{ "catalog": { "uuid": "709601a5-6658-5985-882c-2075ee693335", "metadata": { "title": "Assessment evidence guide for enterprise IT - Critical processes and services OSCAL Resolved Catalog", "published": "2026-10-15T00:30:23Z", "last-modified": "2026-10-15T00:30:23Z", "version": "2026.10.15", "oscal-version": "1.2.3", "props": [ { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain-description", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "Core processes and services that are critical to delivering primary organisational outcomes." }, { "name": "domain-priority-phase", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "phase-2" }, { "name": "resolution-tool", "value": "OSCAL Profile Resolver XSLT Pipeline OPRXP" } ], "links": [ { "href": "#cb13e6fc-647d-5c9d-81d1-c8c490595922", "rel": "source-profile" }, { "href": "#1e75ca1e-24c7-5a0a-a27b-088768d2a2d5", "rel": "canonical" }, { "href": "#20c472de-94f3-5364-88c7-f20f7b41bccd", "rel": "latest-version" }, { "href": "#6938000d-2c69-5a06-baf1-eda3e1059b77", "rel": "predecessor-version" }, { "href": "#f70506c3-e6da-56e5-b0d6-db7aa4832d7c", "rel": "successor-version" }, { "href": "#749a4f98-ab3d-5c34-a269-635125a18aab", "rel": "alternate" } ], "roles": [ { "id": "prepared-by", "title": "Document creator" } ], "parties": [ { "uuid": "abf7d7c0-829f-51f4-9824-87d4373f6edf", "type": "organization", "name": "Australian Cyber Security Centre", "short-name": "ACSC", "links": [ { "href": "https://www.cyber.gov.au", "rel": "website" } ], "email-addresses": [ "asd.assist@defence.gov.au" ], "addresses": [ { "type": "work", "addr-lines": [ "Australian Cyber Security Centre", "General enquiries", "PO Box 5076" ], "city": "Kingston", "state": "ACT", "postal-code": "2604", "country": "AU" } ] } ], "responsible-parties": [ { "role-id": "prepared-by", "party-uuids": [ "abf7d7c0-829f-51f4-9824-87d4373f6edf" ] } ], "remarks": "Consumers of this file should refer to the [Essentials OSCAL NS 1.0](#c1350084-c4c2-5447-affd-185f1ef2f6c2) page for information regarding the Essentials specific representation used in this OSCAL file." }, "groups": [ { "id": "IDE", "title": "Identify principles", "props": [ { "name": "sort-id", "value": "2" } ], "groups": [ { "id": "IDE-01", "class": "essentials-principle", "title": "IDE-01 - Asset identification", "props": [ { "name": "sort-id", "value": "2.1" } ], "parts": [ { "id": "IDE-01.overview", "name": "overview", "props": [ { "name": "sort-id", "value": "2.1.1" }, { "name": "label", "value": "Principle" } ], "prose": "Systems (infrastructure, operating systems, applications, identities, credentials and data) are continually and centrally identified and documented." } ], "controls": [ { "id": "IT.IDE-01.2", "title": "IT.IDE-01.2", "props": [ { "name": "sort-id", "value": "2.1.3" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "parts": [ { "id": "IT.IDE-01.2.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "2.1.3.1" }, { "name": "label", "value": "Action" } ], "prose": "Maintain current records of infrastructure, operating systems, applications, identities, credentials and data assets." }, { "id": "IT.IDE-01.2.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "2.1.3.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "2.1.3.2.1" } ], "parts": [ { "id": "IT.IDE-01.2.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "2.1.3.2.1.1" } ], "prose": "A maintained record of infrastructure, operating systems, applications, identities, credentials and data assets has not been established." }, { "id": "IT.IDE-01.2.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "2.1.3.2.1.2" } ], "prose": "There is no defined process for identifying, recording, reviewing and updating asset records." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "2.1.3.2.2" } ], "parts": [ { "id": "IT.IDE-01.2.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "2.1.3.2.2.1" } ], "prose": "Asset records are maintained, but identified omissions, inaccuracies or newly discovered assets are not triaged and addressed within the timeframes or tolerances defined by the organisation." }, { "id": "IT.IDE-01.2.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "2.1.3.2.2.2" } ], "prose": "A process to update the asset inventory runs on a schedule but the results are not reconciled or updated within a period defined by the organisation." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "2.1.3.2.3" } ], "parts": [ { "id": "IT.IDE-01.2.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "2.1.3.2.3.1" } ], "prose": "At each scheduled review or update, records of infrastructure, operating systems, applications, identities, credentials and data assets are complete and accurate within the tolerances defined by the organisation." }, { "id": "IT.IDE-01.2.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "2.1.3.2.3.2" } ], "prose": "A defined process identifies changes and newly discovered assets between scheduled reviews, and ensures that records are reviewed, reconciled and updated within timeframes commensurate with the associated cyber security risk." } ] } ] } ] } ] } ] }, { "id": "PRO", "title": "Protect principles", "props": [ { "name": "sort-id", "value": "3" } ], "groups": [ { "id": "PRO-01", "class": "essentials-principle", "title": "PRO-01 - Secure system lifecycle", "props": [ { "name": "sort-id", "value": "3.01" } ], "parts": [ { "id": "PRO-01.overview", "name": "overview", "props": [ { "name": "sort-id", "value": "3.01.1" }, { "name": "label", "value": "Principle" } ], "prose": "Systems (infrastructure, operating systems and applications) are planned, designed, developed, tested, deployed, maintained and decommissioned according to their business criticality ratings and security and resilience requirements using Secure by Design and Secure by Default principles and practices." } ], "controls": [ { "id": "IT.PRO-01.1", "title": "IT.PRO-01.1", "props": [ { "name": "sort-id", "value": "3.01.2" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#8506766a-663b-5c06-97d6-d810ca1c1efa", "rel": "mitigated-technique", "text": "Mitigated technique: Exploit Public-Facing Application" }, { "href": "#77ba96d0-f819-580a-9622-c823aba0d750", "rel": "mitigated-technique", "text": "Mitigated technique: Valid Accounts" }, { "href": "#ecd4f2ca-f615-539b-bf51-98fa38c69549", "rel": "mitigated-technique", "text": "Mitigated technique: Remote Services" }, { "href": "#c73e777a-81e0-53e1-a470-3a6df2f16c9e", "rel": "mitigated-technique", "text": "Mitigated technique: Exploitation for Privilege Escalation" } ], "parts": [ { "id": "IT.PRO-01.1.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.01.2.1" }, { "name": "label", "value": "Action" } ], "prose": "Design systems securely to provide visibility, enforce authorised access, protect data, minimise required and default privileges, limit exposed services and remove unnecessary functionality." }, { "id": "IT.PRO-01.1.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.01.2.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.01.2.2.1" } ], "parts": [ { "id": "IT.PRO-01.1.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.2.2.1.1" } ], "prose": "Systems are deployed with default configurations and no evidence of security design considerations." }, { "id": "IT.PRO-01.1.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.2.2.1.2" } ], "prose": "Unnecessary services, protocols or functionality remain enabled with no documented rationale." }, { "id": "IT.PRO-01.1.NE-3", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.2.2.1.3" } ], "prose": "Security telemetry is not enabled or is not considered as part of system design." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.01.2.2.2" } ], "parts": [ { "id": "IT.PRO-01.1.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.2.2.2.1" } ], "prose": "Security is considered during system design but not consistently applied across all assets." }, { "id": "IT.PRO-01.1.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.2.2.2.2" } ], "prose": "Some unnecessary services have been disabled but a systematic review has not been completed." }, { "id": "IT.PRO-01.1.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.2.2.2.3" } ], "prose": "Security telemetry is partially enabled but gaps in coverage exist." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.01.2.2.3" } ], "parts": [ { "id": "IT.PRO-01.1.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.2.2.3.1" } ], "prose": "Systems are designed and deployed with exposed services limited, required and default permissions minimised, data protections in place, authorised access enforced, and only required functionality enabled." }, { "id": "IT.PRO-01.1.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.2.2.3.2" } ], "prose": "Security telemetry is enabled by default." }, { "id": "IT.PRO-01.1.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.2.2.3.3" } ], "prose": "Evidence exists that security design decisions are recorded and reviewed during system changes." } ] } ] } ] }, { "id": "IT.PRO-01.2", "title": "IT.PRO-01.2", "props": [ { "name": "sort-id", "value": "3.01.3" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "parts": [ { "id": "IT.PRO-01.2.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.01.3.1" }, { "name": "label", "value": "Action" } ], "prose": "Secure build and deployment processes to enforce controls consistently across systems." }, { "id": "IT.PRO-01.2.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.01.3.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.01.3.2.1" } ], "parts": [ { "id": "IT.PRO-01.2.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.3.2.1.1" } ], "prose": "No controlled build or deployment process exists for applicable assets." }, { "id": "IT.PRO-01.2.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.3.2.1.2" } ], "prose": "Changes to systems are applied ad hoc, without any version control, testing or approval." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.01.3.2.2" } ], "parts": [ { "id": "IT.PRO-01.2.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.3.2.2.1" } ], "prose": "A controlled deployment process exists but is not consistently followed for all changes." }, { "id": "IT.PRO-01.2.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.3.2.2.2" } ], "prose": "Version control is in place but pre-deployment security verification is not performed." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.01.3.2.3" } ], "parts": [ { "id": "IT.PRO-01.2.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.3.2.3.1" } ], "prose": "A controlled build and deployment process is in place and consistently followed." }, { "id": "IT.PRO-01.2.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.3.2.3.2" } ], "prose": "Configuration changes are subject to version control, testing and approval before deployment." }, { "id": "IT.PRO-01.2.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.3.2.3.3" } ], "prose": "Security controls are confirmed to be implemented consistently across systems following deployment processes." } ] } ] } ] } ] }, { "id": "PRO-16", "class": "essentials-principle", "title": "PRO-16 - Cyber supply chain security", "props": [ { "name": "sort-id", "value": "3.02" } ], "parts": [ { "id": "PRO-16.overview", "name": "overview", "props": [ { "name": "sort-id", "value": "3.02.1" }, { "name": "label", "value": "Principle" } ], "prose": "Cyber supply chains supporting systems (infrastructure, operating systems, applications and data) are secure, resilient and support effective and coordinated cyber security incident response." } ], "controls": [ { "id": "IT.PRO-16.1", "title": "IT.PRO-16.1", "props": [ { "name": "sort-id", "value": "3.02.2" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#0c6c92ee-dc6c-571a-84d7-6c89841f9847", "rel": "mitigated-technique", "text": "Mitigated technique: Supply Chain Compromise" }, { "href": "#c525290c-5eea-5f39-a2fb-c2040a6e5fdb", "rel": "mitigated-technique", "text": "Mitigated technique: Server Software Component" } ], "parts": [ { "id": "IT.PRO-16.1.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.02.2.1" }, { "name": "label", "value": "Action" } ], "prose": "Assess the integrity and authenticity of software, components and updates before use, and verify provenance where suitable supplier evidence is available." }, { "id": "IT.PRO-16.1.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.02.2.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.02.2.2.1" } ], "parts": [ { "id": "IT.PRO-16.1.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.2.2.1.1" } ], "prose": "No verification of software, component or update integrity or authenticity is performed before introduction into systems." }, { "id": "IT.PRO-16.1.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.2.2.1.2" } ], "prose": "Verification outcomes are not recorded or available for review." }, { "id": "IT.PRO-16.1.NE-3", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.2.2.1.3" } ], "prose": "Where verification cannot be performed, no compensating control or remediation paths are documented." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.02.2.2.2" } ], "parts": [ { "id": "IT.PRO-16.1.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.2.2.2.1" } ], "prose": "Verification is performed for some categories of software but not consistently across operating systems, applications, firmware and dependencies." }, { "id": "IT.PRO-16.1.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.2.2.2.2" } ], "prose": "Integrity or provenance checks are performed, but they do not provide sufficient assurance for all software, components or updates." }, { "id": "IT.PRO-16.1.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.2.2.2.3" } ], "prose": "Verification outcomes are recorded for some software, components or updates prior to being introduced into systems, but not consistently." }, { "id": "IT.PRO-16.1.PE-4", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.2.2.2.4" } ], "prose": "Compensating controls exist for some unverifiable components but are not formally approved or time-bound." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.02.2.2.3" } ], "parts": [ { "id": "IT.PRO-16.1.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.2.2.3.1" } ], "prose": "Verification of integrity and provenance is performed for software, components and updates across all relevant categories, and provenance is verified where suitable supplier evidence is available." }, { "id": "IT.PRO-16.1.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.2.2.3.2" } ], "prose": "Verification uses one or more mechanisms appropriate to the software, component, update and source to provide reliable assurance of integrity and provenance." }, { "id": "IT.PRO-16.1.