoring the security posture of networks, detecting malicious behaviour and contributing to investigations following cyber security incidents." controls: - id: ism-0261 class: ISM-control title: "Control: ism-0261" props: - name: sort-id value: "catalog[1].group[24].group[6].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0261_smt name: statement prose: |- The following details are centrally logged for websites accessed via web proxies: - web address - date and time - user - amount of data uploaded and downloaded - internal and external IP addresses. - title: Web content filters props: - name: sort-id value: "catalog[1].group[24].group[7]" parts: - name: overview prose: |- # Further information Further information on cyber supply chain risk management can be found in the ‘Cyber supply chain risk management’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on content filtering techniques can be found in the ‘Content filtering’ section of these guidelines. Further information and [examples of client-side JavaScript controls](#6b4353e0-7281-49f4-a520-f35a4cceec71) are available from the NoScript project. groups: - title: Using web content filters props: - name: sort-id value: "catalog[1].group[24].group[7].group[1]" parts: - name: overview prose: "Effective web content filters can greatly reduce the likelihood of malicious code, or other inappropriate content, being accessed by users. Furthermore, web content filters can disrupt or prevent malicious actors from communicating with their malicious code if they manage to deploy it on an organisation’s networks." controls: - id: ism-0963 class: ISM-control title: "Control: ism-0963" props: - name: sort-id value: "catalog[1].group[24].group[7].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0963_smt name: statement prose: Web content filtering is implemented to filter potentially harmful web-based content. - id: ism-0961 class: ISM-control title: "Control: ism-0961" props: - name: sort-id value: "catalog[1].group[24].group[7].group[1].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0961_smt name: statement prose: Client-side active content is restricted by web content filters to an organisation-approved list of domain names. - id: ism-1237 class: ISM-control title: "Control: ism-1237" props: - name: sort-id value: "catalog[1].group[24].group[7].group[1].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1237_smt name: statement prose: Web content filtering is applied to outbound web traffic where appropriate. - title: Transport Layer Security filtering props: - name: sort-id value: "catalog[1].group[24].group[7].group[2]" parts: - name: overview prose: "As encrypted Hypertext Transfer Protocol Secure connections can bypass traditional web content filtering techniques, an organisation should implement Transport Layer Security (TLS) inspection. However, an organisation may choose to allow some web traffic, such as that for internet banking, to go uninspected to protect privacy." controls: - id: ism-0263 class: ISM-control title: "Control: ism-0263" props: - name: sort-id value: "catalog[1].group[24].group[7].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0263_smt name: statement prose: TLS traffic communicated through gateways is decrypted and inspected. - title: Allowing and blocking access to domain names props: - name: sort-id value: "catalog[1].group[24].group[7].group[3]" parts: - name: overview prose: |- Defining an organisation-approved list of domain names, and blocking all others, removes one of the most common data exfiltration paths used by malicious actors. In doing so, even a relatively permissive list of allowed domain names offers better security than relying solely on a list of malicious domain names. Furthermore, in cases where an organisation chooses to implement a relatively permissive list of allowed domain names, or list of website categories, security risks can be further mitigated by blocking dynamic domain names, or domain names that can be registered anonymously for free, as these are often used by malicious actors due to their lack of attribution. Finally, as human users rarely have a requirement to access websites via their IP addresses instead of their domain names, the presence of such activities could indicate malicious code attempting to communicate with malicious actors’ command and control infrastructure and should be blocked. controls: - id: ism-0958 class: ISM-control title: "Control: ism-0958" props: - name: sort-id value: "catalog[1].group[24].group[7].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0958_smt name: statement prose: "An organisation-approved list of domain names, or list of website categories, is implemented for all Hypertext Transfer Protocol and Hypertext Transfer Protocol Secure traffic communicated through gateways." - id: ism-1236 class: ISM-control title: "Control: ism-1236" props: - name: sort-id value: "catalog[1].group[24].group[7].group[3].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1236_smt name: statement prose: "Malicious domain names, dynamic domain names and domain names that can be registered anonymously for free are blocked by web content filters." - id: ism-1171 class: ISM-control title: "Control: ism-1171" props: - name: sort-id value: "catalog[1].group[24].group[7].group[3].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1171_smt name: statement prose: Attempts to access websites through their IP addresses instead of their domain names are blocked by web content filters. - title: Content filtering props: - name: sort-id value: "catalog[1].group[24].group[8]" parts: - name: overview prose: |- # Context The following content filtering techniques should be considered as part of an organisation’s content filtering implementation for gateways and CDSs: - **Antivirus scans:** Scans files for viruses and other malicious code. - **Automated dynamic analysis:** Analyses executable files run in a sandbox to detect suspicious behaviour. - **File extension checks:** Checks file extensions to determine purported file types. - **File format checks:** Checks files conform to defined file format specifications. - **File type checks:** Checks file headers to determine actual file types. - **Keyword checks:** Checks files for keywords that could indicate undesirable content. - **Metadata checks:** Checks files for metadata that should be removed. - **Protective marking checks:** Checks files for protective markings that may indicate undesirable content. - **Manual inspections:** Involves the manual inspection of files for suspicious or undesirable content that an automated system may miss, which is particularly important for multimedia and content rich files. # Further information Further information on cyber supply chain risk management can be found in the ‘Cyber supply chain risk management’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on performing data transfers can be found in the ‘Data transfers’ section of the [Guidelines for data transfers](#1eefdaf7-3991-4ba2-9439-79565f508c44). groups: - title: Performing content filtering props: - name: sort-id value: "catalog[1].group[24].group[8].group[01]" parts: - name: overview prose: "Content filters perform an important function within gateways and CDSs by reducing the likelihood of unauthorised content or malicious code from entering or exiting networks. In performing content filtering checks, some content will be readily identifiable as malicious, or cannot be inspected, while other content, such as active content, may be deemed suspicious depending on what is considered normal behaviour for content passing through gateways and CDSs within an organisation. Finally, when content filters are used by CDSs, their assurance requirements necessitate rigorous security testing to ensure they perform as expected and cannot be bypassed." controls: - id: ism-0659 class: ISM-control title: "Control: ism-0659" props: - name: sort-id value: "catalog[1].group[24].group[8].group[01].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0659_smt name: statement prose: Files imported or exported via gateways or CDSs undergo content filtering checks. - id: ism-0651 class: ISM-control title: "Control: ism-0651" props: - name: sort-id value: "catalog[1].group[24].group[8].group[01].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0651_smt name: statement prose: "Files identified by content filtering checks as malicious, or that cannot be inspected, are blocked." - id: ism-0652 class: ISM-control title: "Control: ism-0652" props: - name: sort-id value: "catalog[1].group[24].group[8].group[01].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0652_smt name: statement prose: Files identified by content filtering checks as suspicious are quarantined until reviewed and subsequently approved or not approved for release. - id: ism-1524 class: ISM-control title: "Control: ism-1524" props: - name: sort-id value: "catalog[1].group[24].group[8].group[01].control[4]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1524_smt name: statement prose: Content filters used by CDSs undergo rigorous security testing to ensure they perform as expected and cannot be bypassed. - title: Encrypted files props: - name: sort-id value: "catalog[1].group[24].group[8].group[02]" parts: - name: overview prose: |- As encryption can be used to bypass content filtering checks, this poses a security risk in that malicious code could enter networks, or data could be exfiltrated from networks, undetected. In addition, encrypted files could mask data at a higher classification than that authorised to pass through gateways or CDSs, which could result in a data spill. As such, encrypted files should be decrypted to undergo content filtering checks. Where a requirement to preserve the confidentiality of encrypted files exists, an organisation may also consider a dedicated system to enable encrypted files to be decrypted in an appropriately secure environment before being subjected to all applicable content filtering checks. controls: - id: ism-1293 class: ISM-control title: "Control: ism-1293" props: - name: sort-id value: "catalog[1].group[24].group[8].group[02].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1293_smt name: statement prose: Encrypted files imported or exported via gateways or CDSs are decrypted to undergo content filtering checks. - title: Archive files props: - name: sort-id value: "catalog[1].group[24].group[8].group[03]" parts: - name: overview prose: |- Archive files can be used to bypass content filtering checks if content filters do not handle such files correctly. Ensuring content filters recognise archive files will ensure the embedded files they contain are subject to the same content filtering checks as un-archived files. Archive files can be constructed in a manner that can result in a denial of service to content filters due to processor, memory or disk space exhaustion. To limit the likelihood of such situations, content filters can specify resource constraints while unpacking archive files. If these constraints are exceeded, content filtering checks should be terminated. controls: - id: ism-1289 class: ISM-control title: "Control: ism-1289" props: - name: sort-id value: "catalog[1].group[24].group[8].group[03].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1289_smt name: statement prose: Archive files imported or exported via gateways or CDSs are unpacked to undergo content filtering checks. - id: ism-1290 class: ISM-control title: "Control: ism-1290" props: - name: sort-id value: "catalog[1].group[24].group[8].group[03].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1290_smt name: statement prose: Archive files are unpacked in a controlled manner to ensure content filter performance or availability is not adversely affected. - title: Antivirus scanning props: - name: sort-id value: "catalog[1].group[24].group[8].group[04]" parts: - name: overview prose: "Antivirus scanning can be used to detect malicious files. In doing so, multiple different scanning engines should be used to increase the likelihood of identifying any malicious files." controls: - id: ism-1288 class: ISM-control title: "Control: ism-1288" props: - name: sort-id value: "catalog[1].group[24].group[8].group[04].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1288_smt name: statement prose: Files imported or exported via gateways or CDSs undergo antivirus scanning using multiple different scanning engines. - title: Automated dynamic analysis props: - name: sort-id value: "catalog[1].group[24].group[8].group[05]" parts: - name: overview prose: "Analysing executable files in a sandbox can be an effective method to detect suspicious behaviour upon file execution, such as network traffic, creation or modification of files, or system configuration changes." controls: - id: ism-1389 class: ISM-control title: "Control: ism-1389" props: - name: sort-id value: "catalog[1].group[24].group[8].group[05].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1389_smt name: statement prose: Executable files imported via gateways or CDSs are automatically executed in a sandbox to detect any suspicious behaviour. - title: Allowing specific content types props: - name: sort-id value: "catalog[1].group[24].group[8].group[06]" parts: - name: overview prose: "Creating and enforcing an organisation-approved list of allowed file types can reduce the attack surface of networks. For example, a content filter in an email gateway might only allow Microsoft Office files and Portable Document Format (PDF) files." controls: - id: ism-0649 class: ISM-control title: "Control: ism-0649" props: - name: sort-id value: "catalog[1].group[24].group[8].group[06].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0649_smt name: statement prose: Files imported or exported via gateways or CDSs are filtered for allowed file types. - title: Content validation props: - name: sort-id value: "catalog[1].group[24].group[8].group[07]" parts: - name: overview prose: "Content validation, such as file format checks, aims to ensure that files conform to defined file format specifications. In performing content validation, any malformed content may indicate the presence of unauthorised content or malicious code, such as that designed to exploit known vulnerabilities in operating systems and applications." controls: - id: ism-1284 class: ISM-control title: "Control: ism-1284" props: - name: sort-id value: "catalog[1].group[24].group[8].group[07].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1284_smt name: statement prose: Files imported or exported via gateways or CDSs undergo content validation. - title: Content checking props: - name: sort-id value: "catalog[1].group[24].group[8].group[08]" parts: - name: overview prose: "Content checking, such as keyword checks, metadata checks and protective marking checks, aims to ensure that files do not contain any content that could cause a data spill or facilitate unauthorised export of data from systems." controls: - id: ism-1965 class: ISM-control title: "Control: ism-1965" props: - name: sort-id value: "catalog[1].group[24].group[8].group[08].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1965_smt name: statement prose: Files imported or exported via gateways or CDSs undergo content checking. - title: Content conversion props: - name: sort-id value: "catalog[1].group[24].group[8].group[09]" parts: - name: overview prose: |- Content conversion can be an effective method to render malicious code harmless by converting one file type to another file type. However, some file types will not benefit from content conversion. Examples of content conversion include: - converting Microsoft Word documents to PDF files - converting Microsoft PowerPoint presentations to image files - converting Microsoft Excel spreadsheets to comma-separated values files - converting PDF documents to plain text files. controls: - id: ism-1286 class: ISM-control title: "Control: ism-1286" props: - name: sort-id value: "catalog[1].group[24].group[8].group[09].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1286_smt name: statement prose: Files imported or exported via gateways or CDSs undergo content conversion. - title: Content sanitisation props: - name: sort-id value: "catalog[1].group[24].group[8].group[10]" parts: - name: overview prose: "Content sanitisation is the process of rendering files safe by removing or altering active content while leaving the original content as intact as possible, such as by removing macros from Microsoft Office files or removing JavaScript sections from PDF files." controls: - id: ism-1287 class: ISM-control title: "Control: ism-1287" props: - name: sort-id value: "catalog[1].group[24].group[8].group[10].