Australia ACSC ISM

Australian Cyber Security Centre Information Security Manual - PROTECTED/SECRET/TOP SECRET controls.


Short name	AU ISM
Region	Asia-Pacific
Country or scope	Australia
Sector	Government
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers AU ISM

Scan requirements: 7, all decided by a scan.
Controls: the scan requirements below, plus 10 controls from Safeguard's control catalog for AU ISM.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for AU ISM and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 7 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`AU-ISM-DOC-INV` System Documentation and Asset Records	Systems must be documented, including records of their composition, so every software component must appear in the system's inventory (ISM, Guidelines for Security Documentation)	Scan
`AU-ISM-PATCH` Patching Applications and Operating Systems	Security vulnerabilities in applications and operating systems must be patched within mandated timeframes (48 hours for exploited critical vulnerabilities), which requires the exact version of every deployed component to be known (ISM, Guidelines for System Management, patching controls; Essential Eight)	Scan
`AU-ISM-SUPPLY` Cyber Supply Chain Risk Management	Organisations must identify and manage cyber supply chain risks for applications, ICT equipment and services, including knowing the supplier of each software component (ISM, Guidelines for Procurement and Outsourcing)	Scan
`AU-ISM-DEV-INTEG` Secure Development and Component Integrity	Secure software development includes obtaining components from trusted sources and verifying their authenticity and integrity via cryptographic hashes (ISM, Guidelines for Software Development)	Scan
`AU-ISM-SBOM` Software Bill of Materials	The ISM directs developers and suppliers of applications to produce and make available a software bill of materials in a standard machine-readable format (ISM, Guidelines for Software Development, SBOM controls)	Scan
`AU-ISM-EOL` No Unsupported Software	Unsupported operating systems and applications must be removed or replaced, which excludes components declared at vague or floating versions whose support status cannot be determined (ISM, Guidelines for System Management, obsolescence controls)	Scan
`AU-ISM-VULN` Vulnerability Scanning Readiness	Regular vulnerability scanning and monitoring of systems requires components to carry standard identifiers (PURL/CPE) so scan results correlate with published advisories (ISM, Guidelines for System Monitoring)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`ISM-INCI`	Cyber Security Incident Management
`ISM-PERS`	Personnel Security
`ISM-CRYPTO`	Cryptographic Fundamentals
`ISM-HARD`	System Hardening
`ISM-SYSMON`	System Monitoring
`ISM-NETW`	Network Security
`ISM-EMAIL`	Email Security
`ISM-SOFDEV`	Software Development Security
`ISM-PROC`	Procurement & Outsourcing Security
`ISM-SSP`	System Security Plan (SSP)

Policy templates

Written for AU ISM:

ACSC ISM System Security Plan (SSP)

And 22 from the standard set, adapted to AU ISM.