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.2.2.3.3" } ], "prose": "Verification outcomes are recorded and available for review." }, { "id": "IT.PRO-16.1.FE-4", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.2.2.3.4" } ], "prose": "Where verification cannot be performed, compensating controls are applied, exceptions are time-bound and remediation paths are documented." } ] } ] } ] }, { "id": "IT.PRO-16.2", "title": "IT.PRO-16.2", "props": [ { "name": "sort-id", "value": "3.02.3" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" } ], "links": [ { "href": "#0c6c92ee-dc6c-571a-84d7-6c89841f9847", "rel": "mitigated-technique", "text": "Mitigated technique: Supply Chain Compromise" }, { "href": "#c525290c-5eea-5f39-a2fb-c2040a6e5fdb", "rel": "mitigated-technique", "text": "Mitigated technique: Server Software Component" } ], "parts": [ { "id": "IT.PRO-16.2.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.02.3.1" }, { "name": "label", "value": "Action" } ], "prose": "Use vendor advisories and threat intelligence to maintain awareness of supplier, product and component exposure to compromise, and act within timeframes proportionate to the risk." }, { "id": "IT.PRO-16.2.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.02.3.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.02.3.2.1" } ], "parts": [ { "id": "IT.PRO-16.2.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.3.2.1.1" } ], "prose": "No monitoring is performed for indicators of supply chain compromise affecting software, components or services in use." }, { "id": "IT.PRO-16.2.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.3.2.1.2" } ], "prose": "Vendor security notifications and threat advisories are not reviewed or actioned." }, { "id": "IT.PRO-16.2.NE-3", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.3.2.1.3" } ], "prose": "When supply chain compromise is identified, neither containment nor investigation is performed." }, { "id": "IT.PRO-16.2.NE-4", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.3.2.1.4" } ], "prose": "Supply chain compromise events are integrated into neither incident response nor risk management." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.02.3.2.2" } ], "parts": [ { "id": "IT.PRO-16.2.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.3.2.2.1" } ], "prose": "Monitoring occurs but does not draw on relevant threat intelligence sources or does not cover all in-scope systems." }, { "id": "IT.PRO-16.2.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.3.2.2.2" } ], "prose": "Notifications and advisories are reviewed but exposure assessment and response are not conducted in a timely manner." }, { "id": "IT.PRO-16.2.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.3.2.2.3" } ], "prose": "Containment occurs but investigation for evidence of exploitation is not consistently undertaken." }, { "id": "IT.PRO-16.2.PE-4", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.3.2.2.4" } ], "prose": "Some integration exists but findings are not reflected in the risk register or incident response procedures." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.02.3.2.3" } ], "parts": [ { "id": "IT.PRO-16.2.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.3.2.3.1" } ], "prose": "Monitoring covers software, components and services in use, drawing on relevant threat intelligence sources." }, { "id": "IT.PRO-16.2.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.3.2.3.2" } ], "prose": "Vendor security notifications and threat advisories are reviewed, exposure is assessed and response actions are initiated within defined timeframes." }, { "id": "IT.PRO-16.2.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.3.2.3.3" } ], "prose": "Identified supply chain compromises are responded to in timeframes defined by the organisation." }, { "id": "IT.PRO-16.2.FE-4", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.3.2.3.4" } ], "prose": "Supply chain compromise events are integrated with incident response and reflected in the risk register." } ] } ] } ] } ] }, { "id": "PRO-13", "class": "essentials-principle", "title": "PRO-13 - Identity, credential and access management", "props": [ { "name": "sort-id", "value": "3.03" } ], "parts": [ { "id": "PRO-13.overview", "name": "overview", "props": [ { "name": "sort-id", "value": "3.03.1" }, { "name": "label", "value": "Principle" } ], "prose": "Robust and secure identity, credential and access management is used to establish, maintain and control access to systems (infrastructure, operating systems, applications and data) and to support effective detection of identity and credential misuse." } ], "controls": [ { "id": "IT.PRO-13.1", "title": "IT.PRO-13.1", "props": [ { "name": "sort-id", "value": "3.03.2" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#77ba96d0-f819-580a-9622-c823aba0d750", "rel": "mitigated-technique", "text": "Mitigated technique: Valid Accounts" }, { "href": "#f26268e4-32a9-5f2a-9f87-7a7fad7f68fc", "rel": "mitigated-technique", "text": "Mitigated technique: Brute Force" } ], "parts": [ { "id": "IT.PRO-13.1.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.03.2.1" }, { "name": "label", "value": "Action" } ], "prose": "Identify and disable or remove default and unused accounts regularly, permitting exceptions only where the account is documented, justified, hardened and monitored." }, { "id": "IT.PRO-13.1.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.03.2.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.03.2.2.1" } ], "parts": [ { "id": "IT.PRO-13.1.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.2.2.1.1" } ], "prose": "No review of default or unused accounts has been conducted within the review period defined by the organisation." }, { "id": "IT.PRO-13.1.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.2.2.1.2" } ], "prose": "Default vendor accounts remain enabled on production systems without appropriate documentation, justification, hardening and monitoring in place for their use." }, { "id": "IT.PRO-13.1.NE-3", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.2.2.1.3" } ], "prose": "No process exists to identify accounts that have not authenticated within a defined period." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.03.2.2.2" } ], "parts": [ { "id": "IT.PRO-13.1.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.2.2.2.1" } ], "prose": "A review has been conducted but does not cover all assets." }, { "id": "IT.PRO-13.1.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.2.2.2.2" } ], "prose": "Default accounts have been identified but some remain enabled without documented justification." }, { "id": "IT.PRO-13.1.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.2.2.2.3" } ], "prose": "Unused accounts are identified but remediation is incomplete or delayed beyond defined timeframes." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.03.2.2.3" } ], "parts": [ { "id": "IT.PRO-13.1.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.2.2.3.1" } ], "prose": "A review of accounts has been completed within the defined review period covering all assets." }, { "id": "IT.PRO-13.1.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.2.2.3.2" } ], "prose": "Default accounts are disabled or have approved justification for remaining active, with appropriate monitoring and compensating controls for their use in place." }, { "id": "IT.PRO-13.1.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.2.2.3.3" } ], "prose": "Accounts that show no evidence of use, other than approved emergency access accounts, are identified and either disabled or removed in accordance with defined timeframes." } ] } ] } ] }, { "id": "IT.PRO-13.2", "title": "IT.PRO-13.2", "props": [ { "name": "sort-id", "value": "3.03.3" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" } ], "links": [ { "href": "#57fa3c84-e383-5a76-a1ac-8db584b1b7cb", "rel": "mitigated-technique", "text": "Mitigated technique: Unsecured Credentials" }, { "href": "#3dc7231b-760b-500f-8b46-e260fa7af940", "rel": "mitigated-technique", "text": "Mitigated technique: Credentials from Password Stores" } ], "parts": [ { "id": "IT.PRO-13.2.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.03.3.1" }, { "name": "label", "value": "Action" } ], "prose": "Store authentication keys, secrets and tokens in approved secure repositories with access controls, including MFA." }, { "id": "IT.PRO-13.2.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.03.3.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.03.3.2.1" } ], "parts": [ { "id": "IT.PRO-13.2.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.3.2.1.1" } ], "prose": "Credentials are stored in plaintext, spreadsheets, shared drives or other unapproved locations as standard practice." }, { "id": "IT.PRO-13.2.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.3.2.1.2" } ], "prose": "No approved secure repository is in use to store authentication keys, secrets and tokens." }, { "id": "IT.PRO-13.2.NE-3", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.3.2.1.3" } ], "prose": "Access to credential stores is neither controlled nor audited." }, { "id": "IT.PRO-13.2.NE-4", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.3.2.1.4" } ], "prose": "Access controls such as MFA are not enabled for authentication to secure repositories." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.03.3.2.2" } ], "parts": [ { "id": "IT.PRO-13.2.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.3.2.2.1" } ], "prose": "An approved secure repository is in use but does not cover all authentication keys, secrets and tokens within scope." }, { "id": "IT.PRO-13.2.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.3.2.2.2" } ], "prose": "Access controls for secure repositories are in place but access logging is not enabled or not reviewed." }, { "id": "IT.PRO-13.2.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.3.2.2.3" } ], "prose": "MFA is enforced for some, but not all, applicable users, repositories or authentication pathways, and the remaining exceptions are documented and subject to remediation." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.03.3.2.3" } ], "parts": [ { "id": "IT.PRO-13.2.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.3.2.3.1" } ], "prose": "Authentication keys, secrets and tokens within scope are stored in approved secure repositories, with any authorised exceptions documented, risk-assessed and managed in accordance with organisationally defined requirements." }, { "id": "IT.PRO-13.2.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.3.2.3.2" } ], "prose": "Access to secure repositories is restricted using attribute or role-based access controls, MFA is enforced for all applicable authentication pathways, and access is logged and reviewed and investigated where necessary." } ] } ] } ] }, { "id": "IT.PRO-13.4", "title": "IT.PRO-13.4", "props": [ { "name": "sort-id", "value": "3.03.5" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#77ba96d0-f819-580a-9622-c823aba0d750", "rel": "mitigated-technique", "text": "Mitigated technique: Valid Accounts" }, { "href": "#5e12fa47-c2dd-5834-8f8e-aba05566851e", "rel": "mitigated-technique", "text": "Mitigated technique: Account Manipulation" }, { "href": "#f26268e4-32a9-5f2a-9f87-7a7fad7f68fc", "rel": "mitigated-technique", "text": "Mitigated technique: Brute Force" }, { "href": "#ecd4f2ca-f615-539b-bf51-98fa38c69549", "rel": "mitigated-technique", "text": "Mitigated technique: Remote Services" }, { "href": "#adaac7e5-a0e4-56f2-ab2a-62040e289c93", "rel": "mitigated-technique", "text": "Mitigated technique: Multi-Factor Authentication Request Generation" }, { "href": "#e639c32d-d0bb-52cb-a8db-7f59a9ca3a5e", "rel": "mitigated-technique", "text": "Mitigated technique: Adversary-in-the-Middle" } ], "parts": [ { "id": "IT.PRO-13.4.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.03.5.1" }, { "name": "label", "value": "Action" } ], "prose": "Use phishing-resistant MFA for users authenticating to systems, including from untrusted, external or high-risk locations." }, { "id": "IT.PRO-13.4.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.03.5.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.03.5.2.1" } ], "parts": [ { "id": "IT.PRO-13.4.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.5.2.1.1" } ], "prose": "Phishing-resistant MFA is not enforced for interactive user authentication to systems." }, { "id": "IT.PRO-13.4.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.5.2.1.2" } ], "prose": "MFA is deployed but uses non-phishing-resistant methods, such as SMS, voice, or push-only authentication instead of phishing-resistant MFA." }, { "id": "IT.PRO-13.4.NE-3", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.5.2.1.3" } ], "prose": "No access policies differentiate between trusted and untrusted, external or high-risk locations." }, { "id": "IT.PRO-13.4.NE-4", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.5.2.1.4" } ], "prose": "Access from untrusted, external or high-risk locations is permitted without MFA, or with non-phishing-resistant MFA." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.03.5.2.2" } ], "parts": [ { "id": "IT.PRO-13.4.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.5.2.2.1" } ], "prose": "Phishing-resistant MFA is deployed for some but not all systems within scope." }, { "id": "IT.PRO-13.4.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.5.2.2.2" } ], "prose": "Access policies exist but do not cover all organisationally defined high-risk location categories." }, { "id": "IT.PRO-13.4.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.5.2.2.3" } ], "prose": "Exceptions or alternative authentication pathways allow routine or recurring authentication without phishing-resistant MFA, or emergency access arrangements are not adequately restricted, monitored, tested or reviewed." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.03.5.2.3" } ], "parts": [ { "id": "IT.PRO-13.4.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.5.2.3.1" } ], "prose": "Phishing-resistant MFA is enforced for all routine interactive user authentication to systems within scope." }, { "id": "IT.PRO-13.4.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.5.2.3.2" } ], "prose": "Phishing-resistant MFA is enforced for routine authentication attempts from untrusted, external or high-risk locations." }, { "id": "IT.PRO-13.4.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.5.2.3.3" } ], "prose": "Customer-facing services provide a phishing-resistant MFA option for authentication." }, { "id": "IT.PRO-13.4.FE-4", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.5.2.3.4" } ], "prose": "Emergency access arrangements are periodically tested and reviewed to confirm that they remain operational, appropriately protected and limited to their intended purpose. Credentials or authentication factors used for emergency access are securely managed and are not used for routine administration." } ] } ] } ] }, { "id": "IT.PRO-13.5", "title": "IT.PRO-13.5", "props": [ { "name": "sort-id", "value": "3.03.6" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#f26268e4-32a9-5f2a-9f87-7a7fad7f68fc", "rel": "mitigated-technique", "text": "Mitigated technique: Brute Force" }, { "href": "#77ba96d0-f819-580a-9622-c823aba0d750", "rel": "mitigated-technique", "text": "Mitigated technique: Valid Accounts" }, { "href": "#e639c32d-d0bb-52cb-a8db-7f59a9ca3a5e", "rel": "mitigated-technique", "text": "Mitigated technique: Adversary-in-the-Middle" } ], "parts": [ { "id": "IT.PRO-13.5.