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1287_smt name: statement prose: Files imported or exported via gateways or CDSs undergo content sanitisation. - title: Validating file integrity props: - name: sort-id value: "catalog[1].group[24].group[8].group[11]" parts: - name: overview prose: "If files passing through gateways or CDSs contain a form of integrity protection, such as a digital signature or cryptographic checksum, content filters should validate their integrity. In doing so, the failure of any integrity checks may indicate that files have been tampered with." controls: - id: ism-0677 class: ISM-control title: "Control: ism-0677" props: - name: sort-id value: "catalog[1].group[24].group[8].group[11].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-23 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0677_smt name: statement prose: Files imported or exported via gateways or CDSs that have a digital signature or cryptographic checksum are validated. - title: Peripheral switches props: - name: sort-id value: "catalog[1].group[24].group[9]" parts: - name: overview prose: |- # Further information Further information on cyber supply chain risk management can be found in the ‘Cyber supply chain risk management’ section of the [Guidelines for procurement and outsourcing](#f37a4848-0791-4870-b316-5536c2681c28). Further information on evaluated products can be found in the ‘Evaluated product procurement’ section of the [Guidelines for evaluated products](#a699a3aa-828d-479b-b50b-98127bb19437). groups: - title: Using peripheral switches props: - name: sort-id value: "catalog[1].group[24].group[9].group[1]" parts: - name: overview prose: |- When accessing different systems through peripheral switches, it is important that sufficient assurance be obtained in their operation to ensure that data does not pass between connected systems. As such, the level of assurance needed in peripheral switches is determined by the difference in sensitivity or classification of systems they are connected to. There is no requirement for evaluated peripheral switches to be used when all connected systems belong to the same security domain. controls: - id: ism-0591 class: ISM-control title: "Control: ism-0591" props: - name: sort-id value: "catalog[1].group[24].group[9].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0591_smt name: statement prose: Evaluated peripheral switches are used when sharing peripherals between systems. - id: ism-1457 class: ISM-control title: "Control: ism-1457" props: - name: sort-id value: "catalog[1].group[24].group[9].group[1].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "4" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1457_smt name: statement prose: "Evaluated peripheral switches used for sharing peripherals between SECRET and TOP SECRET systems, or between SECRET or TOP SECRET systems belonging to different security domains, preferably complete a high assurance evaluation." - id: ism-1480 class: ISM-control title: "Control: ism-1480" props: - name: sort-id value: "catalog[1].group[24].group[9].group[1].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "2" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1480_smt name: statement prose: Evaluated peripheral switches used for sharing peripherals between SECRET or TOP SECRET systems and any non-SECRET or TOP SECRET systems complete a high assurance evaluation. - title: Guidelines for data transfers props: - name: sort-id value: "catalog[1].group[25]" groups: - title: Data transfers props: - name: sort-id value: "catalog[1].group[25].group[1]" parts: - name: overview prose: |- # Context This section describes security controls applicable to manual data transfers and data transfers using gateways or cross domain solutions (CDSs). For data transfers using gateways or CDSs, the ‘Content filtering’ section of the [Guidelines for gateways](#e8bde527-526c-4a6a-b66f-05228f09dd7b) is also applicable. # Further information Further information on manual data transfers using removable media can be found in the ‘Media usage’ section of the [Guidelines for media](#b594c9c0-b42f-4f06-b643-38023275a5c7). Further information on data transfers using gateways or CDSs can be found in the ‘Content filtering’ section of the [Guidelines for gateways](#e8bde527-526c-4a6a-b66f-05228f09dd7b). groups: - title: Data transfer processes and procedures props: - name: sort-id value: "catalog[1].group[25].group[1].group[1]" parts: - name: overview prose: "Ensuring that data transfer processes and procedures are developed, implemented and maintained can facilitate consistent data transfers. In addition, to reduce the likelihood of Australian Eyes Only (AUSTEO), Australian Government Access Only (AGAO) and Releasable To (REL) data crossing into unsuitable foreign systems, it is important that additional processes and procedures are developed, implemented and maintained to prevent this from occurring. Depending on protective markings applied to REL data, it may be suitable for export to some foreign systems but not to others." controls: - id: ism-0663 class: ISM-control title: "Control: ism-0663" props: - name: sort-id value: "catalog[1].group[25].group[1].group[1].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0663_smt name: statement prose: "Data transfer processes, and supporting data transfer procedures, are developed, implemented and maintained." - id: ism-1535 class: ISM-control title: "Control: ism-1535" props: - name: sort-id value: "catalog[1].group[25].group[1].group[1].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Jun-24 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1535_smt name: statement prose: "Processes, and supporting procedures, are developed, implemented and maintained to prevent AUSTEO, AGAO and REL data in textual and non-textual formats from being exported to unsuitable foreign systems." - title: Accountability for data transfers props: - name: sort-id value: "catalog[1].group[25].group[1].group[2]" parts: - name: overview prose: "When human users transfer data to or from systems, they should understand the potential consequences of their actions. This could include transferring data onto systems not authorised to handle the data, or the unintended introduction of malicious code to systems. As such, human users should be held accountable for all data transfers that they perform." controls: - id: ism-0661 class: ISM-control title: "Control: ism-0661" props: - name: sort-id value: "catalog[1].group[25].group[1].group[2].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "9" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0661_smt name: statement prose: Human users transferring data to and from systems are held accountable for data transfers they perform. - title: Manual import of data props: - name: sort-id value: "catalog[1].group[25].group[1].group[3]" parts: - name: overview prose: "When manually importing data to systems, such as via the use of removable media, the data should be scanned for malicious and active content to reduce the likelihood of causing a malicious code infection. In cases where security checks fail, data should be quarantined until it can be reviewed and subsequently approved or not approved for release." controls: - id: ism-0657 class: ISM-control title: "Control: ism-0657" props: - name: sort-id value: "catalog[1].group[25].group[1].group[3].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0657_smt name: statement prose: "When manually importing data to systems, the data is scanned for malicious and active content." - id: ism-1778 class: ISM-control title: "Control: ism-1778" props: - name: sort-id value: "catalog[1].group[25].group[1].group[3].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1778_smt name: statement prose: "When manually importing data to systems, all data that fails security checks is quarantined until reviewed and subsequently approved or not approved for release." - title: Authorising export of data props: - name: sort-id value: "catalog[1].group[25].group[1].group[4]" parts: - name: overview prose: "Data exported from SECRET and TOP SECRET systems should be reviewed and authorised by a trustworthy source beforehand, such as the chief information security officer or one of their delegates. In doing so, all data authorised for export should be digitally signed by the trustworthy source." controls: - id: ism-0664 class: ISM-control title: "Control: ism-0664" props: - name: sort-id value: "catalog[1].group[25].group[1].group[4].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "8" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0664_smt name: statement prose: Data exported from SECRET and TOP SECRET systems is reviewed and authorised by a trustworthy source beforehand. - id: ism-0675 class: ISM-control title: "Control: ism-0675" props: - name: sort-id value: "catalog[1].group[25].group[1].group[4].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "7" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-25 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0675_smt name: statement prose: Data authorised for export from SECRET and TOP SECRET systems is digitally signed by a trustworthy source. - id: ism-0665 class: ISM-control title: "Control: ism-0665" props: - name: sort-id value: "catalog[1].group[25].group[1].group[4].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "9" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Sep-26 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0665_smt name: statement prose: Trustworthy sources for SECRET and TOP SECRET systems are limited to people and systems that have been verified and authorised as such by the chief information security officer. - title: Manual export of data props: - name: sort-id value: "catalog[1].group[25].group[1].group[5]" parts: - name: overview prose: "When manually exporting data from systems, such as via the use of removable media, the data should be checked for unsuitable protective markings to reduce the likelihood of causing a data spill. In addition, data manually exported from SECRET and TOP SECRET systems will require additional assurances, for example, by validating digital signatures and checking for keywords within all textual data. Finally, in cases where security checks fail, data should be quarantined until it can be reviewed and subsequently approved or not approved for release." controls: - id: ism-1187 class: ISM-control title: "Control: ism-1187" props: - name: sort-id value: "catalog[1].group[25].group[1].group[5].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "3" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1187_smt name: statement prose: "When manually exporting data from systems, the data is checked for unsuitable protective markings." - id: ism-0669 class: ISM-control title: "Control: ism-0669" props: - name: sort-id value: "catalog[1].group[25].group[1].group[5].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "6" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Dec-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0669_smt name: statement prose: "When manually exporting data from SECRET and TOP SECRET systems, digital signatures are validated and keyword checks are performed within all textual data." - id: ism-1779 class: ISM-control title: "Control: ism-1779" props: - name: sort-id value: "catalog[1].group[25].group[1].group[5].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1779_smt name: statement prose: "When manually exporting data from systems, all data that fails security checks is quarantined until reviewed and subsequently approved or not approved for release." - title: Monitoring data import and export props: - name: sort-id value: "catalog[1].group[25].group[1].group[6]" parts: - name: overview prose: "To ensure the ongoing confidentiality and integrity of systems, it is important to log all data transfers. This applies to all forms of data transfers, such as those performed using removable media, gateways or CDSs. Ideally, data transfer logs should contain information on who authorised the data transfer, what data was transferred, where the data was transferred from or to, when the data was transferred, why the data was transferred, and how the data was transferred. Monitoring of such activities, via periodic verification of data transfer logs, can assist in identifying abuse of data transfer privileges and any unusual usage patterns that may indicate attempts by malicious actors to surreptitiously import malicious code or exfiltrate data from SECRET and TOP SECRET systems." controls: - id: ism-1586 class: ISM-control title: "Control: ism-1586" props: - name: sort-id value: "catalog[1].group[25].group[1].group[6].control[1]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "0" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Aug-20 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1586_smt name: statement prose: Data transfer logs are used to record all data imports and exports from systems. - id: ism-1294 class: ISM-control title: "Control: ism-1294" props: - name: sort-id value: "catalog[1].group[25].group[1].group[6].control[2]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "5" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: NC - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: OS - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: P - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-1294_smt name: statement prose: Data transfer logs for systems are partially verified at least monthly. - id: ism-0660 class: ISM-control title: "Control: ism-0660" props: - name: sort-id value: "catalog[1].group[25].group[1].group[6].control[3]" - name: revision ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: "9" - name: updated ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: Mar-22 - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: S - name: applicability ns: https://cyber.gov.au/ns/ism/oscal/3.0 value: TS parts: - id: ism-0660_smt name: statement prose: Data transfer logs for SECRET and TOP SECRET systems are fully verified at least monthly. - title: Cyber security terminology props: - name: sort-id value: "catalog[1].group[26]" groups: - title: Glossary of abbreviations props: - name: sort-id value: "catalog[1].group[26].group[1]" parts: - name: overview prose: |- | Abbreviation | Meaning | |--------------|----------------------------------------------------------------| | AACA | ASD-Approved Cryptographic Algorithm | | AACP | ASD-Approved Cryptographic Protocol | | AD CS | Active Directory Certificate Services | | AD DS | Active Directory Domain Services | | AD FS | Active Directory Federation Services | | AES | Advanced Encryption Standard | | AGAO | Australian Government Access Only | | AH | Authentication Header | | AI | artificial intelligence | | AISEP | Australian Information Security Evaluation Program | | API | application programming interface | | ASD | Australian Signals Directorate | | ASIO | Australian Security Intelligence Organisation | | ATA | Advanced Technology Attachment | | AUSTEO | Australian Eyes Only | | BGP | Border Gateway Protocol | | CCRA | Common Criteria Recognition Arrangement | | CDN | content delivery network | | CDS | cross domain solution | | CISO | chief information security officer | | CRQC | cryptographically relevant quantum computer | | DAST | dynamic application security testing | | DH | Diffie-Hellman | | DKIM | DomainKeys Identified Mail | | DMA | direct memory access | | DMARC | Domain-based Message Authentication, Reporting and Conformance | | DNS | Domain Name System | | EAL | Evaluation Assurance Level | | EAP | Extensible Authentication Protocol | | EAP-TLS | Extensible Authentication Protocol-Transport Layer Security | | ECDH | Elliptic Curve Diffie-Hellman | | ECDSA | Elliptic Curve Digital Signature Algorithm | | EDR | endpoint detection and response | | EEPROM | electrically erasable programmable read-only memory | | EPROM | erasable programmable read-only memory | | ESP | Encapsulating Security Payload | | FIPS | Federal Information Processing Standard | | FT | Fast Basic Service Set Transition | | HACE | High Assurance Cryptographic Equipment | | HIPS | host-based intrusion prevention system | | HMAC | Hash-based Message Authentication Code | | HTML | Hypertext Markup Language | | HTTPS | Hypertext Transfer Protocol Secure | | IEC | International Electrotechnical Commission | | IKE | Internet Key Exchange | | IP | Internet Protocol | | IPsec | Internet Protocol Security | | IPv4 | Internet Protocol version 4 | | IPv6 | Internet Protocol version 6 | | IR | infrared | | IRAP | Infosec Registered Assessors Program | | ISM | Information security manual | | ISO | International Organization for Standardization | | IT | information technology | | MAC | Media Access Control | | MACsec | Media Access Control Security | | MFD | multifunction device | | ML-DSA | Module-Lattice-Based Digital Signature Algorithm | | ML-KEM | Module-Lattice-Based Key Encapsulation Mechanism | | MTA-STS | Mail Transfer Agent Strict Transport Security | | NIDS | network-based intrusion detection system | | NIPS | network-based intrusion prevention system | | NIST | National Institute of Standards and Technology | | OAuth | Open Authorization | | OT | operational technology | | OWASP | Open Worldwide Application Security Project | | PDF | Portable Document Format | | PFS | Perfect Forward Secrecy | | PMK | Pairwise Master Key | | PP | Protection Profile | | PRF | pseudorandom function | | RADIUS | Remote Authentication Dial-In User Service | | REL | Releasable To | | RF | radio frequency | | RMM | remote monitoring and management | | ROA | Route Origin Authorization | | ROV | Route Origin Validation | | RPKI | Resource Public Key Infrastructure | | RSA | Rivest-Shamir-Adleman | | SAST | static application security testing | | SCA | software composition analysis | | SCEC | Security Construction and Equipment Committee | | SHA-2 | Secure Hashing Algorithm 2 | | SHA-3 | Secure Hashing Algorithm 3 | | SIEM | security information and event management | | S/MIME | Secure/Multipurpose Internet Mail Extensions | | SMB | Server Message Block | | SNMP | Simple Network Management Protocol | | SOAR | security orchestration, automation and response | | SOE | standard operating environment | | SP | Special Publication | | SPF | Sender Policy Framework | | SPN | Service Principal Name | | SQL | Structured Query Language | | SSH | Secure Shell | | SSID | Service Set Identifier | | TLS | Transport Layer Security | | USB | Universal Serial Bus | | VLAN | virtual local area network | | VPN | virtual private network | | WAF | web application firewall | | WMI | Windows Management Instrumentation | | WPA2 | Wi-Fi Protected Access 2 | | WPA3 | Wi-Fi Protected Access 3 | - title: Glossary of cyber security terms props: - name: sort-id value: "catalog[1].group[26].group[2]" parts: - name: overview prose: |- | Term | Meaning | |------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | access control | The process of granting or denying requests for access to systems. Can also refer to the process of granting or denying requests for access to facilities. | | access cross domain solution | A system permitting access to multiple security domains from a single client device. | | accountable material | Accountable material requires the strictest control over its access and movement. Accountable material includes TOP SECRET data, some types of caveated data and any data designated as accountable material by its originator. | | application control | An approach that permits only explicitly approved applications and other executable content to execute on systems. | | artificial intelligence application | An application that contains a reasonable degree of artificial intelligence (AI) functionality. This includes AI-enabled applications, AI-powered applications and AI-driven applications. | | artificial intelligence model | A computational model that has been trained using data to recognise patterns; predict, classify or make decisions; or generate outputs in response to inputs, using machine-learning or AI techniques. | | artificial intelligence-driven application | An application that uses AI to autonomously control most of its decisions and behaviour. Such applications typically have low human involvement, with decisions being driven by AI. Without AI functionality, such applications are unable to operate as intended. | | artificial intelligence-enabled application | An application that uses AI for secondary or supporting functionality. Such applications typically have high human involvement, with decisions led by humans and informed by AI insights. Without AI functionality, such applications can still function effectively. | | artificial intelligence-powered application | An application that uses AI for its primary functionality. Such applications typically have moderate human involvement, with decisions shared between humans and AI. Without AI functionality, such applications can function, but only in a severely limited capacity. | | assets | In the context of technology, an overarching term used to refer to operating systems, applications, information technology (IT) equipment, operational technology (OT) equipment, services and data. Such assets may also be referred to as technology assets. | | asymmetric cryptographic algorithms | Cryptographic algorithms where two different keys are used, commonly a private and a public key. Asymmetric cryptographic algorithms are also known as public key cryptographic algorithms. | | attack surface | The reachable points through which a system could be accessed, manipulated or compromised. This can include hardware and software interfaces, network services, and application programming interfaces. | | Australian Eyes Only data | Data not to be passed to, or accessed by, foreign nationals. | | Australian Government Access Only data | Data not to be passed to, or accessed by, foreign nationals, except for seconded foreign nationals. | | Australian Information Security Evaluation Program | A program under which evaluations are performed by impartial bodies against the Common Criteria. The results of these evaluations are then certified by the Australian Certification Authority within the Australian Signals Directorate (ASD). | | Australian Signals Directorate-approved cryptography | Cryptography suitably implemented using an ASD-Approved Cryptographic Algorithm, an ASD-Approved Cryptographic Protocol, a high assurance cryptographic algorithm or a high assurance cryptographic protocol. | | authentication | Verifying the identity of a user as a prerequisite to allowing access to a system and its resources. | | authentication artefact | A digital object created or issued during authentication that represents the authenticated identity of a user, or maintains an authenticated session. For example, authentication assertions, authentication tokens and session cookies. | | Authentication Header | A protocol used in Internet Protocol Security (IPsec) that provides data integrity and data origin authenticity but not confidentiality. | | authorisation package | A cyber security documentation package that includes a system’s system security plan, cyber security incident response plan, change and configuration management plan, continuous monitoring plan, security assessment report, and plan of action and milestones. The authorisation package is provided to a system’s authorising officer to assist them in making an informed decision as to whether the security risks associated with the system’s operation are acceptable or not. | | authorisation to operate | The official management decision by a senior executive or senior executives to authorise a system to operate based on the acceptance of the security risks associated with its operation. | | authorising officer | A senior executive with the authority to authorise the operation of a system at an acceptable level of security risk. | | availability | The assurance that systems are accessible and useable by authorised entities when required. | | biometrics | Measurable physical characteristics used to identify or verify an individual. | | caveat | A marking that indicates that the data has special requirements in addition to those indicated by its classification. This term covers codewords, source codewords, releasability indicators and special-handling caveats. | | certification report | An artefact of Common Criteria evaluations that outlines the outcomes of a product’s evaluation. | | change and configuration management plan | A document that describes the management of changes to the configuration of systems. | | chief information security officer | A senior executive who is responsible for coordinating communication between security and business functions as well as overseeing the application of security controls and associated security risk management processes. | | classification | The categorisation of systems or data according to the expected impact if compromised. | | classified data | Data that would cause limited through to exceptionally grave damage to Australia’s national interests, the Australian Government generally or to an individual Commonwealth entity if compromised (i.e. data assessed as OFFICIAL: Sensitive, PROTECTED, SECRET or TOP SECRET). | | commercial cryptographic equipment | A subset of IT equipment that contains cryptographic components. | | Common Criteria | An international standard for product evaluations. | | Common Criteria Recognition Arrangement | An international agreement that facilitates the mutual recognition of Common Criteria evaluations by certificate producing schemes. | | communications security | The security controls applied to protect telecommunications from unauthorised interception and exploitation, as well as ensure the authenticity of such telecommunications. | | computer accounts | Accounts used to identify computers that belong to a domain, also known as machine accounts. Computer accounts provide a means for authenticating and auditing computer access to networks and domain resources. | | conduit | A tube, duct or pipe used to protect cables. | | confidentiality | The assurance that data is disclosed only to authorised entities. | | connected vehicle | Any vehicle that is connected to the internet enabling the relay of data to or from the vehicle. Connected vehicles may be connected to the internet either via embedded internet connectivity, such as a built-in modem, or via a tethered connection to the driver’s smartphone. | | connection forwarding | The use of network address translation to enable a port on a node inside a network to be accessed from outside the network. Alternatively, using a Secure Shell server to forward a Transmission Control Protocol connection to an arbitrary port on the local host. | | consent grant | An authorisation provided by a human user or administrator that permits an application to access specified data or resources on behalf of that user or an organisation. | | content filter | A filter that examines content to assess conformance against a security policy. | | continuous monitoring plan | A document that describes the plan for the continuous monitoring and assurance in the effectiveness of security controls for a system. | | control plane | The administrative interface that enables the management and orchestration of a system’s infrastructure and applications. | | credential management | The enrolment, issuance, use, protection, change and revocation of credentials and other authentication artefacts. | | critical server | A server that provides critical network or security services. For example, Microsoft Active Directory Domain Services domain controllers, Microsoft Active Directory Certificate Services servers, Microsoft Active Directory Federation Services servers and Microsoft Entra Connect servers. | | cross domain solution | A system capable of implementing comprehensive data flow security policies with a high level of trust between two or more differing security domains. | | cryptographic algorithm | An algorithm used to perform cryptographic functions, such as encryption, integrity, authentication, digital signatures or key establishment. | | cryptographic application | An application designed to perform cryptographic functions. | | cryptographic equipment | A generic term for commercial cryptographic equipment and High Assurance Cryptographic Equipment. | | cryptographic hash | An algorithm (the hash function) that takes as input a string of any length (the message) and generates a fixed length string (the message digest or fingerprint) as output. The algorithm is designed to make it computationally infeasible to find any input that maps to a given digest, or to find two different messages that map to the same digest. | | cryptographic module | The set of hardware and software that implements approved cryptographic functions (including key generation) that are contained within the cryptographic boundary of the module. | | cryptographic protocol | An agreed standard for secure communication between two or more entities to provide one or more security properties, such as confidentiality, integrity, authentication or non-repudiation. | | cryptographic system | A related set of hardware, software and supporting infrastructure used for cryptographic communication, processing or storage and the administrative framework in which it operates. Cryptographic systems may be based upon traditional cryptography, post-quantum cryptography or a combination of both. | | cryptographically relevant quantum computer | A quantum computer that is capable of successfully executing attacks against traditional cryptographic systems. | | customer | A person that an organisation has dealings with, typically via the consumption of goods or services. A customer does not necessarily need to purchase goods or services from the organisation. | | cyber resilience | The ability to adapt to disruptions caused by cyber security incidents while maintaining continuous business operations. This includes the ability to detect, manage and recover from cyber security incidents. | | cyber security | Measures used to protect the confidentiality, integrity and availability of IT and OT systems. | | cyber security documentation | An organisation’s cyber security strategy; system-specific cyber security documentation; and any supporting diagrams, plans, policies, processes, procedures and registers. | | cyber security event | An occurrence of a system, service or network state indicating a possible breach of security policy, failure of safeguards or a previously unknown situation that may be relevant to security. | | cyber security incident | An unwanted or unexpected cyber security event, or a series of such events, that has either compromised business operations or has a significant probability of doing so. | | cyber security incident response plan | A document that describes the plan for responding to cyber security incidents. | | cyber supply chain | The suppliers, manufacturers, distributors and retailers involved in the design, manufacture, storage, delivery, installation, operation, maintenance and decommissioning of products and services utilised within an organisation’s IT and OT environments. | | cyber threat | Any circumstance or event with the potential to harm systems. | | data at rest | Data that resides on media or a system. | | data in transit | Data that is being communicated across a communication medium. | | data repository | A location where data is stored, managed and made available for use. | | data security | Measures used to protect the confidentiality, integrity and availability of data. | | data spill | The accidental or deliberate exposure of data into an uncontrolled or unauthorised environment, or to entities without a need-to-know. | | declassification | A process whereby requirements for the protection of data are removed and an administrative decision is made to formally authorise its release into the public domain. | | decommission | The process of removing something from operational service. | | degausser | An electrical device or permanent magnet assembly that generates a magnetic force for the purpose of degaussing magnetic storage devices. | | degaussing | A process for reducing the magnetisation of a magnetic storage device to zero by applying a reverse magnetic force, rendering any previously stored data unreadable. | | demilitarised zone | A small network with one or more servers that is kept separate from the core network, typically on the outside of the firewall or as a separate network protected by the firewall. Demilitarised zones usually provide data to less trusted networks, such as the internet. | | denial-of-service attack | An attempt by malicious actors to prevent legitimate access to online services (typically a website), for example, by consuming the amount of available bandwidth or the processing capacity of the server hosting the online service. | | device access control application | An application that can be used to prevent removable media and mobile devices from being connected to workstations and servers via external communication interfaces. | | digital preservation | The coordinated and ongoing set of processes and activities that ensure long-term, error-free storage of digital information, with means for retrieval and interpretation, for the entire time span the information is required. | | digital signature | A cryptographic process that enables the proof of the source (with non-repudiation) and the verification of the integrity of that data. | | diode | A device that enables data to flow in only one direction. | | dual-stack network | A network that implements both Internet Protocol version 4 and Internet Protocol version 6 protocol stacks. | | elliptic curve cryptography | A group of asymmetric cryptographic algorithms underpinned by the mathematics of elliptic curves. | | emanation security | The countermeasures employed to reduce sensitive or classified emanations from a facility and its systems to an acceptable level. Emanations can be in the form of Radio Frequency energy, sound waves or optical signals. | | Encapsulating Security Payload | A protocol used for encryption and authentication in IPsec. | | event | In the context of system logs, an observable occurrence or change of state involving a system, network, application, workload or account. | | extendable-output function | A function that uses a hash function to output a digest of a user-chosen length. This is different from a hash function that outputs a digest of a fixed length. | | facility | A physical space where business is performed. For example, a facility can be a building, a floor of a building or a designated space on the floor of a building. | | fax machine | A device that enables documents to be communicated over an analog telephone network. | | firewall | A network device that filters incoming and outgoing network data based on a series of rules. | | firmware | Software embedded in IT equipment or OT equipment. | | fly lead | A lead that connects IT equipment to the fixed infrastructure of a facility. For example, the lead that connects a workstation to a network wall socket. | | foreign national | A person who is not an Australian citizen. | | foreign system | A system that is not managed by, or on behalf of, the Australian Government. | | frontier artificial intelligence model | An AI model typically characterised by advanced reasoning, code understanding, natural language processing or multimodal capabilities, and trained at scale using state-of-the-art techniques. Such AI models can perform complex tasks that exceed the capabilities of conventional automated tools. | | gateway | Gateways securely manage data flows between connected networks from different security domains. | | hardware | A generic term for IT equipment and OT equipment. | | hardware security module | A physical computing device that safeguards cryptographic keys and provides cryptographic processing. A hardware security module is or contains a cryptographic module. Hardware security modules are commonly deployed in Public Key Infrastructure, digital identity solutions and payment systems. | | Hash-based Message Authentication Code | A cryptographic function that can be used to compute Message Authentication Codes using a hash function and a secret key. | | High Assurance Cryptographic Equipment | Cryptographic equipment that has been authorised by ASD for the protection of SECRET and TOP SECRET data. | | High Assurance Evaluation Program | The rigorous investigation, analysis, verification and validation of products by ASD to protect SECRET and TOP SECRET data. | | high assurance information technology equipment | IT equipment that has been designed and authorised for the protection of SECRET and TOP SECRET data. | | high-value server | A server that provides important network services or contains data repositories. For example, Domain Name System servers, database servers, email servers, file servers and web servers. | | human user | A human actor who is authorised to access a system and its resources. | | hybrid hard drive | Non-volatile magnetic media that uses a cache to increase read/write speeds and reduce boot times. The cache is normally non-volatile flash memory media. | | identity and access management | The identification and authentication of human and non-human actors, the authorisation and control of their access, and the monitoring of access activities. | | information technology | Hardware, software and supporting infrastructure used for the processing, storage or communication of data. | | information technology equipment | Any device that can process, store or communicate data within IT environments, such as computers, multifunction devices, network devices, smartphones, electronic storage media and smart devices. | | Infosec Registered Assessors Program | An initiative of ASD designed to register suitably qualified individuals to carry out security control assessments for systems. | | Infosec Registered Assessors Program assessment | A security control assessment conducted by a registered assessor against the requirements of the [Information security manual](#e7ce6e23-4bbb-45c1-a657-7e563c0837ed). | | infrared device | Devices such as mice, keyboards and pointing devices that have an infrared communications capability. | | insider | Any person who has, or had, authorised logical or physical access to a system and its resources. | | insider threat | An insider who performs, or attempts to perform, damaging activities (either intentionally or unintentionally) to a system or its resources. Some organisations may choose to exclude unintentional damage to systems and their resources (often referred to as negligent or accidental damage) from their definition of insider threat to focus on insiders with malicious intent (often referred to as malicious insiders). | | integrity | The assurance that data has been created, amended or deleted only by authorised entities. | | interactive authentication | Authentication that involves direct interaction by a human user. | | internet facing network device | Network devices that operate at the boundary between an organisation’s network and the internet. For example, firewalls, load balancers, routers, virtual private network (VPN) concentrators and web application firewalls. Such network devices are commonly referred to as edge devices. | | Internet Protocol Security | A suite of protocols for secure communications through authentication or encryption of Internet Protocol (IP) packets as well as including protocols for cryptographic key establishment. | | Internet Protocol telephony | The transport of telephone calls over IP networks. | | Internet Protocol version 6 | A protocol used for communicating over packet switched networks. Version 6 is the successor to version 4 that is widely used on the internet. | | intrusion detection system | An automated system used to identify malicious or unwanted activities. An intrusion detection system can be host-based or network-based. | | intrusion prevention system | An automated system used to identify malicious or unwanted activities and react in real-time to block or prevent such activities. An intrusion prevention system can be host-based or network-based. | | jump server | A computer that is used to manage important or critical resources in a separate security domain. Also known as a jump host or jump box. | | key encapsulation mechanism | An asymmetric cryptographic mechanism that enables two entities to establish a shared secret by encapsulating keying material using a public key and decapsulating it using the corresponding private key. | | key management | The use and management of cryptographic keys and associated hardware and software. It includes their generation, registration, distribution, installation, usage, protection, storage, access, recovery and destruction. | | keying material | Cryptographic keys generated or used by cryptographic equipment, applications or libraries. | | logging facility | A facility that collects and stores event logs. | | malicious actors | Human or non-human entities that conduct malicious activities, such as cyber espionage, cyber attacks or cyber-enabled crime. | | malicious code | Any software that attempts to subvert the confidentiality, integrity or availability of a system. | | malicious code infection | The occurrence of malicious code infecting a system. | | media | A generic term for hardware, often portable in nature, that is used to store data. | | media destruction | The process of physically damaging media with the intent of making data stored on it inaccessible. To destroy media effectively, only the actual material in which data is stored needs to be destroyed. | | media disposal | The process of relinquishing control of media when it is no longer required. | | media sanitisation | The process of erasing or overwriting data stored on media so that it cannot be retrieved or reconstructed. | | medical device | Devices approved by the Therapeutic Goods Administration under the [Therapeutic Goods (Medical Devices) Regulations 2002](#55852ef6-7f16-4559-8235-5014c3c3fa14) for diagnostic or therapeutic purposes. | | memory-safe programming languages | Programming languages that prevent the introduction of vulnerabilities related to memory use. Examples of memory-safe programming languages include C#, Go, Java, Ruby, Rust and Swift. Examples of non-memory-safe programming languages include Assembly and C/C++. | | metadata | Descriptive data about the content and context used to identify data. | | mobile device | A portable computing or communications device. For example, smartphones, tablets and laptop computers. | | multifunction device | IT equipment that combines printing, scanning and copying functionality in the one device. | | multi-factor authentication | Authentication using two or more different authentication factors. This may include something people know, something people have or something people are. | | need-to-know | The principle of restricting access to only the data required to fulfil an authorised role or function. | | network access control | Security policies used to control access to a network and actions on a network. This can include authentication checks and authorisation controls. | | network device | IT equipment designed to facilitate the communication of data. For example, routers, switches and wireless access points. | | network infrastructure | The infrastructure used to carry data between workstations and servers or other network devices. | | network management traffic | Network traffic generated over a network to manage or control workstations, servers and network devices. This includes standard management protocols and other network traffic that contains data relating to the management of the network. | | non-human user | A non-human actor, such as a service, application, workload or AI agent, that is authorised to access a system and its resources. | | non-interactive authentication | Authentication that does not involve direct interaction by a human user. | | non-repudiation | Providing proof that an action was performed by a particular user such that the origin of the action cannot subsequently be repudiated. | | non-volatile flash memory media | A specific type of electrically erasable programmable read-only memory. | | non-volatile media | A type of media that retains its data when power is removed. | | off-hook audio protection | A method of mitigating the possibility of an active handset inadvertently enabling background discussions to be heard by a remote party. This can be achieved by using a hold feature, mute feature, push-to-talk handset or equivalent. | | online services | Services directly accessible over the internet, including those located behind a perimeter firewall. Such services may also be referred to as internet-facing services. | | OpenPGP Message Format | A message format for encrypting, digitally signing, compressing and encoding data using OpenPGP cryptography. | | operating system | Software that provides the interface through which users access a system. Operating systems also facilitate access to user applications, server applications, mobile applications and web applications. | | operational technology | Systems that detect or cause a direct change to the physical environment through the monitoring or control of devices, processes and events. OT is predominantly used to describe industrial control systems that include supervisory control and data acquisition systems and distributed control systems. | | operational technology equipment | Any device that can process, store or communicate data or signals within OT environments, such as programmable logic controllers and remote terminal units. | | passkey | A credential that uses public-key cryptography to authenticate a human user to a system or online service. A passkey typically consists of a private key stored on, or accessible through, a computer, mobile device or security key, with a corresponding public key held by the system or online service being authenticated to. Passkey authentication may provide single-factor or multi-factor authentication. It provides multi-factor authentication where use of the private key requires a separate activation factor, such as a password or biometric. | | passphrase | A password consisting solely of a sequence of words. | | password | A sequence of characters used for authentication. Passwords consisting solely of numbers are also known as personal identification numbers, while passwords consisting solely of a sequence of words are also known as passphrases. | | password complexity | The use of different character sets, such as lower-case alphabetical characters (a-z), upper-case alphabetical characters (A-Z), numeric characters (0-9) and special characters. | | passwordless authentication | Authentication that does not involve the use of something people know. Passwordless authentication may be single-factor or multi-factor, with the latter often referred to as passwordless multi-factor authentication. | | passwordless multi-factor authentication | Multi-factor authentication using something people have that is unlocked by something people know or are. While a password may be used as part of passwordless multi-factor authentication (e.g. to unlock access to a cryptographic private key stored on a device) it is not a primary authentication factor. | | patch | A piece of software designed to remedy vulnerabilities or improve the usability or performance of operating systems, applications, IT equipment or OT equipment. | | patch cable | A metallic (copper) or fibre-optic cable used for routing signals between two components in an enclosed container or rack. | | patch panel | A group of sockets or connectors that enable manual configuration changes, generally by means of connecting patch cables. | | penetration test | A security assessment designed to exercise real-world scenarios to achieve a specific goal, such as compromising critical systems or data. | | Perfect Forward Secrecy | A property of key establishment whereby compromise of long-term keying material does not enable recovery of previously established session keys. | | peripheral switch | A device used to share a set of peripherals between multiple computers. For example, a keyboard, video monitor and mouse. | | personal identification number | A password consisting solely of numbers. | | plan of action and milestones | A document that describes vulnerabilities in a system and the plans for their rectification. | | post-quantum cryptography | Asymmetric cryptography designed to remain secure in the presence of a cryptographically relevant quantum computer. | | post-quantum traditional hybrid scheme | An asymmetric cryptographic scheme that incorporates at least two different components based on different mathematically hard problems. Generally, post-quantum traditional hybrid schemes are used to combine post-quantum cryptography and traditional cryptography such that defeating the scheme requires defeating each component. | | privileged operating environments | Privileged operating environments are those used for activities that require a degree of privileged access, such as system administration activities. | | privileged user accounts | User accounts that have the capability to modify system configurations, account privileges, event logs or security configurations. This also applies to user accounts that may only have limited privileges but still have the ability to bypass some security controls. | | product | A generic term used to describe software or hardware. | | PROTECTED area | An area that has been authorised to process, store or communicate PROTECTED data. Such areas are not necessarily tied to a specific level of security zone. | | Protection Profile | A document that stipulates the security functionality that must be included in a Common Criteria evaluation to meet a range of defined threats. Protection Profiles also define the activities to be taken to assess the security function of an evaluated product. | | protective marking | An administrative label assigned to data that not only shows the value of the data but also defines the level of protection to be provided. | | public