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.03.6.1" }, { "name": "label", "value": "Action" } ], "prose": "Disable legacy authentication protocols or, where this is not feasible, restrict and monitor their use, apply compensating controls and establish a time-bound decommissioning plan." }, { "id": "IT.PRO-13.5.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.03.6.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.03.6.2.1" } ], "parts": [ { "id": "IT.PRO-13.5.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.6.2.1.1" } ], "prose": "Legacy authentication protocols that cannot enforce modern authentication controls remain enabled and in active use without restriction." }, { "id": "IT.PRO-13.5.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.6.2.1.2" } ], "prose": "No assessment has been conducted to identify which legacy authentication protocols are in use within the environment." }, { "id": "IT.PRO-13.5.NE-3", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.6.2.1.3" } ], "prose": "Authentication mechanisms transmitting credentials in cleartext or using weak cryptographic primitives remain enabled and no action has been taken to disable them." }, { "id": "IT.PRO-13.5.NE-4", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.6.2.1.4" } ], "prose": "Where legacy protocols are retained, no compensating controls, no monitoring and no decommissioning timelines are in place." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.03.6.2.2" } ], "parts": [ { "id": "IT.PRO-13.5.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.6.2.2.1" } ], "prose": "Legacy authentication protocols have been identified and are partially restricted but some remain enabled across systems within scope without justification." }, { "id": "IT.PRO-13.5.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.6.2.2.2" } ], "prose": "An assessment has been conducted but does not cover all in-scope systems, or the inventory of legacy protocols in use is not maintained." }, { "id": "IT.PRO-13.5.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.6.2.2.3" } ], "prose": "Some weak authentication mechanisms have been disabled but others remain enabled without documented justification or remediation plan." }, { "id": "IT.PRO-13.5.PE-4", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.6.2.2.4" } ], "prose": "Compensating controls exist for some retained legacy protocols but monitoring is inconsistent or decommissioning timelines are not defined." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.03.6.2.3" } ], "parts": [ { "id": "IT.PRO-13.5.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.6.2.3.1" } ], "prose": "Legacy authentication protocols that cannot enforce modern authentication controls have been identified and disabled across systems within scope, excluding documented and risk accepted exceptions." }, { "id": "IT.PRO-13.5.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.6.2.3.2" } ], "prose": "An assessment of legacy authentication protocol use has been conducted across in-scope systems and the inventory is maintained." }, { "id": "IT.PRO-13.5.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.6.2.3.3" } ], "prose": "Where retention is necessary, compensating controls are applied and decommissioning timelines are recorded and tracked." }, { "id": "IT.PRO-13.5.FE-4", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.6.2.3.4" } ], "prose": "Ongoing use of legacy authentication protocols is regularly risk reviewed, accepted and recorded in the organisation’s risk register." } ] } ] } ] }, { "id": "IT.PRO-13.6", "title": "IT.PRO-13.6", "props": [ { "name": "sort-id", "value": "3.03.7" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#f26268e4-32a9-5f2a-9f87-7a7fad7f68fc", "rel": "mitigated-technique", "text": "Mitigated technique: Brute Force" }, { "href": "#77ba96d0-f819-580a-9622-c823aba0d750", "rel": "mitigated-technique", "text": "Mitigated technique: Valid Accounts" } ], "parts": [ { "id": "IT.PRO-13.6.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.03.7.1" }, { "name": "label", "value": "Action" } ], "prose": "Ensure that user, machine, system and service account credentials are unique per system or account, particularly in high-privilege contexts." }, { "id": "IT.PRO-13.6.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.03.7.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.03.7.2.1" } ], "parts": [ { "id": "IT.PRO-13.6.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.7.2.1.1" } ], "prose": "Local administrator credentials are shared across the device fleet, or service or privileged account credentials are routinely reused across systems." }, { "id": "IT.PRO-13.6.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.7.2.1.2" } ], "prose": "Credential uniqueness is not enforced for applicable user, machine, system or service identities." }, { "id": "IT.PRO-13.6.NE-3", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.7.2.1.3" } ], "prose": "Credential uniqueness has not been addressed in high-privilege contexts, including domain administration, cloud administration or automation platforms." }, { "id": "IT.PRO-13.6.NE-4", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.7.2.1.4" } ], "prose": "Where credential uniqueness cannot be enforced, neither compensating controls nor remediation paths are in place." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.03.7.2.2" } ], "parts": [ { "id": "IT.PRO-13.6.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.7.2.2.1" } ], "prose": "Local administrator credential uniqueness has been implemented for some device populations but coverage is incomplete across the device fleet." }, { "id": "IT.PRO-13.6.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.7.2.2.2" } ], "prose": "A technical mechanism is in place but applies to only a subset of credential types or systems within scope." }, { "id": "IT.PRO-13.6.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.7.2.2.3" } ], "prose": "Credential uniqueness has been addressed in some high-privilege contexts but gaps remain in others." }, { "id": "IT.PRO-13.6.PE-4", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.7.2.2.4" } ], "prose": "Compensating controls exist for some shared credentials but monitoring is inconsistent or remediation plans do not exist." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.03.7.2.3" } ], "parts": [ { "id": "IT.PRO-13.6.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.7.2.3.1" } ], "prose": "Credentials for applicable local administrative accounts are unique to each system or account." }, { "id": "IT.PRO-13.6.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.7.2.3.2" } ], "prose": "Credential uniqueness is consistently enforced for applicable user, machine, system and service identities." }, { "id": "IT.PRO-13.6.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.7.2.3.3" } ], "prose": "Credential uniqueness is enforced consistently in high-privilege contexts, with managed identities or equivalent capabilities used in preference to shared static credentials wherever feasible." }, { "id": "IT.PRO-13.6.FE-4", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.7.2.3.4" } ], "prose": "Where uniqueness cannot be enforced, compensating controls are applied, the use of the shared credentials is monitored, and a remediation plan exists." } ] } ] } ] } ] }, { "id": "PRO-12", "class": "essentials-principle", "title": "PRO-12 - Least privilege access", "props": [ { "name": "sort-id", "value": "3.04" } ], "parts": [ { "id": "PRO-12.overview", "name": "overview", "props": [ { "name": "sort-id", "value": "3.04.1" }, { "name": "label", "value": "Principle" } ], "prose": "Users are granted the minimum access to systems (infrastructure, operating systems, applications and data) required to undertake their duties or functions." } ], "controls": [ { "id": "IT.PRO-12.1", "title": "IT.PRO-12.1", "props": [ { "name": "sort-id", "value": "3.04.2" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#5e12fa47-c2dd-5834-8f8e-aba05566851e", "rel": "mitigated-technique", "text": "Mitigated technique: Account Manipulation" } ], "parts": [ { "id": "IT.PRO-12.1.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.04.2.1" }, { "name": "label", "value": "Action" } ], "prose": "Periodically review and update access privileges in alignment with current roles, duties and business requirements." }, { "id": "IT.PRO-12.1.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.04.2.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.04.2.2.1" } ], "parts": [ { "id": "IT.PRO-12.1.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.2.2.1.1" } ], "prose": "Access privileges are not reviewed against current roles, duties and business requirements." }, { "id": "IT.PRO-12.1.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.2.2.1.2" } ], "prose": "Access reviews do not identify privileges that are no longer required." }, { "id": "IT.PRO-12.1.NE-3", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.2.2.1.3" } ], "prose": "Access privileges are not updated when personnel roles, duties or business requirements change." }, { "id": "IT.PRO-12.1.NE-4", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.2.2.1.4" } ], "prose": "Access privileges are not mapped to roles, duties and business requirements." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.04.2.2.2" } ], "parts": [ { "id": "IT.PRO-12.1.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.2.2.2.1" } ], "prose": "Access reviews are conducted for some accounts or systems, but coverage is incomplete." }, { "id": "IT.PRO-12.1.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.2.2.2.2" } ], "prose": "Reviews identify excessive or obsolete privileges, but updates are incomplete or not completed within timeframes defined by the organisation." }, { "id": "IT.PRO-12.1.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.2.2.2.3" } ], "prose": "A process to review access privileges exists but only occurs on an ad hoc basis." }, { "id": "IT.PRO-12.1.PE-4", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.2.2.2.4" } ], "prose": "Some access privileges are mapped to roles, duties and business requirements, but not all." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.04.2.2.3" } ], "parts": [ { "id": "IT.PRO-12.1.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.2.2.3.1" } ], "prose": "Access privileges for all applicable accounts and systems are reviewed within a cycle defined by the organisation and aligned with current roles, duties and business requirements." }, { "id": "IT.PRO-12.1.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.2.2.3.2" } ], "prose": "Privileges identified as excessive or obsolete are removed or updated within timeframes defined by the organisation." }, { "id": "IT.PRO-12.1.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.2.2.3.3" } ], "prose": "Review outcomes and resulting access changes are documented and available as evidence." }, { "id": "IT.PRO-12.1.FE-4", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.2.2.3.4" } ], "prose": "Access privileges are mapped to current roles, duties and business requirements." } ] } ] } ] }, { "id": "IT.PRO-12.2", "title": "IT.PRO-12.2", "props": [ { "name": "sort-id", "value": "3.04.3" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" } ], "links": [ { "href": "#273a9201-4c54-5007-8c36-9c645b3caac0", "rel": "mitigated-technique", "text": "Mitigated technique: Create Account" }, { "href": "#5e12fa47-c2dd-5834-8f8e-aba05566851e", "rel": "mitigated-technique", "text": "Mitigated technique: Account Manipulation" } ], "parts": [ { "id": "IT.PRO-12.2.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.04.3.1" }, { "name": "label", "value": "Action" } ], "prose": "Grant only authorised administrative roles permissions to create, modify or delete accounts and roles, and access privileged functions or applications." }, { "id": "IT.PRO-12.2.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.04.3.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.04.3.2.1" } ], "parts": [ { "id": "IT.PRO-12.2.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.3.2.1.1" } ], "prose": "Non-administrative users can create, modify or delete accounts or roles." }, { "id": "IT.PRO-12.2.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.3.2.1.2" } ], "prose": "Delegated permissions are broad and have not been audited." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.04.3.2.2" } ], "parts": [ { "id": "IT.PRO-12.2.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.3.2.2.1" } ], "prose": "Permissions are restricted to administrative roles but some delegated permissions are broader than required." }, { "id": "IT.PRO-12.2.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.3.2.2.2" } ], "prose": "Approval workflows exist for some high-impact changes but not all." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.04.3.2.3" } ], "parts": [ { "id": "IT.PRO-12.2.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.3.2.3.1" } ], "prose": "Only designated administrative roles can create, modify or delete accounts and roles." }, { "id": "IT.PRO-12.2.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.3.2.3.2" } ], "prose": "Delegated permissions are audited and scoped to the minimum required." }, { "id": "IT.PRO-12.2.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.3.2.3.3" } ], "prose": "Approval workflows are enforced for high-impact identity and access changes." } ] } ] } ] }, { "id": "IT.PRO-12.3", "title": "IT.PRO-12.3", "props": [ { "name": "sort-id", "value": "3.04.4" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" } ], "links": [ { "href": "#273a9201-4c54-5007-8c36-9c645b3caac0", "rel": "mitigated-technique", "text": "Mitigated technique: Create Account" }, { "href": "#5e12fa47-c2dd-5834-8f8e-aba05566851e", "rel": "mitigated-technique", "text": "Mitigated technique: Account Manipulation" } ], "parts": [ { "id": "IT.PRO-12.3.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.04.4.1" }, { "name": "label", "value": "Action" } ], "prose": "Provision user, administrative and non-person accounts with only the minimum access and privileges required to perform defined operational functions." }, { "id": "IT.PRO-12.3.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.04.4.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.04.4.2.1" } ], "parts": [ { "id": "IT.PRO-12.3.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.4.2.1.1" } ], "prose": "Accounts are provisioned with broad default permissions that exceed operational requirements." }, { "id": "IT.PRO-12.3.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.4.2.1.2" } ], "prose": "Administrative and day-to-day user functions share the same account, with no separate privileged accounts." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.04.4.2.2" } ], "parts": [ { "id": "IT.PRO-12.3.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.4.2.2.1" } ], "prose": "Minimum privilege provisioning is defined but not consistently applied to all account types." }, { "id": "IT.PRO-12.3.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.4.2.2.2" } ], "prose": "Administrative accounts are separated from user accounts but some exceptions exist without documented justification." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.04.4.2.3" } ], "parts": [ { "id": "IT.PRO-12.3.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.4.2.3.1" } ], "prose": "All accounts are provisioned with documented minimum permissions aligned to defined operational functions." }, { "id": "IT.PRO-12.3.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.4.2.3.2" } ], "prose": "Separate accounts are allocated for privileged and day-to-day functions, and controls prevent privileged use from day-to-day context." }, { "id": "IT.PRO-12.3.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.4.2.3.3" } ], "prose": "Non-person and service accounts are scoped to their specific integration requirements." } ] } ] } ] } ] }, { "id": "PRO-05", "class": "essentials-principle", "title": "PRO-05 - Secure administration", "props": [ { "name": "sort-id", "value": "3.05" } ], "parts": [ { "id": "PRO-05.overview", "name": "overview", "props": [ { "name": "sort-id", "value": "3.05.1" }, { "name": "label", "value": "Principle" } ], "prose": "Systems (infrastructure, operating systems, applications and data) are administered in a secure, accountable and auditable manner." } ], "controls": [ { "id": "IT.PRO-05.1", "title": "IT.PRO-05.1", "props": [ { "name": "sort-id", "value": "3.05.2" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" } ], "links": [ { "href": "#c73e777a-81e0-53e1-a470-3a6df2f16c9e", "rel": "mitigated-technique", "text": "Mitigated technique: Exploitation for Privilege Escalation" }, { "href": "#673978f9-01a4-5122-b90f-cf2cbd9ce239", "rel": "mitigated-technique", "text": "Mitigated technique: OS Credential Dumping" } ], "parts": [ { "id": "IT.PRO-05.1.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.05.2.1" }, { "name": "label", "value": "Action" } ], "prose": "Ensure administrative activities can only be performed from dedicated and hardened environments that are isolated from unprivileged user workloads." }, { "id": "IT.PRO-05.1.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.05.2.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.05.2.2.1" } ], "parts": [ { "id": "IT.PRO-05.1.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.05.2.2.1.1" } ], "prose": "Administrative access to systems is routinely performed from standard user devices without additional controls to protect the administrative session." }, { "id": "IT.PRO-05.1.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.05.2.2.1.2" } ], "prose": "No dedicated or hardened administrative environment exists." }, { "id": "IT.PRO-05.1.NE-3", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.05.2.2.1.3" } ], "prose": "Exceptions to the use of dedicated administrative environments are neither identified nor assessed." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.05.2.2.2" } ], "parts": [ { "id": "IT.PRO-05.1.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.05.2.2.2.1" } ], "prose": "A dedicated administrative environment has been established, but administrative access is not consistently routed through it." }, { "id": "IT.PRO-05.1.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.05.2.2.2.2" } ], "prose": "Administrative endpoints have been hardened, but unprivileged user workloads or unnecessary functions remain accessible." }, { "id": "IT.PRO-05.1.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.05.2.2.2.3" } ], "prose": "Exceptions are documented, but their justification, risk acceptance, compensating controls or review arrangements are incomplete or inconsistently applied." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.05.2.2.3" } ], "parts": [ { "id": "IT.PRO-05.1.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.05.2.2.3.1" } ], "prose": "Administrative sessions originate from dedicated and hardened administrative environments that are isolated from unprivileged user workloads. Where this cannot be technically enforced, exceptions are documented, risk-assessed, formally accepted and protected by compensating controls." }, { "id": "IT.PRO-05.1.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.05.2.2.3.2" } ], "prose": "Administrative environments are hardened and restricted to the functions required for authorised administration." }, { "id": "IT.PRO-05.1.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.05.2.2.3.3" } ], "prose": "Exceptions are limited to systems or services that cannot support administration through a dedicated environment, are periodically reviewed and are removed when the technical limitation no longer applies." } ] } ] } ] }, { "id": "IT.PRO-05.2", "title": "IT.PRO-05.2", "props": [ { "name": "sort-id", "value": "3.05.3" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" } ], "links": [ { "href": "#673978f9-01a4-5122-b90f-cf2cbd9ce239", "rel": "mitigated-technique", "text": "Mitigated technique: OS Credential Dumping" }, { "href": "#21ed2a3d-b86f-584e-b811-bb9ab6a90be4", "rel": "mitigated-technique", "text": "Mitigated technique: Use Alternate Authentication Material" }, { "href": "#54a1fec4-ca8d-56ee-a1b0-5e06e29d844b", "rel": "mitigated-technique", "text": "Mitigated technique: Steal or Forge Kerberos Tickets" } ], "parts": [ { "id": "IT.PRO-05.2.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.05.3.1" }, { "name": "label", "value": "Action" } ], "prose": "Enforce explicit session establishment controls before privileged actions are permitted, including the use of time-bound privilege grants." }, { "id": "IT.PRO-05.2.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.05.3.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.05.3.2.1" } ], "parts": [ { "id": "IT.PRO-05.2.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.05.3.2.1.1" } ], "prose": "Privileged access is standing and does not require explicit activation or time-bound grants, excluding approved break-glass and emergency access accounts." }, { "id": "IT.PRO-05.2.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.05.3.2.1.2" } ], "prose": "No re-authentication or step-up authentication is required before privileged sessions." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.05.3.2.2" } ], "parts": [ { "id": "IT.PRO-05.2.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.05.3.2.2.1" } ], "prose": "Time-bound access is implemented for some privileged roles but standing access remains for others." }, { "id": "IT.PRO-05.2.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.05.3.2.2.2" } ], "prose": "Session duration limits exist but are not consistently enforced or are set excessively long." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.05.3.2.3" } ], "parts": [ { "id": "IT.PRO-05.2.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.05.3.2.3.1" } ], "prose": "Time-bound privilege grants are enforced for applicable privileged roles, with defined maximum session durations and approved emergency access arrangements." }, { "id": "IT.PRO-05.2.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.05.3.2.3.2" } ], "prose": "Re-authentication or step-up authentication is required before privilege activation." }, { "id": "IT.PRO-05.2.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.05.3.2.3.3" } ], "prose": "All privilege activations are logged with activating user, role and timeframes." } ] } ] } ] }, { "id": "IT.PRO-05.3", "title": "IT.PRO-05.3", "props": [ { "name": "sort-id", "value": "3.05.4" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" } ], "links": [ { "href": "#7b9a147e-3ff0-575d-bd46-8175e912f663", "rel": "mitigated-technique", "text": "Mitigated technique: Disable or Modify Tools" }, { "href": "#d8919c75-5d9c-55c2-a60c-bd8be81e044a", "rel": "mitigated-technique", "text": "Mitigated technique: Modify Registry" }, { "href": "#273a9201-4c54-5007-8c36-9c645b3caac0", "rel": "mitigated-technique", "text": "Mitigated technique: Create Account" }, { "href": "#c6a132f7-7135-56d6-964b-df4430105d5b", "rel": "mitigated-technique", "text": "Mitigated technique: Create or Modify System Process" } ], "parts": [ { "id": "IT.PRO-05.3.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.05.4.1" }, { "name": "label", "value": "Action" } ], "prose": "Record all administrative or management actions that modify systems, configurations or controls, including the details of the associated user, timestamp and target." }, { "id": "IT.PRO-05.3.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.05.4.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.05.4.2.1" } ], "parts": [ { "id": "IT.PRO-05.3.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.05.4.2.1.1" } ], "prose": "Administrative or management actions that modify systems, configurations or controls are not logged." }, { "id": "IT.PRO-05.3.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.05.4.2.1.2" } ], "prose": "Logs do not capture sufficient detail to identify who made a change, when and to what target." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.05.4.2.2" } ], "parts": [ { "id": "IT.PRO-05.3.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.05.4.2.2.1" } ], "prose": "Logging is enabled and provides useful coverage, but does not cover all applicable administrative or management platforms." }, { "id": "IT.PRO-05.3.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.05.4.2.2.2" } ], "prose": "Logs capture the administrator identity and action but lack detail on the target or change nature." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.05.4.2.3" } ], "parts": [ { "id": "IT.PRO-05.3.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.05.4.2.3.1" } ], "prose": "Comprehensive audit logging to capture all administrative or management actions is enabled on all platforms in scope." }, { "id": "IT.PRO-05.3.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.05.4.2.3.2" } ], "prose": "Logs capture administrator identity, timestamp, target object and nature of change." } ] } ] } ] } ] }, { "id": "PRO-04", "class": "essentials-principle", "title": "PRO-04 - Secure configuration management", "props": [ { "name": "sort-id", "value": "3.06" } ], "parts": [ { "id": "PRO-04.overview", "name": "overview", "props": [ { "name": "sort-id", "value": "3.06.1" }, { "name": "label", "value": "Principle" } ], "prose": "Systems (infrastructure, operating systems and applications) are securely configured to approved and maintained baselines, including by reducing attack surfaces and attack paths, with configurations continually monitored and consistently enforced." } ], "controls": [ { "id": "IT.PRO-04.1", "title": "IT.PRO-04.1", "props": [ { "name": "sort-id", "value": "3.06.2" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#c525290c-5eea-5f39-a2fb-c2040a6e5fdb", "rel": "mitigated-technique", "text": "Mitigated technique: Server Software Component" }, { "href": "#c63496b4-4278-579d-9285-096cb1827bff", "rel": "mitigated-technique", "text": "Mitigated technique: Windows Management Instrumentation" }, { "href": "#6c7783e0-7afa-53d9-a1d1-14609e950bb8", "rel": "mitigated-technique", "text": "Mitigated technique: Network Service Discovery" }, { "href": "#673978f9-01a4-5122-b90f-cf2cbd9ce239", "rel": "mitigated-technique", "text": "Mitigated technique: OS Credential Dumping" } ], "parts": [ { "id": "IT.PRO-04.1.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.06.2.1" }, { "name": "label", "value": "Action" } ], "prose": "Define approved configuration baselines, informed by vendor and industry hardening guidance, that disable or remove unnecessary services, insecure settings, and unsupported or weak communication protocols." }, { "id": "IT.PRO-04.1.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.06.2.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.06.2.2.1" } ], "parts": [ { "id": "IT.PRO-04.1.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.2.2.1.1" } ], "prose": "No documented configuration baseline exists for assets." }, { "id": "IT.PRO-04.1.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.2.2.1.2" } ], "prose": "Systems are deployed with vendor defaults and no documented hardening has been applied." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.06.2.2.2" } ], "parts": [ { "id": "IT.PRO-04.1.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.2.2.2.1" } ], "prose": "A baseline exists but does not address all applicable asset types." }, { "id": "IT.PRO-04.1.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.2.2.2.2" } ], "prose": "The baseline is documented but has not been reviewed or updated within the cycle defined by the organisation." }, { "id": "IT.PRO-04.1.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.2.2.2.3" } ], "prose": "The baseline exists but rationale for configuration decisions is not documented." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.06.2.2.3" } ], "parts": [ { "id": "IT.PRO-04.1.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.2.2.3.1" } ], "prose": "A documented and approved baseline exists for all applicable asset types." }, { "id": "IT.PRO-04.1.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.2.2.3.2" } ], "prose": "The baseline disables or removes unnecessary services, insecure settings, and unsupported or weak communication protocols." }, { "id": "IT.PRO-04.1.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.2.2.3.3" } ], "prose": "Configuration decisions are documented with rationale to support drift assessment." }, { "id": "IT.PRO-04.1.FE-4", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.2.2.3.4" } ], "prose": "The baseline is reviewed and updated on a cycle defined by the organisation." } ] } ] } ] }, { "id": "IT.PRO-04.2", "title": "IT.PRO-04.2", "props": [ { "name": "sort-id", "value": "3.06.3" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#8506766a-663b-5c06-97d6-d810ca1c1efa", "rel": "mitigated-technique", "text": "Mitigated technique: Exploit Public-Facing Application" }, { "href": "#7c507df2-5896-514c-96a0-e5a3d03e185c", "rel": "mitigated-technique", "text": "Mitigated technique: External Remote Services" }, { "href": "#bc8e7bf7-de00-5611-971b-03f8177737f5", "rel": "mitigated-technique", "text": "Mitigated technique: User Execution" }, { "href": "#f7271268-a1b0-5db7-8e73-63a5b2c328ff", "rel": "mitigated-technique", "text": "Mitigated technique: Command and Scripting Interpreter" } ], "parts": [ { "id": "IT.PRO-04.2.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.06.3.1" }, { "name": "label", "value": "Action" } ], "prose": "Deploy approved configuration baselines on systems, including infrastructure, operating systems and applications." }, { "id": "IT.PRO-04.2.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.06.3.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.06.3.2.1" } ], "parts": [ { "id": "IT.PRO-04.2.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.3.2.1.1" } ], "prose": "Approved baselines have not been applied to assets." }, { "id": "IT.PRO-04.2.