data | Data that has been formally authorised for release into the public domain. | | public network infrastructure | Network infrastructure that an organisation has no control over, such as the internet. | | push-to-talk handsets | Handsets that have a button that needs to be pressed before audio can be communicated, thus providing off-hook audio protection. | | quality of service | The ability to provide different priorities to different applications, users or data flows, or to guarantee a certain level of performance to a data flow. | | reclassification | An administrative decision to change the security controls used to protect data based on a reassessment of the potential impact of its unauthorised disclosure. The lowering of the security controls for media containing sensitive or classified data often requires sanitisation or destruction processes to be undertaken prior to a formal decision to lower the security controls protecting the data. | | Releasable To data | Data not to be passed to, or accessed by, foreign nationals beyond those belonging to specific nations that the data has been authorised for release to. | | remote access | Access to a system that originates from outside an organisation’s network and enters the network through a gateway, including over the internet. | | removable media | Storage media that can be easily removed from a system and is designed for removal, such as Universal Serial Bus flash drives and optical media. | | seconded foreign national | A representative of a foreign government on exchange or long-term posting. | | SECRET area | An area that has been authorised to process, store or communicate SECRET data. Such areas are not necessarily tied to a specific level of security zone. | | Secure Admin Workstation | A hardened workstation, or virtualised privileged operating environment, used specifically in the performance of administrative activities. | | Secure by Default | A software development principle whereby products and services are configured for maximum security by default. | | Secure by Demand | When a customer requests that their suppliers provide evidence of their commitment to security and transparency for their products and services. | | Secure by Design | A software development principle whereby security is designed into every stage of a product or service’s development. | | secure channel | A path for transferring data between two entities that ensures confidentiality and integrity, as well as mutual authentication, between the two entities. | | Secure Shell | A network protocol that can be used to securely log into, execute commands on, and transfer files between remote workstations and servers. | | Secure/Multipurpose Internet Mail Extensions | A protocol that enables the encryption and signing of email messages. | | secured space | An area certified to the physical security requirements for a Security Zone Two to Security Zone Five area, as defined in the Department of Home Affairs’ [Protective Security Policy Framework](#92679127-f61d-486a-a93e-df2a26dfb07a). | | security assessment | An activity designed to provide assurance in the security posture of a system and its operating environment. Security assessments can include security control assessments, vulnerability scanning, vulnerability assessments and penetration tests. | | security assessment plan | A document that describes the agreed scope, type and extent of assessment activities as part of a security control assessment. | | security assessment report | A document that describes the outcomes of a security control assessment and contributes to the development of a plan of action and milestones. | | security association | A collection of connection-specific parameters used for IPsec connections. | | security association lifetime | The duration a security association is valid for. | | Security Construction and Equipment Committee | An Australian Government interdepartmental committee responsible for the evaluation and endorsement of security equipment and services. The committee is chaired by the Australian Security Intelligence Organisation. | | security control | A safeguard implemented for a system or its operating environment to protect the confidentiality, integrity or availability of data. | | security control assessment | A security assessment activity undertaken to assess security controls for a system and its environment to determine if they have been implemented correctly and are operating as intended. | | security domain | A system or collection of systems operating under a consistent security policy that defines the classification, releasability and special handling caveats for data processed within the domain. | | security posture | The level of security risk to which a system is exposed. A system with a strong security posture is exposed to a low level of security risk while a system with a weak security posture is exposed to a high level of security risk. | | security risk | The likelihood and consequence of an event that could result in the compromise, loss of integrity or unavailability of systems, their resources or data, or deliberate harm to people. | | security risk management | The process of identifying, assessing and taking steps to reduce security risks to an acceptable level. | | security target | An artefact of Common Criteria evaluations that specifies conformance claims, threats and assumptions, security objectives, and security requirements for an evaluated product. | | sensitive data | Data that would cause damage to an organisation or an individual if compromised. | | server | A computer that provides services to users or other systems. For example, a file server, email server or database server. | | service accounts | User accounts used by non-human users to perform automated tasks without manual intervention, such as machine-to-machine communications. Service accounts will typically be configured to disallow interactive logins. | | shared facility | A facility shared by multiple tenants. For example, a single floor, or part of a floor, within a multi-tenanted building. | | shared responsibility model | A framework that describes the management and operational responsibilities between different parties for a system. Where responsibilities relating to specific security controls are shared between multiple parties, enough detail is documented to provide clear demarcation between the parties. | | software | An element of a system including, but not limited to, an operating system or application. | | solid-state drive | Non-volatile media that uses non-volatile flash memory media to retain its data when power is removed and, unlike non-volatile magnetic media, contains no moving parts. | | split tunnelling | Functionality that enables a device to access public network infrastructure and a VPN connection at the same time. | | standard operating environment | A standardised build of an operating system and associated applications that can be used for servers, workstations and mobile devices. | | supplier | Organisations, such as software developers, IT equipment manufacturers, OT equipment manufacturers, service providers and data brokers, that provide products and services. Suppliers can also include other organisations involved in distribution channels. | | symmetric cryptographic algorithms | Cryptographic algorithms that use the same key for encryption and decryption. Block ciphers and stream ciphers are common types of symmetric cryptographic algorithms. | | system | The cyber supply chain, infrastructure, operating systems and applications supporting the processing, storage or communication of data, including the governance framework within which they operate. | | system administrator | A system administration role performed by a human user with privileged access. | | system owner | The executive responsible for a system. | | system security plan | A document that describes a system and its associated security controls. | | system-specific cyber security documentation | A system’s system security plan, cyber security incident response plan, change and configuration management plan, continuous monitoring plan, security assessment report, and plan of action and milestones. | | telemetry | The automatic measurement and transmission of data collected from remote sources. Such data is often used within systems to measure the use, performance and health of one or more functions or devices that make up the system. | | telephone | A device that is used for point-to-point communication over a distance. This includes digital and IP telephony. | | telephone system | A system designed primarily for the transmission of voice communications. | | TOP SECRET area | An area that has been authorised to process, store or communicate TOP SECRET data. Such areas are not necessarily tied to a specific level of security zone. | | traditional cryptography | Common well studied and understood cryptographic algorithms that existed before the threat of a cryptographically relevant quantum computer existed. | | transfer cross domain solution | A system that facilitates the transfer of data in one or more directions between different security domains. | | transport mode | An IPsec mode that provides a secure connection between two endpoints by encapsulating an IP payload. | | trustworthy source | A person or system formally identified as being capable of reliably producing data meeting certain defined parameters, such as a maximum data classification and reliably reviewing data produced by others to confirm compliance with certain defined parameters. | | trustworthy supplier | A supplier that has been verified as trustworthy as part of a cyber supply chain risk management assessment and subsequently documented on an organisation’s approved supplier list. | | tunnel mode | An IPsec mode that provides a secure connection between two endpoints by encapsulating an entire IP packet. | | unprivileged user accounts | User accounts that do not have the capability to modify system configurations, account privileges, event logs or security configurations. | | unprivileged operating environments | Unprivileged operating environments are those used for activities that do not require privileged access, such as reading emails and browsing the web. | | user | A human or non-human actor that is authorised to access a system and its resources. | | user accounts | Accounts used by users to access systems and their resources, excluding computer accounts. User accounts include privileged user accounts and unprivileged user accounts. | | validation | Confirmation that stakeholder requirements for the intended use of operating systems, applications, IT equipment or OT equipment have been met. | | verification | Confirmation that design or compliance requirements for operating systems, applications, IT equipment or OT equipment have been met. | | virtual local area network | Network devices and networked IT equipment grouped logically based on resources, security or business requirements instead of their physical location. | | virtual private network | A network that maintains privacy through a tunnelling protocol and security procedures. VPNs may use encryption to protect network traffic. | | virtualisation | Simulation of hardware or software resources. | | volatile media | A type of media, such as random-access memory, that gradually loses its data when power is removed. | | vulnerability | A weakness in a system’s security requirements, design, implementation or operation that could be accidentally triggered or intentionally exploited and result in a violation of the system’s security policy. | | vulnerability assessment | A security assessment involving a review of a system’s architecture or an in-depth hands-on assessment to identify as many potential vulnerabilities as possible. | | vulnerability scan | A security assessment using tools to conduct automated checks for known vulnerabilities in a system and its environment. | | wear levelling | A technique used in non-volatile flash memory media to prolong the life of the media. As data can be written to and erased from memory blocks a finite number of times, wear-levelling helps to distribute writes evenly across each memory block, decreasing wear and increasing its lifetime. | | Wi-Fi Protected Access | A security standard for protecting wireless networks. | | Wi-Fi Protected Access 2 | A successor to Wi-Fi Protected Access that provides enhanced security for wireless networks. | | Wi-Fi Protected Access 3 | A successor to Wi-Fi Protected Access 2 that provides further enhanced security for wireless networks. | | wireless access point | A device that enables communications between wireless clients. It is typically also the device that connects wired and wireless networks. | | wireless communications | The transmission of data over a communications path using electromagnetic waves rather than a wired medium. | | wireless network | A network based on 802.11 standards. | | workstation | A stand-alone or networked single-user computer. | | X11 forwarding | X11, also known as the X Window System, is a basic method of video display used in a variety of operating systems. X11 forwarding enables the video display from one device to be shown on another device. | back-matter: resources: - uuid: 014064b7-5b77-4a79-af6c-79a16f4d0cb2 title: ICT Supply Chain Resource Library rlinks: - href: https://www.cisa.gov/ict-supply-chain-resource-library - uuid: 022fcd70-df8b-45ee-ae19-fb9cfe7b6cb6 title: Events to monitor rlinks: - href: https://learn.microsoft.com/en-au/windows-server/identity/ad-ds/plan/appendix-l--events-to-monitor - uuid: 0248ace8-2e08-40f8-b19e-117c76909cf1 title: Engaging with artificial intelligence rlinks: - href: https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/engaging-with-artificial-intelligence - uuid: 02fb4cb5-e4c4-4097-97a2-f1b6aa04131a title: Patching applications and operating systems rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/system-administration/patching-applications-and-operating-systems - uuid: 03f761fa-7014-459c-aa16-02c303d50abb title: reporting vulnerabilities rlinks: - href: https://www.cyber.gov.au/report-and-recover/report/report-a-vulnerability - uuid: 041bce05-55ad-4a2a-93e3-c582d39fce94 title: "Cyber security incident response planning: Practitioner guidance" rlinks: - href: https://www.cyber.gov.au/business-government/detecting-responding-to-threats/cyber-security-incident-response/cyber-security-incident-response-planning-practitioner-guidance - uuid: 0508be6f-cb97-44da-b212-42416a0048b0 title: random dice roller rlinks: - href: https://www.random.org/dice/?num=5 - uuid: 065263a6-4634-4a52-bd3f-48b83bf437d8 title: "Managing the risks of legacy IT: Executive guidance" rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/legacy-technology-management/managing-the-risks-of-legacy-it-executive-guidance - uuid: 089badd3-ed47-4597-8b1f-bce3e42f4ac4 title: "Managing the risks of legacy IT: Practitioner guidance" rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/legacy-technology-management/managing-the-risks-of-legacy-it-practitioner-guidance - uuid: 0a1508c0-b062-4d85-8ded-a95316e17a3a title: command line process logging rlinks: - href: https://learn.microsoft.com/en-au/windows-server/identity/ad-ds/manage/component-updates/command-line-process-auditing - uuid: 0acc5064-2b41-4479-b396-8ca6bcdc24b1 title: "Guidance for Implementing M-21-31: Improving the Federal Government’s Investigative and Remediation Capabilities" rlinks: - href: https://www.cisa.gov/sites/default/files/2023-02/TLP%20CLEAR%20-%20Guidance%20for%20Implementing%20M-21-31_Improving%20the%20Federal%20Governments%20Investigative%20and%20Remediation%20Capabilities_.pdf - uuid: 0b1a477d-b08a-4491-9cfc-c9d435b28dc8 title: Planning for post-quantum cryptography rlinks: - href: https://www.cyber.gov.au/business-government/secure-design/quantum/planning-for-post-quantum-cryptography - uuid: 0bf3a1ef-031a-419b-80c3-08a08b1cee9d title: Microsoft Security Baselines Blog rlinks: - href: https://techcommunity.microsoft.com/category/security-baselines/blog/microsoft-security-baselines - uuid: 0cae2aee-3762-482f-8ffe-850e98d7d605 title: "Mitigation strategies for edge devices: Practitioner guidance" rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/hardening-systems-applications/network-hardening/securing-edge-devices/mitigation-strategies-for-edge-devices-practitioner-guidance - uuid: 0d7243fc-65f0-4b4e-9358-bf4f6e0e34d7 title: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations rlinks: - href: https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final - uuid: 0d9d5f12-3519-4585-82d9-bc0f42abcd3c title: IoT Secure by Design guidance for manufacturers rlinks: - href: https://www.cyber.gov.au/business-government/secure-design/secure-by-design/iot-secure-by-design-guidance-for-manufacturers - uuid: 0e982561-93dc-4cf7-9a98-e91411e99ca6 title: Bring Your Own Device for executives rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/remote-working-secure-mobility/secure-mobility/bring-your-own-device-for-executives - uuid: 11372646-3106-42c6-b3e1-444b3f630462 title: Australian Government Email Protective Marking Standard rlinks: - href: https://www.protectivesecurity.gov.au/publications-library/australian-government-email-protective-marking-standard-2025 - uuid: 1258a1ce-774a-4701-8d47-80940b988a2d title: Adversarial Threat Landscape for Artificial-Intelligence Systems rlinks: - href: https://atlas.mitre.org/ - uuid: 131048c7-a2e7-4da3-9257-7a058b06c1f8 title: Secure administration rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/system-administration/secure-administration - uuid: 14ef2c5e-67a1-4fef-9264-e86e2a078ffa title: Establishing a Coordinated Vulnerability Disclosure Program to Work With Security Researchers rlinks: - href: https://www.cisa.gov/resources-tools/resources/establishing-coordinated-vulnerability-disclosure-program-work-security-researchers - uuid: 15d9668e-8aa4-4f80-b6e5-05400621cfb4 title: National Information Assurance Partnership rlinks: - href: https://www.niap-ccevs.org/ - uuid: 18203e18-2aca-492e-be44-770b2f47242f title: AV-TEST rlinks: - href: https://www.av-test.org/en/ - uuid: 18274424-7086-419e-9fae-a6ba64870459 title: OWASP Top 10 Proactive Controls 2024 rlinks: - href: https://owasp.org/www-project-proactive-controls/ - uuid: 188466f6-be12-49ce-b99a-981e54b1663e title: reporting cybercrime incidents rlinks: - href: https://reportapp.cyber.gov.au/ - uuid: 195abe87-bb1e-4006-8b42-eaecca4d51f1 title: Guidelines for cryptography rlinks: - href: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/cyber-security-guidelines/guidelines-for-cryptography - uuid: 197db872-c6a9-4b29-9888-1552e908252c title: "FIPS 140-3 Derived Test Requirements (DTR): CMVP Validation Authority Updates to ISO/IEC 24759" rlinks: - href: https://csrc.nist.gov/pubs/sp/800/140/final - uuid: 19947ae5-678c-4dc0-a35e-283e4af1284c title: Supply chain security guidance rlinks: - href: https://www.ncsc.gov.uk/collection/supply-chain-security - uuid: 1ba81b1c-8e4b-4d7c-85b4-6175ea5fc9bf title: Prerequisites for Microsoft Entra Connect rlinks: - href: https://learn.microsoft.com/en-au/entra/identity/hybrid/connect/how-to-connect-install-prerequisites - uuid: 1dbda98a-4e8b-4a52-b4f7-9d1a895fd324 title: "Priority logs for SIEM ingestion: Practitioner guidance" rlinks: - href: https://www.cyber.gov.au/business-government/detecting-responding-to-threats/event-logging/implementing-siem-soar-platforms/priority-logs-for-siem-ingestion-practitioner-guidance - uuid: 1e4a57a2-2832-441d-8ea4-12a98d2be417 title: Australian Privacy Principles guidelines rlinks: - href: https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines - uuid: 1ecfc41e-f6a8-4c96-ac41-1587718ca459 title: Network Infrastructure Security Guide rlinks: - href: https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2949885/nsa-details-network-infrastructure-best-practices/ - uuid: 1eefdaf7-3991-4ba2-9439-79565f508c44 title: Guidelines for data transfers rlinks: - href: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/cyber-security-guidelines/guidelines-for-data-transfers - uuid: 219fa690-b9c0-4e76-9333-d5136a5582d1 title: Information security manual OSCAL catalog - latest version rlinks: - href: https://www.cyber.gov.au/ism/oscal/latest-version/artifacts/ISM_catalog.xml media-type: application/xml - href: https://www.cyber.gov.au/ism/oscal/latest-version/artifacts/ISM_catalog.json media-type: application/json - href: https://www.cyber.gov.au/ism/oscal/latest-version/artifacts/ISM_catalog.yaml media-type: application/oscal+yaml - uuid: 231b9f0c-6f88-4ead-ac34-acd2a24a0008 title: Common Criteria rlinks: - href: https://www.commoncriteriaportal.org/index.cfm - uuid: 233c7982-dc01-496e-b761-b24ac06ded49 title: "Artificial intelligence and machine learning: Supply chain risks and mitigations" rlinks: - href: https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/artificial-intelligence-and-machine-learning-supply-chain-risks-and-mitigations - uuid: 23d977b2-e64e-4ebc-a59f-cd95212045c5 title: Implementing network segmentation and segregation rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/hardening-systems-applications/network-hardening/implementing-network-segmentation-and-segregation - uuid: 24eb9af8-fb43-4772-a461-2c36dd0f6d7e title: recommended contents for a ‘security.txt’ file rlinks: - href: https://securitytxt.org/ - uuid: 26137381-dc34-485c-8331-3bc9876ed48c title: Software Memory Safety rlinks: - href: https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/3215760/nsa-releases-guidance-on-how-to-protect-against-software-memory-safety-issues/ - uuid: 2667c626-d3e8-4ee5-9044-2ada9f133df2 title: Practical cyber security tips for business leaders rlinks: - href: https://www.cyber.gov.au/business-government/protecting-business-leaders/cyber-security-for-business-leaders/practical-cyber-security-tips-for-business-leaders - uuid: 28cd91d2-e5cb-4896-bcfc-abb32e05e61d title: Cryptographic Module Validation Program rlinks: - href: https://csrc.nist.gov/projects/cryptographic-module-validation-program - uuid: 29b04eaf-5f57-4ea1-a453-8047826dccf5 title: Certified Products List rlinks: - href: https://commoncriteriaportal.org/products/index.cfm - uuid: 2d003129-793e-4263-92ee-f6d02d016023 title: Australian Government Gateway Security Standard rlinks: - href: https://www.protectivesecurity.gov.au/publications-library/australian-government-gateway-security-standard-2025 - uuid: 2d78eb83-ba21-4fe3-8466-e6d1cd8ee6dc title: "Cloud shared responsibility model: Executive guidance" rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/cloud-computing/cloud-shared-responsibility-model-executive-guidance - uuid: 2e11877b-2dcb-46d1-814f-c516290175d3 title: Using the cyber security framework rlinks: - href: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/using-the-cyber-security-framework - uuid: 315744ea-3523-4c93-838d-fe2848ac4181 title: Guide to Bluetooth Security rlinks: - href: https://csrc.nist.gov/pubs/sp/800/121/r2/upd1/final - uuid: 32c8fa3a-45bb-4f88-baee-73a7696aa2ad title: Security Requirements for Cryptographic Modules rlinks: - href: https://csrc.nist.gov/pubs/fips/140-3/final - uuid: 331263bc-3314-496b-9d35-76788eb0f403 title: Detecting and mitigating Active Directory compromises rlinks: - href: https://www.cyber.gov.au/business-government/detecting-responding-to-threats/detecting-and-mitigating-active-directory-compromises - uuid: 332a65d2-2836-47fa-85fd-1ec2f28edacc title: Vulnerability disclosure programs explained rlinks: - href: https://www.cyber.gov.au/business-government/detecting-responding-to-threats/vulnerability-planning/vulnerability-disclosure-programs-explained - uuid: 33d26cdd-51fc-45d3-a026-0814d51a4c7e title: Security Recommendations for Server-based Hypervisor Platforms rlinks: - href: https://csrc.nist.gov/pubs/sp/800/125/a/r1/final - uuid: 347eee88-cb61-44b9-81ce-ab97dd08387c title: Cloud computing security for cloud service providers rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/cloud-computing/cloud-computing-security-for-cloud-service-providers - uuid: 348be728-4459-4447-990e-1dfb3049c71f title: data retention rlinks: - href: https://www.naa.gov.au/information-management/records-authorities/types-records-authorities/afda-express-version-2-functions - uuid: 353dcc1a-23e6-48d5-8047-950cc614bf0b title: Guidelines for secure AI system development rlinks: - href: https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development - uuid: 355b47b5-6253-4be5-ba7c-274833d84b75 title: ROA records rlinks: - href: https://www.apnic.net/community/security/resource-certification/#routing - uuid: 37f65b5b-ce8c-4137-9c84-41678af1e70e title: Cyber supply chain risk management rlinks: - href: https://www.cyber.gov.au/business-government/supplier-cyber-risk-management/managing-cyber-supply-chains/cyber-supply-chain-risk-management - uuid: 388c3570-58ed-40be-be5e-bdfba9cfee1d title: Careful adoption of agentic AI services rlinks: - href: https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/careful-adoption-of-agentic-ai-services - uuid: 39e186f3-d175-4eed-afe6-2b9a7a936a91 title: MemtestG80 rlinks: - href: https://github.com/ihaque/memtestG80 - uuid: 3a1a00f6-2f56-4d04-b99d-6f1682b95a98 title: detect or prevent various stages of network intrusions rlinks: - href: https://evals.mitre.org/ - uuid: 3a7b903b-ed0d-450d-9123-60f6f8fd5dd2 title: Guidelines for communications systems rlinks: - href: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/cyber-security-guidelines/guidelines-for-communications-systems - uuid: 3ccea9a8-a728-4f5b-a0a8-43f2f206f76b title: Restricting administrative privileges rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/system-administration/restricting-administrative-privileges - uuid: 3df21b72-0559-4bbf-a990-5ee509f70747 title: Gateway security guidance package rlinks: - href: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/gateway-security-guidance-package - uuid: 3e5a98e5-9219-46c8-81c2-e3a4d13407ce title: Active Directory Forest Recovery - Reset the krbtgt password rlinks: - href: https://learn.microsoft.com/en-au/windows-server/identity/ad-ds/manage/forest-recovery-guide/ad-forest-recovery-reset-the-krbtgt-password - uuid: 3f349d16-11a1-459a-a299-c9446aea7597 title: Guidelines for database systems rlinks: - href: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/cyber-security-guidelines/guidelines-for-database-systems - uuid: 3f43c8d2-8a8c-4e2f-af80-48a607bce643 title: Local Security Authority protection functionality rlinks: - href: https://learn.microsoft.com/en-au/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection - uuid: 401ed034-e2bd-43b4-9fde-05d07618039a title: Center for Memory and Recording Research rlinks: - href: https://cmrr.ucsd.edu/resources/secure-erase.html - uuid: 403f72c6-3e85-4185-8df3-130b2a6b25b3 title: "Cyber security incident response planning: Executive guidance" rlinks: - href: https://www.cyber.gov.au/business-government/detecting-responding-to-threats/cyber-security-incident-response/cyber-security-incident-response-planning-executive-guidance - uuid: 42e7d99d-9709-4355-a54d-98959c552aa1 title: Cryptographic Algorithm Validation Program rlinks: - href: https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program - uuid: 43fbcaf9-03a3-493a-83be-9340a37778fa title: Hardening Microsoft Windows 11 workstations rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/hardening-systems-applications/system-hardening/hardening-microsoft-windows-11-workstations - uuid: 45889c11-aad2-4eef-a8fb-81e12b5ee7fe title: Privileged User Training rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/system-administration/privileged-user-training - uuid: 45899752-c83f-4976-bc99-03f6824a0793 title: How to manage your security when engaging a managed service provider rlinks: - href: https://www.cyber.gov.au/business-government/supplier-cyber-risk-management/managed-service-providers/how-to-manage-your-security-when-engaging-a-managed-service-provider - uuid: 490f4622-8562-4333-a263-b64f660620e8 title: Cyber Security Toolkit for Boards rlinks: - href: https://www.ncsc.gov.uk/collection/board-toolkit - uuid: 493f335d-298a-4891-9a73-de2b5e6d8a89 title: Information security manual props: - name: published value: 2026-09-03T00:00:00+10:00 - name: version value: 2026.09.03 rlinks: - href: https://www.cyber.gov.au/ism/pdf/v2026.09.03-pdf media-type: application/pdf - uuid: 4974639a-f41a-4280-ae06-33d1f13d6083 title: Secure by Design Pledge rlinks: - href: https://www.cisa.gov/securebydesign/pledge - uuid: 4a3a265f-7772-433b-9906-7f784052f28b title: vulnerable driver blocklist rlinks: - href: https://learn.microsoft.com/en-au/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules - uuid: 4b0f2fa7-f9d6-48d8-b14c-527939808882 title: Trustworthy Email rlinks: - href: https://csrc.nist.gov/pubs/sp/800/177/r1/final - uuid: 4bebe303-7a91-4ffa-90d8-8df9f80a6318 title: "Implementing SIEM and SOAR platforms: Executive guidance" rlinks: - href: https://www.cyber.gov.au/business-government/detecting-responding-to-threats/event-logging/implementing-siem-soar-platforms/implementing-siem-and-soar-platforms-executive-guidance - uuid: 4da9c9bd-48a5-48dc-81e6-e005c037e998 title: 2026 Minimum Elements for a Software Bill of Materials (SBOM) rlinks: - href: https://www.cisa.gov/resources-tools/resources/2026-minimum-elements-software-bill-materials-sbom - uuid: 4deea7ea-18a2-4fd7-8b25-0b3603215df2 title: Guidelines for physical security rlinks: - href: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/cyber-security-guidelines/guidelines-for-physical-security - uuid: 4defa9a8-c5f5-4b39-8b0a-537f14d9d14d title: Guidelines for communications infrastructure rlinks: - href: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/cyber-security-guidelines/guidelines-for-communications-infrastructure - uuid: 4e01708d-9c2d-4a84-a08a-cb98077235a6 title: "Implementing SIEM and SOAR platforms: Practitioner guidance" rlinks: - href: https://www.cyber.gov.au/business-government/detecting-responding-to-threats/event-logging/implementing-siem-soar-platforms/implementing-siem-and-soar-platforms-practitioner-guidance - uuid: 4ea4e1e9-09f5-46c2-b003-352bc862d5ed title: "Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy" rlinks: - href: https://csrc.nist.gov/pubs/sp/800/37/r2/final - uuid: 4eeff329-cea0-4baf-a80b-8b0b76436075 title: Implementing application control rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/hardening-systems-applications/system-hardening/implementing-application-control - uuid: 506198a8-7ae8-4c95-8b7b-2a4833cfab4b title: Guidelines for software development rlinks: - href: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/cyber-security-guidelines/guidelines-for-software-development - uuid: 53d281fa-1f25-4d33-9d6b-a5831851df50 title: Guidance on digital forensics and protective monitoring specifications for producers of network devices and appliances rlinks: - href: https://www.ncsc.gov.uk/guidance/guidance-on-digital-forensics-protective-monitoring - uuid: 53da8dba-961e-4222-94e0-68cb9510384d title: digital preservation planning rlinks: - href: https://www.naa.gov.au/information-management/legislation/digital-preservation-planning - uuid: 55038d94-7587-4234-a18c-fb459fcdb295 title: Domain Name System-Based Electronic Mail Security rlinks: - href: https://csrc.nist.gov/pubs/sp/1800/6/final - uuid: 5516125f-d0eb-4196-8dc4-f8db55fca032 title: DevSecOps Guidelines rlinks: - href: https://owasp.org/www-project-devsecops-guideline/latest/02-Vulnerability-Scanning - uuid: 55852ef6-7f16-4559-8235-5014c3c3fa14 title: Therapeutic Goods (Medical Devices) Regulations 2002 rlinks: - href: https://www.legislation.gov.au/F2002B00237/latest/text - uuid: 578d0434-6b3f-46f3-aad8-c7ac75c2ebcc title: Guidelines for cyber security documentation rlinks: - href: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/cyber-security-guidelines/guidelines-for-cyber-security-documentation - uuid: 57c58870-2ebb-4fce-b995-0c86cb64002f title: AISEP rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/assessment-evaluation-programs/australian-information-security-evaluation-program - uuid: 58282062-5c17-476a-98b1-105a627cd28d title: randomly generating passphrases rlinks: - href: https://www.eff.org/dice - uuid: 58589044-8b34-4d46-bf70-103ee8d10bc9 title: Managing cryptographic keys and secrets rlinks: - href: https://www.cyber.gov.au/business-government/secure-design/secure-by-design/managing-cryptographic-keys-and-secrets - uuid: 585f4feb-d589-4a8e-868a-9ae60cf822ea title: ASD Cyber Security Network Partners rlinks: - href: https://www.cyber.gov.au/asds-cyber-security-partnership-program - uuid: 58c9abfb-58fe-416e-a279-dfbfe123c99f title: "Hardening Microsoft 365, Office 2021, Office 2019 and Office 2016" rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/hardening-systems-applications/system-hardening/hardening-microsoft-365-office-2021-office-2019-and-office-2016 - uuid: 5935bbd2-883f-45e1-861e-e33a1e279063 title: OWASP Mobile Application Security Verification Standard version 2.1.0 rlinks: - href: https://mas.owasp.org/ - uuid: 5a2ed3ef-afcc-485e-8014-5107e9ed97e3 title: recommended application blocklist rlinks: - href: https://learn.microsoft.com/en-au/windows/security/application-security/application-control/app-control-for-business/design/applications-that-can-bypass-appcontrol - uuid: 5d217b62-2aa7-4d9c-93cc-da3916279802 title: Risk management – Guidelines rlinks: - href: https://www.iso.org/standard/65694.html - uuid: 6136b137-0cc9-4d21-94ee-0abfac2b4e18 title: Malicious email mitigation strategies rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/hardening-systems-applications/email-hardening/malicious-email-mitigation-strategies - uuid: 616fce77-495b-472a-a552-7593ab64f188 title: "Security configuration guide: Samsung Galaxy S10, S20 and Note 20 devices" rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/hardening-systems-applications/mobility-hardening/security-configuration-guide-samsung-galaxy-s10-s20-and-note-20-devices - uuid: 626d3582-3caf-49d6-89d5-4b8fdbbf1f31 title: reporting cyber security incidents rlinks: - href: https://www.cyber.gov.au/report-and-recover/report/report-a-cyber-security-incident - uuid: 626dab35-81ab-45fe-8c12-0faff1c23c07 title: Guidelines for cyber security roles rlinks: - href: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/cyber-security-guidelines/guidelines-for-cyber-security-roles - uuid: 629818d8-430c-4125-8fd2-5e3f988fce21 title: MemTest86 rlinks: - href: https://www.memtest86.com/ - uuid: 63b0d043-b6b3-4e2b-bca8-99b42cfd9904 title: Selecting a Protective DNS Service rlinks: - href: https://www.cisa.gov/news-events/alerts/2021/03/04/joint-nsa-and-cisa-guidance-strengthening-cyber-defense-through-protective-dns - uuid: 63bba9d2-127e-41d5-b735-e0cf3fe4b9aa title: Windows 11 Security Book rlinks: - href: https://learn.microsoft.com/en-au/windows/security/book/ - uuid: 63e87a07-3ac7-4cd7-a712-bb2a8150ec58 title: Security tips for social media and messaging services rlinks: - href: https://www.cyber.gov.au/business-government/protecting-business-leaders/security-tips-for-social-media-and-messaging-services - uuid: 6494bba4-bdb5-4b19-8f6c-8d5506a8bb09 title: Secure by Design foundations rlinks: - href: https://www.cyber.gov.au/business-government/secure-design/secure-by-design/secure-by-design-foundations - uuid: 672e85cc-2d40-46ba-9e94-c604b9731c75 title: secure programming practices rlinks: - href: https://www.sei.cmu.edu/secure-development/ - uuid: 69c67e26-82cf-426a-8358-0e486b5a9287 title: Risk management – Risk assessment techniques rlinks: - href: https://www.iso.org/standard/72140.html - uuid: 6b4353e0-7281-49f4-a520-f35a4cceec71 title: examples of client-side JavaScript controls rlinks: - href: https://noscript.net/ - uuid: 6cd11202-0ce1-455e-95e5-d0b40d78efe4 title: Alerts and advisories rlinks: - href: https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories - uuid: 6e17dd11-a1c5-4f2b-87df-c5edde5fc8bd title: "AI Data Security: Best Practices for Securing Data Used to Train \\& Operate AI Systems" rlinks: - href: https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4192332/nsas-aisc-releases-joint-guidance-on-the-risks-and-best-practices-in-ai-data-se/ - uuid: 6f1f2f2b-abe6-46e4-9c9d-8339f1d9dab7 title: "Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities" rlinks: - href: https://csrc.nist.gov/pubs/sp/800/218/final - uuid: 6fac5a84-b86e-405f-b2b3-8c13ecee4a02 title: Privacy Act 1988 rlinks: - href: https://www.legislation.gov.au/C2004A03712/latest/text - uuid: 741ab440-5759-4571-894d-e499dea3a54c title: Chrome Browser Enterprise Security Configuration Guide (Windows) rlinks: - href: https://support.google.com/chrome/a/answer/9710898?hl=en - uuid: 76068c96-8d89-4c37-9eef-03488d5e1b1d title: Questions to ask managed service providers rlinks: - href: https://www.cyber.gov.au/business-government/supplier-cyber-risk-management/managed-service-providers/questions-to-ask-managed-service-providers - uuid: 76087ab6-88d4-4610-9a98-6ddc5f7bd7e6 title: OWASP API Security Top 10 2023 rlinks: - href: https://owasp.org/API-Security/editions/2023/en/0x00-header/ - uuid: 76d68682-44dd-4e97-98c8-66db2cce1fda title: Guidelines for system access rlinks: - href: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/cyber-security-guidelines/guidelines-for-system-access - uuid: 78a48231-9963-4f78-962a-861c96c58ead title: Starting a Vulnerability Disclosure Program rlinks: - href: https://developers.google.com/android/play-protect/starting-a-vdp - uuid: 7d16ae67-87a7-4861-b939-e13ec279b5a2 title: Guidelines for personnel security rlinks: - href: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/cyber-security-guidelines/guidelines-for-personnel-security - uuid: 7d22400c-ddef-4cbb-90f1-7502dc569e5b title: the use of PowerShell by blue teams rlinks: - href: https://devblogs.microsoft.com/powershell/powershell-the-blue-team/ - uuid: 7da35efd-7196-4aba-bd79-30c19e8ef48b title: RPKI rlinks: - href: https://www.apnic.net/community/security/resource-certification/#resource-certification - uuid: 7ffd20ed-4f40-43be-a37b-97e7a1b31e2f title: The CERT Guide to Coordinated Vulnerability Disclosure rlinks: - href: https://www.sei.cmu.edu/library/the-cert-guide-to-coordinated-vulnerability-disclosure-2/ - uuid: 8132c47e-a2dc-4dd9-81d6-38db96e5cec6 title: Hardening Linux workstations and servers rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/hardening-systems-applications/system-hardening/hardening-linux-workstations-and-servers - uuid: 81401de7-184d-4535-a3f7-4de1c336630f title: Guide for Conducting Risk Assessments rlinks: - href: https://csrc.nist.gov/pubs/sp/800/30/r1/final - uuid: 82ae76a4-ed9e-4a7b-8bad-f1950c41eab7 title: attack surface reduction rules overview rlinks: - href: https://learn.microsoft.com/en-au/defender-endpoint/attack-surface-reduction-rules-overview?view=o365-worldwide - uuid: 83e3a9b1-5057-4531-91dd-03c8d92634b0 title: Implementing multi-factor authentication rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/hardening-systems-applications/system-hardening/implementing-multi-factor-authentication - uuid: 84d3cbab-ab84-4981-a4f7-2bd469c8deaf title: the purpose of IRAP rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/assessment-evaluation-programs/irap - uuid: 85c9b592-8734-4860-8243-ac0821f78854 title: Australian cabling standards rlinks: - href: https://www.acma.gov.au/australian-cabling-standards - uuid: 85ee803a-b711-443b-98bf-b279de8fbed0 title: Identifying cyber supply chain risks rlinks: - href: https://www.cyber.gov.au/business-government/supplier-cyber-risk-management/managing-cyber-supply-chains/identifying-cyber-supply-chain-risks - uuid: 86814651-26b5-43f5-807d-0040c2d71169 title: "Planning for critical vulnerabilities: What the board of directors needs to know" rlinks: - href: https://www.cyber.gov.au/business-government/detecting-responding-to-threats/vulnerability-planning/planning-for-critical-vulnerabilities-what-the-board-of-directors-needs-to-know - uuid: 86847be4-3a06-4d2f-9952-447158593e0d title: Introduction to Cross Domain Solutions rlinks: - href: https://www.cyber.gov.au/business-government/secure-design/secure-by-design/cross-domain-solutions/introduction-to-cross-domain-solutions - uuid: 887c65c3-c853-41c6-89d5-3f297108889e title: Application Container Security Guide rlinks: - href: https://csrc.nist.gov/pubs/sp/800/190/final - uuid: 890d202b-ec79-4ea7-b0df-0cf7d7b7ad29 title: OWASP Top 10 for LLM Applications 2025 rlinks: - href: https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/ - uuid: 89a4e4d7-0075-40f1-ae05-dff0a19183f9 title: Secure by Design Principles rlinks: - href: https://www.security.gov.uk/policy-and-guidance/secure-by-design/principles/ - uuid: 8a0daed2-8840-443f-a83e-68252d2dcdc5 title: "Supply Chain Cyber Security: In Safe Hands" rlinks: - href: https://www.ncsc.govt.nz/protect-your-organisation/supply-chain-cyber-security-in-safe-hands/ - uuid: 8a67ffd7-61a4-4773-a1e7-e6b146f51d62 title: Foundations for modern defensible architecture rlinks: - href: https://www.cyber.gov.au/business-government/secure-design/secure-by-design/modern-defensible-architecture/foundations-for-modern-defensible-architecture - uuid: 8d53ee7f-54c2-4380-8408-f7403db30ba1 title: Credential Guard functionality rlinks: - href: https://learn.microsoft.com/en-au/windows/security/identity-protection/credential-guard/ - uuid: 8edb7798-5d97-4811-a8ba-add3d5a123cf title: Australian Register of Therapeutic Goods rlinks: - href: https://www.tga.gov.au/products/australian-register-therapeutic-goods-artg - uuid: 8f1965a9-a6a1-4342-bfb8-797ea358db30 title: Information technology – Security techniques – Vulnerability disclosure rlinks: - href: https://www.iso.org/standard/72311.html - uuid: 8ffea524-0974-4b53-a8f5-41166073ede5 title: Securing PowerShell in the enterprise rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/system-administration/securing-powershell-in-the-enterprise - uuid: 905f3bc8-e4ae-4532-9873-2d1430cabc48 title: Post-quantum questions to ask your vendors rlinks: - href: https://www.cyber.gov.au/business-government/secure-design/quantum/post-quantum-questions-to-ask-your-vendors - uuid: 91b92563-d991-40fa-9adc-548df9f6c496 title: secure group Managed Service Accounts rlinks: - href: https://learn.microsoft.com/en-au/entra/architecture/service-accounts-group-managed - uuid: 9209d9cd-86c1-486f-890e-1edfa4545093 title: Hardening Microsoft Windows 10 workstations rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/hardening-systems-applications/system-hardening/hardening-microsoft-windows-10-workstations - uuid: 92679127-f61d-486a-a93e-df2a26dfb07a title: Protective Security Policy Framework rlinks: - href: https://www.protectivesecurity.gov.au/ - uuid: 92975dff-58e0-4813-842b-f27c0533ca56 title: Remote Credential Guard functionality rlinks: - href: https://learn.microsoft.com/en-au/windows/security/identity-protection/remote-credential-guard - uuid: 941626b7-cfcc-4ab2-83a0-f9a91b2e453e title: "Information security, cybersecurity and privacy protection – Guidance on managing information security risks" rlinks: - href: https://www.iso.org/standard/80585.html - uuid: 94d9fbcb-e8d1-4ef2-b543-5938f4387fee title: "Safe Software Deployment: How Software Manufacturers Can Ensure Reliability for Customers" rlinks: - href: https://www.cisa.gov/resources-tools/resources/safe-software-deployment-how-software-manufacturers-can-ensure-reliability-customers - uuid: 971c6452-6e97-4b4f-b5e4-64e457cb8320 title: "Cyber supply chain: An approach to assessing risk" rlinks: - href: https://www.cyber.gc.ca/en/guidance/cyber-supply-chain-approach-assessing-risk-itsap10070 - uuid: 98951624-a06e-4d9a-96a3-f89ac944bcaa title: Protecting against business email compromise rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/hardening-systems-applications/email-hardening/protecting-against-business-email-compromise - uuid: 9898653e-fc87-4b42-a1fa-f7e323902841 title: Secure by Design Activities rlinks: - href: https://www.security.gov.uk/policy-and-guidance/secure-by-design/activities/ - uuid: 99c117f0-78e0-4196-adc8-705405d996bc title: Information technology – Security techniques – Vulnerability handling processes rlinks: - href: https://www.iso.org/standard/69725.html - uuid: 9a8f5a63-bcd5-45a8-9f9c-974fc796ac95 title: Guidelines for enterprise mobility rlinks: - href: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/cyber-security-guidelines/guidelines-for-enterprise-mobility - uuid: 9ad09461-7b3d-4faf-bdcd-61df9952cf49 title: Security Configuration Guide for Acrobat rlinks: - href: https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/index.html - uuid: 9af7c141-51de-43f0-97bc-547e24e96545 title: "Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations" rlinks: - href: https://csrc.nist.gov/pubs/ai/100/2/e2023/final - uuid: 9d38f42d-eeff-4124-93db-4b29abaafb67 title: MemtestCL rlinks: - href: https://github.com/ihaque/memtestCL - uuid: 9fdb8571-d69e-4fc8-8b6c-1825e48eb340 title: OWASP Top 10 For Agentic Applications 2026 rlinks: - href: https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/ - uuid: a07c439d-b2f4-4ee2-b56e-f17000f3722f title: "Information security, cybersecurity and privacy protection – Security requirements for cryptographic modules" rlinks: - href: https://www.iso.org/standard/82423.html - uuid: a699a3aa-828d-479b-b50b-98127bb19437 title: Guidelines for evaluated products rlinks: - href: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/cyber-security-guidelines/guidelines-for-evaluated-products - uuid: a75de67b-9502-47e9-b48b-5e2a45d528e1 title: Recommendation for Key-Derivation Methods in Key-Establishment Schemes rlinks: - href: https://csrc.nist.gov/pubs/sp/800/56/c/r2/final - uuid: a9307fb2-8003-4e6e-9d64-2c00ea8b0ec8 title: Exploring Memory Safety in Critical Open Source Projects rlinks: - href: https://www.cisa.gov/resources-tools/resources/exploring-memory-safety-critical-open-source-projects - uuid: a9b6660b-fc4c-4a08-8db6-1130370b6b09 title: Wi-Fi technologies and associated testing and certification programs rlinks: - href: https://www.wi-fi.org/explore-all-technologies - uuid: aab0523a-513e-48c9-978e-32d5b9adeea6 title: developing a vulnerability disclosure policy rlinks: - href: https://policymaker.disclose.io/policymaker/introduction/ - uuid: aaf83df2-02e3-4f9f-bdf5-33fbff42842d title: "Information security, cybersecurity and privacy protection – Test requirements for cryptographic modules" rlinks: - href: https://www.iso.org/standard/82424.html - uuid: ab5852b2-0004-4565-8e81-e769ca47ea81 title: "Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products" rlinks: - href: https://www.cisa.gov/resources-tools/resources/secure-demand-priority-considerations-operational-technology-owners-and-operators-when-selecting - uuid: ab73fa95-f213-4041-915e-a8ccbdf74331 title: Guidelines for email rlinks: - href: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/cyber-security-guidelines/guidelines-for-email - uuid: adc62d2d-87b9-43a0-ae76-6e6828ff3bbb title: Choosing secure and verifiable technologies rlinks: - href: https://www.cyber.gov.au/business-government/secure-design/secure-by-design/choosing-secure-and-verifiable-technologies - uuid: ae426d0a-adb6-43b8-a463-faa33e83b679 title: Active Directory accounts rlinks: - href: https://learn.microsoft.com/en-au/windows-server/identity/ad-ds/manage/understand-default-user-accounts - uuid: af0810aa-3486-4ca6-a48a-fad8ce9ac193 title: greater visibility through PowerShell logging rlinks: - href: https://cloud.google.com/blog/topics/threat-intelligence/greater-visibility/ - uuid: afe3656f-2a78-488f-9eae-3cb9af69b018 title: "Memory Safe Languages: Reducing Vulnerabilities in Modern Software Development" rlinks: - href: https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4223298/nsa-and-cisa-release-csi-highlighting-importance-of-memory-safe-languages-in-so/ - uuid: aff92212-4cd2-459a-9ba1-d4dd1815ebec title: Opportunities for AI in cyber defence rlinks: - href: https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/opportunities-for-ai-in-cyber-defence - uuid: b0a56885-8484-42d6-af79-4c87237ede30 title: NSA/CSS Evaluated Products List for Magnetic Degaussers rlinks: - href: https://www.nsa.gov/Resources/Media-Destruction-Guidance/NSA-Evaluated-Products-Lists-EPLs/ - uuid: b105f0d3-3354-498a-88fe-a05a7362b4b4 title: Cyber Threat Intelligence Sharing service rlinks: - href: https://www.cyber.gov.au/about-us/view-all-content/news-and-media/join-the-cyber-threat-intelligence-sharing-service-through-sentinel - uuid: b13cb68a-a94a-4a69-b094-b1b68d10239e title: Domain Name System security for domain resolvers rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/hardening-systems-applications/network-hardening/domain-name-system-security-for-domain-resolvers - uuid: b151e338-c42f-41ef-9f99-2cb98f368637 title: Best practices for securing Active Directory rlinks: - href: https://learn.microsoft.com/en-au/windows-server/identity/ad-ds/plan/security-best-practices/best-practices-for-securing-active-directory - uuid: b383a647-7627-4450-99b6-640ae554c2f1 title: Guidelines on Electronic Mail Security rlinks: - href: https://csrc.nist.gov/pubs/sp/800/45/ver2/final - uuid: b43b0377-c2e4-4cdc-acec-a9ece7371e36 title: Baseline security requirements for network security zones (version 2.0) rlinks: - href: https://www.cyber.gc.ca/en/guidance/baseline-security-requirements-network-security-zones-version-20-itsp80022 - uuid: b54cf0d1-d275-426e-98aa-9c678b9d55a5 title: Next steps in preparing for post-quantum cryptography rlinks: - href: https://www.ncsc.gov.uk/paper/next-steps-in-preparing-for-post-quantum-cryptography - uuid: b594c9c0-b42f-4f06-b643-38023275a5c7 title: Guidelines for media rlinks: - href: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/cyber-security-guidelines/guidelines-for-media - uuid: b5b7b7fc-d3c7-4861-a036-a037593c575b title: OWASP Top 10:2025 rlinks: - href: https://owasp.org/Top10/ - uuid: b6479d9a-43c9-41f2-9dbc-2bb689c8e6d8 title: Cloud assessment and authorisation rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/cloud-computing/cloud-assessment-and-authorisation - uuid: b66f8d23-4209-4775-a1fd-bd4dc299a027 