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.3.2.1.2" } ], "prose": "Baseline deployment has not been validated through technical assessment." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.06.3.2.2" } ], "parts": [ { "id": "IT.PRO-04.2.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.3.2.2.1" } ], "prose": "Approved baselines have been implemented where available, but some relevant asset types are not covered by an approved baseline." }, { "id": "IT.PRO-04.2.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.3.2.2.2" } ], "prose": "Deployment has occurred but validation through technical assessment is incomplete or not current." }, { "id": "IT.PRO-04.2.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.3.2.2.3" } ], "prose": "Approved baselines have been deployed, but coverage for all applicable assets is inconsistent." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.06.3.2.3" } ], "parts": [ { "id": "IT.PRO-04.2.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.3.2.3.1" } ], "prose": "Approved baselines have been applied to all applicable assets." }, { "id": "IT.PRO-04.2.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.3.2.3.2" } ], "prose": "Deployment has been validated through technical assessment." }, { "id": "IT.PRO-04.2.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.3.2.3.3" } ], "prose": "Coverage metrics are available demonstrating deployment completeness." } ] } ] } ] }, { "id": "IT.PRO-04.3", "title": "IT.PRO-04.3", "props": [ { "name": "sort-id", "value": "3.06.4" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#7b9a147e-3ff0-575d-bd46-8175e912f663", "rel": "mitigated-technique", "text": "Mitigated technique: Disable or Modify Tools" }, { "href": "#d8919c75-5d9c-55c2-a60c-bd8be81e044a", "rel": "mitigated-technique", "text": "Mitigated technique: Modify Registry" } ], "parts": [ { "id": "IT.PRO-04.3.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.06.4.1" }, { "name": "label", "value": "Action" } ], "prose": "Detect and respond to configuration drift using scheduled technical assessments and, where supported, automated monitoring, based on system criticality and change rate." }, { "id": "IT.PRO-04.3.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.06.4.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.06.4.2.1" } ], "parts": [ { "id": "IT.PRO-04.3.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.4.2.1.1" } ], "prose": "No mechanism exists to detect configuration drift from approved baselines." }, { "id": "IT.PRO-04.3.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.4.2.1.2" } ], "prose": "Assessments to detect configuration drift have not been conducted within the review period defined by the organisation." }, { "id": "IT.PRO-04.3.NE-3", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.4.2.1.3" } ], "prose": "Assessments do not systematically identify instances of configuration drift for assets." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.06.4.2.2" } ], "parts": [ { "id": "IT.PRO-04.3.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.4.2.2.1" } ], "prose": "Drift detection is in place but does not cover all applicable assets." }, { "id": "IT.PRO-04.3.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.4.2.2.2" } ], "prose": "Drift is detected but the remediation process is informal or response timeframes are not defined." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.06.4.2.3" } ], "parts": [ { "id": "IT.PRO-04.3.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.4.2.3.1" } ], "prose": "Automated configuration monitoring or regular technical assessments detect drift across the applicable assets, occurring at a frequency based on system criticality and change rate." }, { "id": "IT.PRO-04.3.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.4.2.3.2" } ], "prose": "A documented remediation process exists with defined response timeframes aligned to severity." }, { "id": "IT.PRO-04.3.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.4.2.3.3" } ], "prose": "Drift events are tracked to closure with evidence of remediation." } ] } ] } ] } ] }, { "id": "PRO-06", "class": "essentials-principle", "title": "PRO-06 - Vulnerability management", "props": [ { "name": "sort-id", "value": "3.07" } ], "parts": [ { "id": "PRO-06.overview", "name": "overview", "props": [ { "name": "sort-id", "value": "3.07.1" }, { "name": "label", "value": "Principle" } ], "prose": "Vulnerabilities in systems (infrastructure, operating systems, applications and data) are identified, documented, validated and prioritised for remediation or mitigation in a timely manner, with all remediation and mitigation actions verified for effectiveness." } ], "controls": [ { "id": "IT.PRO-06.1", "title": "IT.PRO-06.1", "props": [ { "name": "sort-id", "value": "3.07.2" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#8506766a-663b-5c06-97d6-d810ca1c1efa", "rel": "mitigated-technique", "text": "Mitigated technique: Exploit Public-Facing Application" }, { "href": "#c73e777a-81e0-53e1-a470-3a6df2f16c9e", "rel": "mitigated-technique", "text": "Mitigated technique: Exploitation for Privilege Escalation" }, { "href": "#c8a8aa25-4f5d-5499-ace7-6c4f319dc2d2", "rel": "mitigated-technique", "text": "Mitigated technique: Exploitation of Remote Services" }, { "href": "#1efe1353-9697-5390-88a4-c28d87de2074", "rel": "mitigated-technique", "text": "Mitigated technique: Exploitation for Client Execution" } ], "parts": [ { "id": "IT.PRO-06.1.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.07.2.1" }, { "name": "label", "value": "Action" } ], "prose": "Identify known software and configuration weaknesses of assets through continuous and repeatable assessment activities, including vulnerability scanning activities." }, { "id": "IT.PRO-06.1.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.07.2.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.07.2.2.1" } ], "parts": [ { "id": "IT.PRO-06.1.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.2.2.1.1" } ], "prose": "Vulnerability scanning activities are not undertaken." }, { "id": "IT.PRO-06.1.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.2.2.1.2" } ], "prose": "No routine vulnerability assessment activity has been conducted within a period defined by the organisation." }, { "id": "IT.PRO-06.1.NE-3", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.2.2.1.3" } ], "prose": "Advisories for relevant software and configuration weaknesses for organisational assets are not reviewed and assessed for impact." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.07.2.2.2" } ], "parts": [ { "id": "IT.PRO-06.1.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.2.2.2.1" } ], "prose": "Vulnerability scanning is deployed but does not cover all applicable assets." }, { "id": "IT.PRO-06.1.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.2.2.2.2" } ], "prose": "Vulnerability scans are conducted but results are not reviewed and prioritised within timeframes defined by the organisation." }, { "id": "IT.PRO-06.1.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.2.2.2.3" } ], "prose": "Vulnerability scans are conducted but frequency is not regular enough to enable timely response." }, { "id": "IT.PRO-06.1.PE-4", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.2.2.2.4" } ], "prose": "Scanning covers software vulnerabilities but not configuration weaknesses." }, { "id": "IT.PRO-06.1.PE-5", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.2.2.2.5" } ], "prose": "Advisories for relevant software and configuration weaknesses for organisational assets are reviewed on an ad hoc basis, or only for some assets." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.07.2.2.3" } ], "parts": [ { "id": "IT.PRO-06.1.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.2.2.3.1" } ], "prose": "All applicable assets are included in routine vulnerability scanning, and scanning frequency enables timely response." }, { "id": "IT.PRO-06.1.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.2.2.3.2" } ], "prose": "Scanning covers both software vulnerabilities and configuration weaknesses." }, { "id": "IT.PRO-06.1.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.2.2.3.3" } ], "prose": "Results are reviewed and prioritised within timeframes defined by the organisation." }, { "id": "IT.PRO-06.1.FE-4", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.2.2.3.4" } ], "prose": "Advisories for relevant software and configuration weaknesses in all organisational assets are regularly reviewed and assessed for impact." } ] } ] } ] }, { "id": "IT.PRO-06.2", "title": "IT.PRO-06.2", "props": [ { "name": "sort-id", "value": "3.07.3" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#8506766a-663b-5c06-97d6-d810ca1c1efa", "rel": "mitigated-technique", "text": "Mitigated technique: Exploit Public-Facing Application" }, { "href": "#c73e777a-81e0-53e1-a470-3a6df2f16c9e", "rel": "mitigated-technique", "text": "Mitigated technique: Exploitation for Privilege Escalation" }, { "href": "#c8a8aa25-4f5d-5499-ace7-6c4f319dc2d2", "rel": "mitigated-technique", "text": "Mitigated technique: Exploitation of Remote Services" }, { "href": "#1efe1353-9697-5390-88a4-c28d87de2074", "rel": "mitigated-technique", "text": "Mitigated technique: Exploitation for Client Execution" } ], "parts": [ { "id": "IT.PRO-06.2.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.07.3.1" }, { "name": "label", "value": "Action" } ], "prose": "Apply security patches or updates within defined risk-based timeframes or automatically where operational impact is low." }, { "id": "IT.PRO-06.2.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.07.3.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.07.3.2.1" } ], "parts": [ { "id": "IT.PRO-06.2.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.3.2.1.1" } ], "prose": "No defined patching timeframes exist for applicable assets." }, { "id": "IT.PRO-06.2.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.3.2.1.2" } ], "prose": "Patches are not applied or are applied on an ad hoc basis with no tracking." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.07.3.2.2" } ], "parts": [ { "id": "IT.PRO-06.2.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.3.2.2.1" } ], "prose": "Expected patching timeframes are defined by the organisation but are not consistently met." }, { "id": "IT.PRO-06.2.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.3.2.2.2" } ], "prose": "Patches are applied but compensating controls are not documented where operational constraints prevent timely patching." }, { "id": "IT.PRO-06.2.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.3.2.2.3" } ], "prose": "Patching coverage metrics exist but show significant gaps." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.07.3.2.3" } ], "parts": [ { "id": "IT.PRO-06.2.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.3.2.3.1" } ], "prose": "Risk-based patching timeframes defined by the organisation are in place and consistently met." }, { "id": "IT.PRO-06.2.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.3.2.3.2" } ], "prose": "Patching is prioritised based on vulnerability severity, exposure and exploit availability." }, { "id": "IT.PRO-06.2.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.3.2.3.3" } ], "prose": "Where operational constraints prevent timely patching, compensating controls are documented and approved." }, { "id": "IT.PRO-06.2.FE-4", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.3.2.3.4" } ], "prose": "Patching coverage metrics account for all applicable assets, with any exclusions identified and formally risk accepted." }, { "id": "IT.PRO-06.2.FE-5", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.3.2.3.5" } ], "prose": "Automatic patching of assets is applied where available and the organisation has determined operational impact is low." } ] } ] } ] }, { "id": "IT.PRO-06.3", "title": "IT.PRO-06.3", "props": [ { "name": "sort-id", "value": "3.07.4" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#8506766a-663b-5c06-97d6-d810ca1c1efa", "rel": "mitigated-technique", "text": "Mitigated technique: Exploit Public-Facing Application" }, { "href": "#c73e777a-81e0-53e1-a470-3a6df2f16c9e", "rel": "mitigated-technique", "text": "Mitigated technique: Exploitation for Privilege Escalation" }, { "href": "#c8a8aa25-4f5d-5499-ace7-6c4f319dc2d2", "rel": "mitigated-technique", "text": "Mitigated technique: Exploitation of Remote Services" }, { "href": "#1efe1353-9697-5390-88a4-c28d87de2074", "rel": "mitigated-technique", "text": "Mitigated technique: Exploitation for Client Execution" } ], "parts": [ { "id": "IT.PRO-06.3.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.07.4.1" }, { "name": "label", "value": "Action" } ], "prose": "Remediate or mitigate vulnerabilities exceeding defined risk thresholds within defined timeframes based on exploitation, exposure, criticality, impact and compensating controls, and verify treatment effectiveness." }, { "id": "IT.PRO-06.3.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.07.4.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.07.4.2.1" } ], "parts": [ { "id": "IT.PRO-06.3.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.4.2.1.1" } ], "prose": "No risk thresholds are defined for vulnerability remediation." }, { "id": "IT.PRO-06.3.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.4.2.1.2" } ], "prose": "Vulnerabilities exceeding acceptable risk levels are not tracked or remediated." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.07.4.2.2" } ], "parts": [ { "id": "IT.PRO-06.3.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.4.2.2.1" } ], "prose": "Risk thresholds are defined but vulnerabilities exceeding them are not consistently remediated within defined timeframes." }, { "id": "IT.PRO-06.3.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.4.2.2.2" } ], "prose": "Compensating controls are applied in some cases but are not formally documented or approved." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.07.4.2.3" } ], "parts": [ { "id": "IT.PRO-06.3.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.4.2.3.1" } ], "prose": "Risk thresholds defined by the organisation exist, and vulnerabilities exceeding them are remediated or have approved compensating controls within organisationally defined timeframes." }, { "id": "IT.PRO-06.3.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.4.2.3.2" } ], "prose": "Remediation and mitigation actions are tracked to closure with verification that actions reduced the risk as intended." }, { "id": "IT.PRO-06.3.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.4.2.3.3" } ], "prose": "The process is sustained, with historical data demonstrating consistent performance across organisationally defined reporting periods." } ] } ] } ] } ] }, { "id": "PRO-07", "class": "essentials-principle", "title": "PRO-07 - Trustworthy software", "props": [ { "name": "sort-id", "value": "3.08" } ], "parts": [ { "id": "PRO-07.overview", "name": "overview", "props": [ { "name": "sort-id", "value": "3.08.1" }, { "name": "label", "value": "Principle" } ], "prose": "Systems (operating systems and applications) only permit the execution of software that is supported, verified and authorised." } ], "controls": [ { "id": "IT.PRO-07.1", "title": "IT.PRO-07.1", "props": [ { "name": "sort-id", "value": "3.08.2" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#7b9a147e-3ff0-575d-bd46-8175e912f663", "rel": "mitigated-technique", "text": "Mitigated technique: Disable or Modify Tools" }, { "href": "#bc8e7bf7-de00-5611-971b-03f8177737f5", "rel": "mitigated-technique", "text": "Mitigated technique: User Execution" }, { "href": "#f7271268-a1b0-5db7-8e73-63a5b2c328ff", "rel": "mitigated-technique", "text": "Mitigated technique: Command and Scripting Interpreter" }, { "href": "#c63496b4-4278-579d-9285-096cb1827bff", "rel": "mitigated-technique", "text": "Mitigated technique: Windows Management Instrumentation" }, { "href": "#3cdb8a7b-7078-504c-b939-b63f740335c9", "rel": "mitigated-technique", "text": "Mitigated technique: Process Injection" }, { "href": "#49f81937-6239-545c-9a71-294e320e4648", "rel": "mitigated-technique", "text": "Mitigated technique: System Binary Proxy Execution" } ], "parts": [ { "id": "IT.PRO-07.1.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.08.2.1" }, { "name": "label", "value": "Action" } ], "prose": "Permit only supported, verified and organisation-authorised software to execute on systems, with exceptions minimised, formally risk accepted, time-bound, monitored and regularly reviewed." }, { "id": "IT.PRO-07.1.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.08.2.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.08.2.2.1" } ], "parts": [ { "id": "IT.PRO-07.1.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.2.2.1.1" } ], "prose": "Unsupported, unverified or unauthorised software can execute without restriction." }, { "id": "IT.PRO-07.1.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.2.2.1.2" } ], "prose": "The list of approved software does not exist." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.08.2.2.2" } ], "parts": [ { "id": "IT.PRO-07.1.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.2.2.2.1" } ], "prose": "Execution restriction controls are deployed but do not cover all applicable assets." }, { "id": "IT.PRO-07.1.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.2.2.2.2" } ], "prose": "The organisation maintains a list of approved software, but it has not been reviewed within timeframes defined by the organisation." }, { "id": "IT.PRO-07.1.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.2.2.2.3" } ], "prose": "Execution restrictions are in place but integrity verification of approved software is not performed." }, { "id": "IT.PRO-07.1.PE-4", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.2.2.2.4" } ], "prose": "Exceptions to execution restrictions are granted without formal approval or time-bounding." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.08.2.2.3" } ], "parts": [ { "id": "IT.PRO-07.1.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.2.2.3.1" } ], "prose": "Controls restrict execution to supported, organisation-authorised and integrity-verified software on all applicable assets." }, { "id": "IT.PRO-07.1.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.2.2.3.2" } ], "prose": "The organisation maintains a list of approved software and reviews it within the timeframes defined by the organisation." }, { "id": "IT.PRO-07.1.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.2.2.3.3" } ], "prose": "Integrity of permitted software is verified using trusted mechanisms appropriate to the software and its source." }, { "id": "IT.PRO-07.1.FE-4", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.2.2.3.4" } ], "prose": "Exceptions are formally approved, documented, time-bound and reviewed on a regular cycle defined by the organisation." } ] } ] } ] }, { "id": "IT.PRO-07.2", "title": "IT.PRO-07.2", "props": [ { "name": "sort-id", "value": "3.08.3" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#7b9a147e-3ff0-575d-bd46-8175e912f663", "rel": "mitigated-technique", "text": "Mitigated technique: Disable or Modify Tools" }, { "href": "#bc8e7bf7-de00-5611-971b-03f8177737f5", "rel": "mitigated-technique", "text": "Mitigated technique: User Execution" }, { "href": "#f7271268-a1b0-5db7-8e73-63a5b2c328ff", "rel": "mitigated-technique", "text": "Mitigated technique: Command and Scripting Interpreter" }, { "href": "#c63496b4-4278-579d-9285-096cb1827bff", "rel": "mitigated-technique", "text": "Mitigated technique: Windows Management Instrumentation" }, { "href": "#3cdb8a7b-7078-504c-b939-b63f740335c9", "rel": "mitigated-technique", "text": "Mitigated technique: Process Injection" }, { "href": "#49f81937-6239-545c-9a71-294e320e4648", "rel": "mitigated-technique", "text": "Mitigated technique: System Binary Proxy Execution" } ], "parts": [ { "id": "IT.PRO-07.2.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.08.3.1" }, { "name": "label", "value": "Action" } ], "prose": "Restrict administrative and management tooling to approved software sets and executed from only authorised, known locations." }, { "id": "IT.PRO-07.2.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.08.3.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.08.3.2.1" } ], "parts": [ { "id": "IT.PRO-07.2.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.3.2.1.1" } ], "prose": "No approved administrative toolset is defined." }, { "id": "IT.PRO-07.2.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.3.2.1.2" } ], "prose": "No restrictions are placed on the location administrative tooling can be executed from." }, { "id": "IT.PRO-07.2.NE-3", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.3.2.1.3" } ], "prose": "No controls prevent unapproved administrative tools, including tools commonly used in post-compromise activity, from executing on managed assets." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.08.3.2.2" } ], "parts": [ { "id": "IT.PRO-07.2.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.3.2.2.1" } ], "prose": "An approved toolset is defined but not consistently enforced across all assets." }, { "id": "IT.PRO-07.2.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.3.2.2.2" } ], "prose": "Administrative tooling is configured to execute from known locations, but privileged users can still run tooling from unapproved locations." }, { "id": "IT.PRO-07.2.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.3.2.2.3" } ], "prose": "Some unapproved administrative tools are blocked but enforcement gaps exist." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.08.3.2.3" } ], "parts": [ { "id": "IT.PRO-07.2.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.3.2.3.1" } ], "prose": "A defined and enforced approved toolset exists for administrative and management activities, and execution is limited to authorised, known locations." }, { "id": "IT.PRO-07.2.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.3.2.3.2" } ], "prose": "Administrative and management tooling outside the approved set is blocked from execution, including from unauthorised locations." } ] } ] } ] } ] }, { "id": "PRO-10", "class": "essentials-principle", "title": "PRO-10 - Regular and proven backups", "props": [ { "name": "sort-id", "value": "3.09" } ], "parts": [ { "id": "PRO-10.overview", "name": "overview", "props": [ { "name": "sort-id", "value": "3.09.1" }, { "name": "label", "value": "Principle" } ], "prose": "Systems (infrastructure, operating systems, applications and data) are regularly backed up in a secure and proven manner, including through the validation of restoration capabilities." } ], "controls": [ { "id": "IT.PRO-10.1", "title": "IT.PRO-10.1", "props": [ { "name": "sort-id", "value": "3.09.2" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" } ], "links": [ { "href": "#b2a1e1f4-45e5-53cc-9ab8-a7a506d574aa", "rel": "mitigated-technique", "text": "Mitigated technique: Data Encrypted for Impact" }, { "href": "#3997970a-d2c2-5d3f-9dcc-8beed16e06a6", "rel": "mitigated-technique", "text": "Mitigated technique: Inhibit System Recovery" } ], "parts": [ { "id": "IT.PRO-10.1.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.09.2.1" }, { "name": "label", "value": "Action" } ], "prose": "Back up important data, applications and settings on a defined schedule to secure, resilient storage protected by encryption and immutable, offline, logically isolated or equivalent controls." }, { "id": "IT.PRO-10.1.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.09.2.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.09.2.2.1" } ], "parts": [ { "id": "IT.PRO-10.1.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.09.2.2.1.1" } ], "prose": "No managed backup process exists for important data, applications and settings." }, { "id": "IT.PRO-10.1.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.09.2.2.1.2" } ], "prose": "Backup storage is neither encrypted nor protected by immutable, offline, logically isolated or equivalent controls." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.09.2.2.2" } ], "parts": [ { "id": "IT.PRO-10.1.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.09.2.2.2.1" } ], "prose": "Important data, applications and settings are backed up, but backup schedules are not defined, do not cover all important assets, or are not consistently met." }, { "id": "IT.PRO-10.1.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.09.2.2.2.2" } ], "prose": "Backups are encrypted but no immutable, offline, logically isolated or equivalent resilience controls are consistently applied." }, { "id": "IT.PRO-10.1.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.09.2.2.2.3" } ], "prose": "Backups use immutable, offline, logically isolated or equivalent controls, but encryption is not consistently enforced." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.09.2.2.3" } ], "parts": [ { "id": "IT.PRO-10.1.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.09.2.2.3.1" } ], "prose": "All important data, applications and settings are backed up according to schedules defined by the organisation and aligned with their recovery requirements." }, { "id": "IT.PRO-10.1.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.09.2.2.3.2" } ], "prose": "Backup schedules are monitored, and missed or unsuccessful backups are identified, investigated and remediated within timeframes defined by the organisation." }, { "id": "IT.PRO-10.1.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.09.2.2.3.3" } ], "prose": "Backup storage is encrypted and protected by immutable, offline, logically isolated or equivalent controls." } ] } ] } ] }, { "id": "IT.PRO-10.2", "title": "IT.PRO-10.2", "props": [ { "name": "sort-id", "value": "3.09.3" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" } ], "links": [ { "href": "#b2a1e1f4-45e5-53cc-9ab8-a7a506d574aa", "rel": "mitigated-technique", "text": "Mitigated technique: Data Encrypted for Impact" }, { "href": "#7b503e3a-a051-5a53-840d-4cef38895687", "rel": "mitigated-technique", "text": "Mitigated technique: Data from Local System" }, { "href": "#3997970a-d2c2-5d3f-9dcc-8beed16e06a6", "rel": "mitigated-technique", "text": "Mitigated technique: Inhibit System Recovery" } ], "parts": [ { "id": "IT.PRO-10.2.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.09.3.1" }, { "name": "label", "value": "Action" } ], "prose": "Isolate backup repositories from general user environments and production workloads, ensuring they are separated from primary systems to prevent unauthorised access, modification or deletion." }, { "id": "IT.PRO-10.2.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.09.3.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.09.3.2.1" } ], "parts": [ { "id": "IT.PRO-10.2.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.09.3.2.1.1" } ], "prose": "Backup repositories are accessible from the production environment or by production administrators." }, { "id": "IT.PRO-10.2.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.09.3.2.1.2" } ], "prose": "Compromise of a system would provide a direct path to access, modify or delete its own backups." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.09.3.2.2" } ], "parts": [ { "id": "IT.PRO-10.2.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.09.3.2.2.1" } ], "prose": "Backup repositories are logically separated but use credentials managed by the same identity platform as production." }, { "id": "IT.PRO-10.2.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.09.3.2.2.2" } ], "prose": "Isolation is implemented but has not been tested or validated." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.09.3.2.3" } ], "parts": [ { "id": "IT.PRO-10.2.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.09.3.2.3.1" } ], "prose": "Backup repositories are isolated from production environments and general user access." }, { "id": "IT.PRO-10.2.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.09.3.2.3.2" } ], "prose": "Access is controlled through credentials and administrative paths isolated from compromise of the primary identity environment." }, { "id": "IT.PRO-10.2.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.09.3.2.3.3" } ], "prose": "Isolation has been validated to confirm that compromise of a system does not provide access to backups." } ] } ] } ] }, { "id": "IT.PRO-10.3", "title": "IT.PRO-10.3", "props": [ { "name": "sort-id", "value": "3.09.4" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" } ], "links": [ { "href": "#b2a1e1f4-45e5-53cc-9ab8-a7a506d574aa", "rel": "mitigated-technique", "text": "Mitigated technique: Data Encrypted for Impact" }, { "href": "#3997970a-d2c2-5d3f-9dcc-8beed16e06a6", "rel": "mitigated-technique", "text": "Mitigated technique: Inhibit System Recovery" } ], "parts": [ { "id": "IT.PRO-10.3.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.09.4.1" }, { "name": "label", "value": "Action" } ], "prose": "Conduct regular testing of backup and restoration procedures to ensure that backups are reliable and capable of meeting defined recovery time objectives and recovery point objectives." }, { "id": "IT.PRO-10.3.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.09.4.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.09.4.2.1" } ], "parts": [ { "id": "IT.PRO-10.3.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.09.4.2.1.1" } ], "prose": "No restoration test has been conducted within the test cycle defined by the organisation." }, { "id": "IT.PRO-10.3.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.09.4.2.1.2" } ], "prose": "No backup or restoration procedures exist." }, { "id": "IT.PRO-10.3.NE-3", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.09.4.2.1.3" } ], "prose": "Restoration testing demonstrates that backups cannot be restored, or consistently fail to meet defined recovery time or recovery point objectives." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.09.4.2.2" } ], "parts": [ { "id": "IT.PRO-10.3.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.09.4.2.2.1" } ], "prose": "Restoration testing has been conducted but does not cover all important assets." }, { "id": "IT.PRO-10.3.