title: Domain Name System security for domain owners rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/hardening-systems-applications/network-hardening/domain-name-system-security-for-domain-owners - uuid: b794a062-2339-48ed-89ac-14aa4c3a61db title: "Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software" rlinks: - href: https://www.cisa.gov/resources-tools/resources/secure-by-design - uuid: b79c4fe8-4541-401f-a32e-87fd83021c98 title: "Mitigation strategies for edge devices: Executive guidance" rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/hardening-systems-applications/network-hardening/securing-edge-devices/mitigation-strategies-for-edge-devices-executive-guidance - uuid: b8cdbf18-31cb-4e10-bb43-e8488ee8c2f6 title: "Implementing certificates, TLS, HTTPS and opportunistic TLS" rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/hardening-systems-applications/web-hardening/implementing-certificates-tls-https-and-opportunistic-tls - uuid: b959caf4-8b60-4b82-9552-963754841bb7 title: Cloud computing security for tenants rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/cloud-computing/cloud-computing-security-for-tenants - uuid: b95c4745-572a-4121-b4e1-d0baa90a84fc title: Best practices for event logging and threat detection rlinks: - href: https://www.cyber.gov.au/business-government/detecting-responding-to-threats/event-logging/best-practices-for-event-logging-and-threat-detection - uuid: bac2c6f2-9356-46d2-b7c4-9af7393008df title: Australian Privacy Principles rlinks: - href: https://www.oaic.gov.au/privacy/australian-privacy-principles - uuid: bb5eee70-5b74-4ea2-bc27-32aceeee9b2f title: Microsoft Exchange Server Security Best Practices rlinks: - href: https://www.cisa.gov/resources-tools/resources/microsoft-exchange-server-security-best-practices - uuid: bdb9d443-a877-4197-b9ad-ec5853f081c7 title: "The Case for Memory Safe Roadmaps: Why Both C-Suite Executives and Technical Experts Need to Take Memory Safe Coding Seriously" rlinks: - href: https://www.cisa.gov/resources-tools/resources/case-memory-safe-roadmaps - uuid: bf76a2ec-3cf5-4a02-839a-7b2ea11cb3fc title: Intelligence Services Act 2001 rlinks: - href: https://www.legislation.gov.au/C2004A00928/latest/text - uuid: c0558477-3987-493c-99de-eeceff99847d title: Security of Critical Infrastructure Act 2018 rlinks: - href: https://www.legislation.gov.au/C2018A00029/latest/text - uuid: c17600e6-8b13-4d6e-a380-035b51a71b73 title: The NIST Definition of Cloud Computing rlinks: - href: https://csrc.nist.gov/pubs/sp/800/145/final - uuid: c2a2f934-c5d6-46a7-86db-7fec1565058e title: Insider Risk Guidance rlinks: - href: https://www.npsa.gov.uk/specialised-guidance/insider-risk-guidance - uuid: c322926a-13b3-4efe-8573-06624418e8f5 title: Insider Threat Mitigation Guide rlinks: - href: https://www.cisa.gov/resources-tools/resources/insider-threat-mitigation-guide - uuid: c47ab307-e25d-43e7-9700-7b26d9c229c3 title: Security considerations for edge devices rlinks: - href: https://www.cyber.gc.ca/en/guidance/security-considerations-edge-devices-itsm80101 - uuid: c4f9eb1b-753e-4d16-a05e-55e6dca1dd3f title: retention of records created using artificial intelligence rlinks: - href: https://www.naa.gov.au/information-management/manage-information-assets/types-information/information-management-records-created-using-artificial-intelligence-ai-technologies - uuid: c54cc4db-22f4-4d10-8977-2ce62b647bd2 title: Preparing for and responding to denial-of-service attacks rlinks: - href: https://www.cyber.gov.au/business-government/detecting-responding-to-threats/cyber-security-incident-response/preparing-for-and-responding-to-denial-of-service-attacks - uuid: c5ca2027-161e-4322-9367-7ec736b4846f title: "Deploying AI Systems Securely: Best Practices for Deploying Secure and Resilient AI Systems" rlinks: - href: https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/3741371/nsa-publishes-guidance-for-strengthening-ai-system-security/ - uuid: c6ca6620-ccd5-4c5d-b97c-9d92f1162948 title: Guidelines for system management rlinks: - href: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/cyber-security-guidelines/guidelines-for-system-management - uuid: c74c6e7a-2209-4337-bb3a-715ce6e792a4 title: Secure development and deployment guidance rlinks: - href: https://www.ncsc.gov.uk/collection/developers-collection - uuid: c81898f4-ae8b-486f-b175-ae8e4dd5e60f title: CyberGym rlinks: - href: https://www.cybergym.io/ - uuid: c852e735-4920-4616-8e34-2fddfb49eea8 title: AV-Comparatives rlinks: - href: https://av-comparatives.org/ - uuid: c8773dbd-4ada-4fa1-8d96-8b1483205ae8 title: Information security manual OSCAL catalog - successor version rlinks: - href: https://www.cyber.gov.au/ism/oscal/v2026.09.4/successor-version/artifacts/ISM_catalog.xml media-type: application/xml - href: https://www.cyber.gov.au/ism/oscal/v2026.09.4/successor-version/artifacts/ISM_catalog.json media-type: application/json - href: https://www.cyber.gov.au/ism/oscal/v2026.09.4/successor-version/artifacts/ISM_catalog.yaml media-type: application/oscal+yaml - uuid: c8ee37e4-fb81-4fa7-8f14-132c850974bc title: Cloud computing security for executives rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/cloud-computing/cloud-computing-security-for-executives - uuid: cad720b4-e47a-437d-b272-6958e738131d title: "Common Sense Guide to Mitigating Insider Threats, Seventh Edition" rlinks: - href: https://www.sei.cmu.edu/library/common-sense-guide-to-mitigating-insider-threats-seventh-edition/ - uuid: cae0ac6b-e69b-4359-bfd7-5ee5eff1049d title: limited use obligation rlinks: - href: https://www.cyber.gov.au/report-and-recover/how-we-help-during-a-cyber-security-incident/limited-use - uuid: cc1a55cb-34ab-4418-b660-53571b3af899 title: AFDA Express Version 2 – Technology \& Information Management rlinks: - href: https://www.naa.gov.au/information-management/records-authorities/types-records-authorities/afda-express-version-2-functions/afda-express-version-2-technology-information-management - uuid: cc618df8-757e-4d6c-9ad2-405554cb487d title: Source Code Analysis Tools rlinks: - href: https://owasp.org/www-community/Source_Code_Analysis_Tools - uuid: cdd2231b-3e35-46d0-910f-96b7c8832760 title: Information security manual OSCAL catalog - predecessor version rlinks: - href: https://www.cyber.gov.au/ism/oscal/v2026.09.4/predecessor-version/artifacts/ISM_catalog.xml media-type: application/xml - href: https://www.cyber.gov.au/ism/oscal/v2026.09.4/predecessor-version/artifacts/ISM_catalog.json media-type: application/json - href: https://www.cyber.gov.au/ism/oscal/v2026.09.4/predecessor-version/artifacts/ISM_catalog.yaml media-type: application/oscal+yaml - uuid: d0ace151-3c21-49af-bde7-eda58ab18a82 title: cyber supply chain transparency rlinks: - href: https://www.ntia.gov/page/software-bill-materials - uuid: d0df96bb-7236-4784-8f54-2cb6335ad228 title: exploit protection functionality rlinks: - href: https://learn.microsoft.com/en-au/defender-endpoint/exploit-protection?view=o365-worldwide - uuid: d2910e61-da88-4d29-b860-83c25161fd18 title: "Security configuration guide: Apple iOS 14 devices" rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/hardening-systems-applications/mobility-hardening/security-configuration-guide-apple-ios-14-devices - uuid: d2f005c5-2ad3-4b5e-9eb1-d0642f3560f4 title: OWASP Application Security Verification Standard 5.0.0 rlinks: - href: https://owasp.org/www-project-application-security-verification-standard/ - uuid: d3572f80-d9d6-4023-b6e6-23720bb0d618 title: How to combat fake emails rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/hardening-systems-applications/email-hardening/how-to-combat-fake-emails - uuid: d36ce452-ec21-4b05-89c1-f29a444a3dca title: End of support for Microsoft Windows and Microsoft Windows Server rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/legacy-technology-management/end-of-support-for-microsoft-windows-and-microsoft-windows-server - uuid: d446dea3-c36d-45af-9623-05b686624af0 title: memory integrity functionality rlinks: - href: https://support.microsoft.com/en-us/windows/security/windows-security/device-security-in-the-windows-security-app - uuid: daae37ef-262f-4b20-bfb7-a27901f3c2db title: "Security configuration guide: Viasat Mobile Dynamic Defense" rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/hardening-systems-applications/mobility-hardening/security-configuration-guide-viasat-mobile-dynamic-defense - uuid: db2e237c-2dbc-4a1f-bae7-9cb63a1f1dc3 title: Guidelines for information technology equipment rlinks: - href: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/cyber-security-guidelines/guidelines-for-information-technology-equipment - uuid: dc0469b3-3901-4d2c-8b22-7c6b6627ab97 title: Ten things to know about data security rlinks: - href: https://www.cyber.gov.au/business-government/protecting-business-leaders/cyber-security-for-business-leaders/ten-things-to-know-about-data-security - uuid: dda788b6-183b-4e89-8254-8c4b5d0540a0 title: Cloud assessment and authorisation FAQ rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/cloud-computing/cloud-assessment-and-authorisation-faq - uuid: de239dae-d1e8-4969-9680-ef3444d32a83 title: Windows event logging and forwarding rlinks: - href: https://www.cyber.gov.au/business-government/detecting-responding-to-threats/event-logging/windows-event-logging-and-forwarding - uuid: de7525f3-a466-40a5-abdd-3ae24a6d1b44 title: Guidelines for system hardening rlinks: - href: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/cyber-security-guidelines/guidelines-for-system-hardening - uuid: ded13757-3c76-40cb-b46e-f84e46a1c1c7 title: Defending against the malicious use of the Tor network rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/hardening-systems-applications/network-hardening/defending-against-the-malicious-use-of-the-tor-network - uuid: dfb52998-0e7e-420d-97e1-d1313c8f919a title: Restricting Microsoft Office macros rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/hardening-systems-applications/system-hardening/restricting-microsoft-office-macros - uuid: e0d3b5ea-6a5a-400c-8daa-8a8059816a06 title: Archives Act 1983 rlinks: - href: https://www.legislation.gov.au/C2004A02796/latest/text - uuid: e19a0c40-0a68-4fba-aea1-142fdd57dc75 title: Web conferencing security rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/remote-working-secure-mobility/remote-working/web-conferencing-security - uuid: e2205e57-2bf0-4696-8bd8-94a5a5d5c4f2 title: Adopting Encrypted DNS in Enterprise Environments rlinks: - href: https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2471956/nsa-recommends-how-enterprises-can-securely-adopt-encrypted-dns/ - uuid: e4c07309-9ca8-40b7-9571-4f6c032180a1 title: Telecommunications (Interception and Access) Act 1979 rlinks: - href: https://www.legislation.gov.au/C2004A02124/latest/text - uuid: e4eee462-f6e5-4921-a8fe-26f3de6c6f45 title: Marketing and filtering email service providers rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/hardening-systems-applications/email-hardening/marketing-and-filtering-email-service-providers - uuid: e4ef23da-2683-4356-93c4-a2412c9d52ee title: High Assurance Evaluation Program rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/assessment-evaluation-programs/high-assurance-evaluation-program - uuid: e513ac6b-09fa-4d53-951a-a5142208cf12 title: An introduction to artificial intelligence rlinks: - href: https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/an-introduction-to-artificial-intelligence - uuid: e7ce6e23-4bbb-45c1-a657-7e563c0837ed title: Information security manual rlinks: - href: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism - uuid: e8a28fa5-4ea1-4ef5-a870-4d59e40fab37 title: Commercial National Security Algorithm Suite 2.0 rlinks: - href: https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/3148990/nsa-releases-future-quantum-resistant-qr-algorithm-requirements-for-national-se/ - uuid: e8bde527-526c-4a6a-b66f-05228f09dd7b title: Guidelines for gateways rlinks: - href: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/cyber-security-guidelines/guidelines-for-gateways - uuid: e8ec7a1f-775d-4b79-a164-0752278177fa title: Risk management of enterprise mobility (including Bring Your Own Device) rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/remote-working-secure-mobility/secure-mobility/risk-management-of-enterprise-mobility-including-bring-your-own-device - uuid: ea6f8148-55ea-4540-8b39-f35cc3411eb2 title: A Shared Vision of Software Bill of Materials (SBOM) for Cybersecurity rlinks: - href: https://www.cisa.gov/resources-tools/resources/shared-vision-software-bill-materials-sbom-cybersecurity - uuid: ed6aa6ab-545d-48eb-92bc-9ad763d4b868 title: Protection Profile for Mobile Device Management Version 4.0 rlinks: - href: https://www.niap-ccevs.org/protectionprofiles/428 - uuid: ef60c0e4-acfb-4a8b-b5ed-25675c6e117c title: Guidelines for security assurance rlinks: - href: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/cyber-security-guidelines/guidelines-for-security-assurance - uuid: efddc783-51dc-48ac-a53e-a5dd56c17fd0 title: Detecting socially engineered messages rlinks: - href: https://www.cyber.gov.au/business-government/protecting-devices-systems/hardening-systems-applications/email-hardening/detecting-socially-engineered-messages - uuid: f145ff5b-d396-4248-8f48-621349d6f0ed title: Guidelines for networking rlinks: - href: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/cyber-security-guidelines/guidelines-for-networking - uuid: f160b04e-1a32-4dd5-816e-1cba8c97982c title: Protection Profile for Mobile Device Fundamentals Version 3.3 rlinks: - href: https://www.niap-ccevs.org/protectionprofiles/468 - uuid: f32020e9-4cb3-486b-bcbb-6fb6719f58a5 title: Fundamentals of Cross Domain Solutions rlinks: - href: https://www.cyber.gov.au/business-government/secure-design/secure-by-design/cross-domain-solutions/fundamentals-of-cross-domain-solutions - uuid: f37a4848-0791-4870-b316-5536c2681c28 title: Guidelines for procurement and outsourcing rlinks: - href: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/cyber-security-guidelines/guidelines-for-procurement-and-outsourcing - uuid: f41c5403-9070-41ab-968e-cf69ac8bf34a title: "Choosing secure and verifiable technologies: Executive guidance" rlinks: - href: https://www.cyber.gov.au/business-government/secure-design/secure-by-design/choosing-secure-and-verifiable-technologies-executive-guidance - uuid: f48c0d05-5173-4c8e-8748-e5591518c1fb title: "Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile" rlinks: - href: https://csrc.nist.gov/pubs/sp/800/61/r3/final - uuid: f6813648-fe24-4d45-9e45-c97b4021506e title: "Countering the insider threat: A security manager’s guide" rlinks: - href: https://www.asio.gov.au/outreach - uuid: f74ba095-a7f7-4b8c-9e60-5fe84f2a2d0b title: changing credentials for this service account rlinks: - href: https://www.microsoft.com/en-us/security/blog/2015/02/11/krbtgt-account-password-reset-scripts-now-available-for-customers/ - uuid: f7e13f7b-eb48-4294-bd01-9c22c756d96b title: Security Equipment Evaluated Products List rlinks: - href: https://www.scec.gov.au/catalogue - uuid: f832363c-d81e-4908-afd9-cf45047dd19c title: configuring OpenSSH rlinks: - href: https://man.openbsd.org/sshd_config - uuid: fb60e251-ed4c-4781-96db-58a0225bca89 title: "Countering the Insider Threat: A guide for Australian Government" rlinks: - href: https://www.ag.gov.au/integrity/publications/countering-insider-threat-guide-australian-government - uuid: fba4bdb9-82be-47a4-8198-3d47d5786932 title: Encrypted DNS Implementation Guidance rlinks: - href: https://www.cisa.gov/resources-tools/resources/encrypted-dns-implementation-guidance - uuid: fd4e2255-74ca-4b20-811c-a64a93282f57 title: "Mergers, acquisitions and Machinery of Government changes" rlinks: - href: https://www.cyber.gov.au/business-government/protecting-business-leaders/cyber-security-for-business-leaders/mergers-acquisitions-and-machinery-of-government-changes - uuid: fe0138db-e83b-4a23-85d3-d84e1c22816f title: Guidelines for cyber security incidents rlinks: - href: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/cyber-security-guidelines/guidelines-for-cyber-security-incidents - uuid: fe231f91-e589-461c-bf65-8dcdc5ff4941 title: Information security manual OSCAL catalog rlinks: - href: https://www.cyber.gov.au/ism/oscal/v2026.09.4/artifacts/ISM_catalog.xml media-type: application/xml - href: https://www.cyber.gov.au/ism/oscal/v2026.09.4/artifacts/ISM_catalog.json media-type: application/json - href: https://www.cyber.gov.au/ism/oscal/v2026.09.4/artifacts/ISM_catalog.yaml media-type: application/oscal+yaml - uuid: ffc8a1f6-f4e3-4ff5-a7f9-f41f766274eb title: "Recommendation for Key Management: Part 1 – General" rlinks: - href: https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final