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.09.4.2.2.2" } ], "prose": "Backup procedures exist but have never been tested." }, { "id": "IT.PRO-10.3.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.09.4.2.2.3" } ], "prose": "Testing has been conducted but coverage is incomplete or some tests did not meet the expected recovery time or recovery point objectives." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.09.4.2.3" } ], "parts": [ { "id": "IT.PRO-10.3.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.09.4.2.3.1" } ], "prose": "Restoration testing covering important assets is conducted within the test cycle defined by the organisation." }, { "id": "IT.PRO-10.3.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.09.4.2.3.2" } ], "prose": "Testing validates that restoration meets the expected recovery time and recovery point objectives." }, { "id": "IT.PRO-10.3.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.09.4.2.3.3" } ], "prose": "Test results are documented and gaps identified during testing are remediated." } ] } ] } ] } ] }, { "id": "PRO-18", "class": "essentials-principle", "title": "PRO-18 - Network segmentation and segregation", "props": [ { "name": "sort-id", "value": "3.10" } ], "parts": [ { "id": "PRO-18.overview", "name": "overview", "props": [ { "name": "sort-id", "value": "3.10.1" }, { "name": "label", "value": "Principle" } ], "prose": "Systems (infrastructure, operating systems and applications) are segmented into network zones based on business criticality and trust levels, with only authorised, controlled and monitored inbound and outbound communication paths between network zones permitted." } ], "controls": [ { "id": "IT.PRO-18.1", "title": "IT.PRO-18.1", "props": [ { "name": "sort-id", "value": "3.10.2" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" } ], "links": [ { "href": "#8506766a-663b-5c06-97d6-d810ca1c1efa", "rel": "mitigated-technique", "text": "Mitigated technique: Exploit Public-Facing Application" }, { "href": "#7c507df2-5896-514c-96a0-e5a3d03e185c", "rel": "mitigated-technique", "text": "Mitigated technique: External Remote Services" } ], "parts": [ { "id": "IT.PRO-18.1.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.10.2.1" }, { "name": "label", "value": "Action" } ], "prose": "Isolate systems within network zones based on business criticality and trust level, and restrict and monitor inbound and outbound access to explicitly approved pathways and services." }, { "id": "IT.PRO-18.1.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.10.2.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.10.2.2.1" } ], "parts": [ { "id": "IT.PRO-18.1.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.10.2.2.1.1" } ], "prose": "Systems are deployed on shared or flat network segments with no segregation between functions or trust levels." }, { "id": "IT.PRO-18.1.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.10.2.2.1.2" } ], "prose": "No access controls restrict network access from external or general user networks to in-scope systems." }, { "id": "IT.PRO-18.1.NE-3", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.10.2.2.1.3" } ], "prose": "Segmentation is documented or administratively defined but not enforced by technical controls." }, { "id": "IT.PRO-18.1.NE-4", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.10.2.2.1.4" } ], "prose": "Segmentation has not been validated through technical assessment." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.10.2.2.2" } ], "parts": [ { "id": "IT.PRO-18.1.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.10.2.2.2.1" } ], "prose": "Network segmentation has been implemented but does not cover all in-scope systems, or segments are defined inconsistently." }, { "id": "IT.PRO-18.1.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.10.2.2.2.2" } ], "prose": "Access controls exist between segments, but deny-by-default is not enforced, or some pathways are permitted without documented approval." }, { "id": "IT.PRO-18.1.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.10.2.2.2.3" } ], "prose": "Technical enforcement is in place for some segments but relies on a single mechanism that does not provide meaningful isolation." }, { "id": "IT.PRO-18.1.PE-4", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.10.2.2.2.4" } ], "prose": "Validation has been performed for some segments but not consistently across in-scope systems, or validation is out of date." }, { "id": "IT.PRO-18.1.PE-5", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.10.2.2.2.5" } ], "prose": "Pathways are reviewed, but findings are not actioned, or the review cycle is not defined by the organisation." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.10.2.2.3" } ], "parts": [ { "id": "IT.PRO-18.1.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.10.2.2.3.1" } ], "prose": "Systems within scope are deployed in network segments defined according to function, criticality and trust level, with segmentation applied consistently." }, { "id": "IT.PRO-18.1.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.10.2.2.3.2" } ], "prose": "Deny-by-default access controls are enforced between segments, with access from external and general user networks limited to documented and approved pathways." }, { "id": "IT.PRO-18.1.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.10.2.2.3.3" } ], "prose": "Segmentation is enforced through network-layer technical controls that provide meaningful isolation." }, { "id": "IT.PRO-18.1.FE-4", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.10.2.2.3.4" } ], "prose": "Segmentation has been validated through technical assessment with results documented and gaps remediated." }, { "id": "IT.PRO-18.1.FE-5", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.10.2.2.3.5" } ], "prose": "Approved pathways are reviewed on a regular cycle defined by the organisation, with unjustified pathways removed and changes reflected in the access control configuration." } ] } ] } ] }, { "id": "IT.PRO-18.2", "title": "IT.PRO-18.2", "props": [ { "name": "sort-id", "value": "3.10.3" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" } ], "links": [ { "href": "#ecd4f2ca-f615-539b-bf51-98fa38c69549", "rel": "mitigated-technique", "text": "Mitigated technique: Remote Services" }, { "href": "#ed204c2e-7780-55e0-aac2-a2d59bf66243", "rel": "mitigated-technique", "text": "Mitigated technique: Lateral Tool Transfer" } ], "parts": [ { "id": "IT.PRO-18.2.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.10.3.1" }, { "name": "label", "value": "Action" } ], "prose": "Limit lateral movement between, and within, network segments to explicitly approved pathways and services, based on business requirements and trust levels." }, { "id": "IT.PRO-18.2.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.10.3.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.10.3.2.1" } ], "parts": [ { "id": "IT.PRO-18.2.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.10.3.2.1.1" } ], "prose": "No controls limit lateral movement between or within network segments." }, { "id": "IT.PRO-18.2.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.10.3.2.1.2" } ], "prose": "Lateral movement is permitted by default across the environment, with restrictions applied only on an exception basis." }, { "id": "IT.PRO-18.2.NE-3", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.10.3.2.1.3" } ], "prose": "Approved pathways are not documented." }, { "id": "IT.PRO-18.2.NE-4", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.10.3.2.1.4" } ], "prose": "Lateral movement controls have not been validated through technical assessment." }, { "id": "IT.PRO-18.2.NE-5", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.10.3.2.1.5" } ], "prose": "Pathways and services are not reviewed after initial approval." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.10.3.2.2" } ], "parts": [ { "id": "IT.PRO-18.2.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.10.3.2.2.1" } ], "prose": "Controls limit lateral movement between segments but no controls operate within segments." }, { "id": "IT.PRO-18.2.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.10.3.2.2.2" } ], "prose": "Restrictions are applied to some pathways, but the default position remains permissive in parts of the environment." }, { "id": "IT.PRO-18.2.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.10.3.2.2.3" } ], "prose": "Approved pathways are documented but documentation is out of date or incomplete." }, { "id": "IT.PRO-18.2.PE-4", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.10.3.2.2.4" } ], "prose": "Validation has been performed but does not cover all in-scope segments, or is out of date." }, { "id": "IT.PRO-18.2.PE-5", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.10.3.2.2.5" } ], "prose": "Pathways are reviewed, but findings are not actioned, or the review cycle is not defined by the organisation." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.10.3.2.3" } ], "parts": [ { "id": "IT.PRO-18.2.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.10.3.2.3.1" } ], "prose": "Controls limit lateral movement both between and within segments, with deny-by-default applied at each boundary." }, { "id": "IT.PRO-18.2.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.10.3.2.3.2" } ], "prose": "Pathways and services are explicitly approved based on documented business requirements and trust levels, with all other lateral movement denied." }, { "id": "IT.PRO-18.2.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.10.3.2.3.3" } ], "prose": "Approved pathways are documented, reflect the current configuration and identify the business requirement and trust relationship justifying each." }, { "id": "IT.PRO-18.2.FE-4", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.10.3.2.3.4" } ], "prose": "Lateral movement controls have been validated through technical assessment with results documented and gaps remediated." }, { "id": "IT.PRO-18.2.FE-5", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.10.3.2.3.5" } ], "prose": "Pathways and services are reviewed on a regular cycle defined by the organisation, with unjustified pathways removed and the configuration updated to reflect approved changes." } ] } ] } ] } ] }, { "id": "PRO-09", "class": "essentials-principle", "title": "PRO-09 - Content filtering", "props": [ { "name": "sort-id", "value": "3.11" } ], "parts": [ { "id": "PRO-09.overview", "name": "overview", "props": [ { "name": "sort-id", "value": "3.11.1" }, { "name": "label", "value": "Principle" } ], "prose": "Data communicated between different security domains for systems (infrastructure and applications) is controlled and subject to inspection and verification." } ], "controls": [ { "id": "IT.PRO-09.1", "title": "IT.PRO-09.1", "props": [ { "name": "sort-id", "value": "3.11.2" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" } ], "links": [ { "href": "#f51dc9c1-1ce7-5584-bd1e-806c874d4643", "rel": "mitigated-technique", "text": "Mitigated technique: Exfiltration Over C2 Channel" }, { "href": "#9beb23c7-6abc-50ab-87b7-f905d080ed37", "rel": "mitigated-technique", "text": "Mitigated technique: Exfiltration Over Alternative Protocol" }, { "href": "#662f9ea9-efe4-5d65-aa67-0010a55a54a8", "rel": "mitigated-technique", "text": "Mitigated technique: Proxy" } ], "parts": [ { "id": "IT.PRO-09.1.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.11.2.1" }, { "name": "label", "value": "Action" } ], "prose": "Inspect outbound content flows to detect unauthorised transfer of sensitive or high-value data." }, { "id": "IT.PRO-09.1.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.11.2.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.11.2.2.1" } ], "parts": [ { "id": "IT.PRO-09.1.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.11.2.2.1.1" } ], "prose": "No outbound content inspection is deployed." }, { "id": "IT.PRO-09.1.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.11.2.2.1.2" } ], "prose": "Sensitive data can leave the organisation through any egress path without detection or control." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.11.2.2.2" } ], "parts": [ { "id": "IT.PRO-09.1.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.11.2.2.2.1" } ], "prose": "Outbound inspection is deployed but does not cover all applicable egress paths." }, { "id": "IT.PRO-09.1.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.11.2.2.2.2" } ], "prose": "Rules are configured but do not cover all classified, regulated or high-value data types." }, { "id": "IT.PRO-09.1.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.11.2.2.2.3" } ], "prose": "Alerts are generated but are not triaged or acted upon in a timely manner." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.11.2.2.3" } ], "parts": [ { "id": "IT.PRO-09.1.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.11.2.2.3.1" } ], "prose": "Outbound content inspection is deployed covering all applicable egress paths." }, { "id": "IT.PRO-09.1.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.11.2.2.3.2" } ], "prose": "Rules are configured to detect unauthorised transfer of classified, regulated and high-value data." }, { "id": "IT.PRO-09.1.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.11.2.2.3.3" } ], "prose": "Alerts are triaged and responded to within accepted risk timeframes defined by the organisation." } ] } ] } ] }, { "id": "IT.PRO-09.2", "title": "IT.PRO-09.2", "props": [ { "name": "sort-id", "value": "3.11.3" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" } ], "links": [ { "href": "#c7c4f0fd-45f9-58a1-8f0a-243542353021", "rel": "mitigated-technique", "text": "Mitigated technique: Phishing" }, { "href": "#bc8e7bf7-de00-5611-971b-03f8177737f5", "rel": "mitigated-technique", "text": "Mitigated technique: User Execution" }, { "href": "#f51dc9c1-1ce7-5584-bd1e-806c874d4643", "rel": "mitigated-technique", "text": "Mitigated technique: Exfiltration Over C2 Channel" }, { "href": "#9beb23c7-6abc-50ab-87b7-f905d080ed37", "rel": "mitigated-technique", "text": "Mitigated technique: Exfiltration Over Alternative Protocol" }, { "href": "#662f9ea9-efe4-5d65-aa67-0010a55a54a8", "rel": "mitigated-technique", "text": "Mitigated technique: Proxy" } ], "parts": [ { "id": "IT.PRO-09.2.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.11.3.1" }, { "name": "label", "value": "Action" } ], "prose": "Block outbound network connections to known malicious or untrusted destinations." }, { "id": "IT.PRO-09.2.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.11.3.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.11.3.2.1" } ], "parts": [ { "id": "IT.PRO-09.2.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.11.3.2.1.1" } ], "prose": "No controls are deployed to prevent systems from establishing outbound connections to known malicious or untrusted destinations." }, { "id": "IT.PRO-09.2.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.11.3.2.1.2" } ], "prose": "Blocking decisions are not informed by current threat intelligence." }, { "id": "IT.PRO-09.2.NE-3", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.11.3.2.1.3" } ], "prose": "Destination categorisation is not used." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.11.3.2.2" } ], "parts": [ { "id": "IT.PRO-09.2.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.11.3.2.2.1" } ], "prose": "Controls to prevent outbound connections being established are deployed but cover only a subset of in-scope systems or egress paths." }, { "id": "IT.PRO-09.2.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.11.3.2.2.2" } ], "prose": "Threat intelligence is used to inform block decisions for outbound connections, but updates are infrequent, manual or limited to a single source." }, { "id": "IT.PRO-09.2.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.11.3.2.2.3" } ], "prose": "Categorisation is in place, but the categories blocked do not reflect the organisation’s risk position." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.11.3.2.3" } ], "parts": [ { "id": "IT.PRO-09.2.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.11.3.2.3.1" } ], "prose": "Controls are deployed and applied across in-scope systems, egress paths, services, and network boundaries." }, { "id": "IT.PRO-09.2.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.11.3.2.3.2" } ], "prose": "Blocking decisions draw on current threat intelligence, with destination lists updated on a cycle defined by the organisation." }, { "id": "IT.PRO-09.2.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.11.3.2.3.3" } ], "prose": "Destination reputation, category and age are considered alongside threat intelligence, with category-based blocking aligned to the organisation’s risk position." } ] } ] } ] }, { "id": "IT.PRO-09.3", "title": "IT.PRO-09.3", "props": [ { "name": "sort-id", "value": "3.11.4" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" } ], "links": [ { "href": "#c7c4f0fd-45f9-58a1-8f0a-243542353021", "rel": "mitigated-technique", "text": "Mitigated technique: Phishing" }, { "href": "#ecd4f2ca-f615-539b-bf51-98fa38c69549", "rel": "mitigated-technique", "text": "Mitigated technique: Remote Services" }, { "href": "#3ac03f01-05e0-5771-abbe-c297d2f3384f", "rel": "mitigated-technique", "text": "Mitigated technique: Ingress Tool Transfer" } ], "parts": [ { "id": "IT.PRO-09.3.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.11.4.1" }, { "name": "label", "value": "Action" } ], "prose": "Inspect inbound content from external or untrusted sources to prevent delivery of malicious or unsafe content." }, { "id": "IT.PRO-09.3.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.11.4.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.11.4.2.1" } ], "parts": [ { "id": "IT.PRO-09.3.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.11.4.2.1.1" } ], "prose": "No inbound content inspection is deployed." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.11.4.2.2" } ], "parts": [ { "id": "IT.PRO-09.3.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.11.4.2.2.1" } ], "prose": "Inbound inspection is deployed but does not cover all applicable content channels." }, { "id": "IT.PRO-09.3.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.11.4.2.2.2" } ], "prose": "Inspection is in place but detection signatures or rules are not maintained or updated." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.11.4.2.3" } ], "parts": [ { "id": "IT.PRO-09.3.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.11.4.2.3.1" } ], "prose": "Inbound content inspection covers all applicable content channels." }, { "id": "IT.PRO-09.3.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.11.4.2.3.2" } ], "prose": "Detection signatures and rules are maintained and updated on a regular cycle defined by the organisation." }, { "id": "IT.PRO-09.3.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.11.4.2.3.3" } ], "prose": "Blocked content is logged and available for review." }, { "id": "IT.PRO-09.3.FE-4", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.11.4.2.3.4" } ], "prose": "Current cyber threat intelligence is considered when implementing controls to prevent the delivery of malicious or unsafe content." } ] } ] } ] } ] }, { "id": "PRO-14", "class": "essentials-principle", "title": "PRO-14 - Cyber security awareness training", "props": [ { "name": "sort-id", "value": "3.12" } ], "parts": [ { "id": "PRO-14.overview", "name": "overview", "props": [ { "name": "sort-id", "value": "3.12.1" }, { "name": "label", "value": "Principle" } ], "prose": "Personnel are provided with ongoing cyber security awareness training, including operational security considerations, tailored to their duties, access levels and current cyber threats." } ], "controls": [ { "id": "IT.PRO-14.1", "title": "IT.PRO-14.1", "props": [ { "name": "sort-id", "value": "3.12.2" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" } ], "links": [ { "href": "#c7c4f0fd-45f9-58a1-8f0a-243542353021", "rel": "mitigated-technique", "text": "Mitigated technique: Phishing" }, { "href": "#77ba96d0-f819-580a-9622-c823aba0d750", "rel": "mitigated-technique", "text": "Mitigated technique: Valid Accounts" } ], "parts": [ { "id": "IT.PRO-14.1.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.12.2.1" }, { "name": "label", "value": "Action" } ], "prose": "Ensure all personnel receive cyber security awareness training, that is tailored to how they will interact with systems, applications and data in their assigned roles, before being granted access to organisational systems and data." }, { "id": "IT.PRO-14.1.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.12.2.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.12.2.2.1" } ], "parts": [ { "id": "IT.PRO-14.1.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.12.2.2.1.1" } ], "prose": "No requirement exists for personnel to complete cyber security awareness training before being granted access to critical, privileged or business systems." }, { "id": "IT.PRO-14.1.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.12.2.2.1.2" } ], "prose": "No training completion records are maintained." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.12.2.2.2" } ], "parts": [ { "id": "IT.PRO-14.1.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.12.2.2.2.1" } ], "prose": "A training program exists but is not tailored to the specific risks of the systems in-scope." }, { "id": "IT.PRO-14.1.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.12.2.2.2.2" } ], "prose": "A requirement to complete training before access is granted exists but is not consistently enforced." }, { "id": "IT.PRO-14.1.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.12.2.2.2.3" } ], "prose": "Completion records are maintained but show significant gaps in coverage." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.12.2.2.3" } ], "parts": [ { "id": "IT.PRO-14.1.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.12.2.2.3.1" } ], "prose": "Role-tailored training programs address the specific risks, data handling obligations and incident reporting requirements relevant to in-scope systems." }, { "id": "IT.PRO-14.1.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.12.2.2.3.2" } ], "prose": "All personnel complete role-tailored training before being granted access to organisational systems and data, with refresher training mandated within a cycle defined by the organisation." }, { "id": "IT.PRO-14.1.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.12.2.2.3.3" } ], "prose": "Completion records are maintained and demonstrate full coverage." } ] } ] } ] } ] } ] }, { "id": "DET", "title": "Detect principles", "props": [ { "name": "sort-id", "value": "4" } ], "groups": [ { "id": "DET-01", "class": "essentials-principle", "title": "DET-01 - Centralised event logging", "props": [ { "name": "sort-id", "value": "4.1" } ], "parts": [ { "id": "DET-01.overview", "name": "overview", "props": [ { "name": "sort-id", "value": "4.1.1" }, { "name": "label", "value": "Principle" } ], "prose": "Security-relevant event logs and configuration changes for systems (infrastructure, operating systems, applications and data) are centrally collected, protected against unauthorised modification or deletion, and retained to support effective cyber security event detection and investigation." } ], "controls": [ { "id": "IT.DET-01.1", "title": "IT.DET-01.1", "props": [ { "name": "sort-id", "value": "4.1.2" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#46785cc3-484c-58a6-aae3-b25173f54a61", "rel": "mitigated-technique", "text": "Mitigated technique: Indicator Removal" }, { "href": "#7b9a147e-3ff0-575d-bd46-8175e912f663", "rel": "mitigated-technique", "text": "Mitigated technique: Disable or Modify Tools" } ], "parts": [ { "id": "IT.DET-01.1.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "4.1.2.1" }, { "name": "label", "value": "Action" } ], "prose": "Protect event logs from unauthorised access, modification or deletion, including by encrypting them during transit and at rest and securing the systems and accounts used to store, manage and analyse them." }, { "id": "IT.DET-01.1.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "4.1.2.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "4.1.2.2.1" } ], "parts": [ { "id": "IT.DET-01.1.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.2.2.1.1" } ], "prose": "Logs generated by applicable assets are not protected from modification or deletion." }, { "id": "IT.DET-01.1.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.2.2.1.2" } ], "prose": "Log access is not restricted to authorised roles with a business need." }, { "id": "IT.DET-01.1.NE-3", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.2.2.1.3" } ], "prose": "Logs are neither encrypted during transit nor at rest." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "4.1.2.2.2" } ], "parts": [ { "id": "IT.DET-01.1.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.2.2.2.1" } ], "prose": "Logs are forwarded but integrity protections are not in place at the source." }, { "id": "IT.DET-01.1.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.2.2.2.2" } ], "prose": "Log access is restricted but some roles retain the ability to modify or delete logs." }, { "id": "IT.DET-01.1.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.2.2.2.3" } ], "prose": "Logs are encrypted during transit but are not protected with encryption at rest (or vice versa)." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "4.1.2.2.3" } ], "parts": [ { "id": "IT.DET-01.1.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.2.2.3.1" } ], "prose": "Logs are protected against modification or deletion." }, { "id": "IT.DET-01.1.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.2.2.3.2" } ], "prose": "Logs are encrypted in transit and at rest." }, { "id": "IT.DET-01.1.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.2.2.3.3" } ], "prose": "Access to logs is restricted to authorised roles with a business need." } ] } ] } ] }, { "id": "IT.DET-01.2", "title": "IT.DET-01.2", "props": [ { "name": "sort-id", "value": "4.1.3" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#46785cc3-484c-58a6-aae3-b25173f54a61", "rel": "mitigated-technique", "text": "Mitigated technique: Indicator Removal" }, { "href": "#7b9a147e-3ff0-575d-bd46-8175e912f663", "rel": "mitigated-technique", "text": "Mitigated technique: Disable or Modify Tools" } ], "parts": [ { "id": "IT.DET-01.2.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "4.1.3.1" }, { "name": "label", "value": "Action" } ], "prose": "Forward high-value, security-relevant event logs and configuration changes from infrastructure, operating systems and applications to a central log storage capability." }, { "id": "IT.DET-01.2.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "4.1.3.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "4.1.3.2.1" } ], "parts": [ { "id": "IT.DET-01.2.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.3.2.1.1" } ], "prose": "Security-relevant logs from assets are not forwarded to a central logging capability." }, { "id": "IT.DET-01.2.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.3.2.1.2" } ], "prose": "High-value, security-relevant event logs or configuration changes from infrastructure, operating systems or applications are not forwarded." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "4.1.3.2.2" } ], "parts": [ { "id": "IT.DET-01.2.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.3.2.2.1" } ], "prose": "High-value, security-relevant event logs are forwarded, but coverage gaps are identified or completeness has not been validated." }, { "id": "IT.DET-01.2.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.3.2.2.2" } ], "prose": "Configuration change logs are forwarded inconsistently." }, { "id": "IT.DET-01.2.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.3.2.2.3" } ], "prose": "The utility of security log sources is reviewed, but on an ad hoc basis rather than according to a defined schedule." }, { "id": "IT.DET-01.2.PE-4", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.3.2.2.4" } ], "prose": "Log forwarding is in place but latency is excessive for effective detection." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "4.1.3.2.3" } ], "parts": [ { "id": "IT.DET-01.2.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.3.2.3.1" } ], "prose": "High-value security-relevant event logs and configuration changes from all relevant infrastructure, operating systems and application sources are forwarded to the central logging capability." }, { "id": "IT.DET-01.2.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.3.2.3.2" } ], "prose": "Security log sources are reviewed at regular intervals to ensure their continued utility in detecting and responding to changing adversary techniques." }, { "id": "IT.DET-01.2.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.3.2.3.3" } ], "prose": "Log completeness has been validated against the expected log sources." }, { "id": "IT.DET-01.2.FE-4", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.3.2.3.4" } ], "prose": "Logs are forwarded at a frequency that enables timely detection." } ] } ] } ] } ] }, { "id": "DET-04", "class": "essentials-principle", "title": "DET-04 - Baseline high-risk access activities", "props": [ { "name": "sort-id", "value": "4.2" } ], "parts": [ { "id": "DET-04.overview", "name": "overview", "props": [ { "name": "sort-id", "value": "4.2.1" }, { "name": "label", "value": "Principle" } ], "prose": "Baseline patterns of identity and credential access activities, privileged access activities, and remote access activities are established and maintained for systems (infrastructure, operating systems, applications and data) to enable the detection of anomalous or unexpected behaviour." } ], "controls": [ { "id": "IT.DET-04.1", "title": "IT.DET-04.1", "props": [ { "name": "sort-id", "value": "4.2.2" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" } ], "links": [ { "href": "#77ba96d0-f819-580a-9622-c823aba0d750", "rel": "mitigated-technique", "text": "Mitigated technique: Valid Accounts" }, { "href": "#49f81937-6239-545c-9a71-294e320e4648", "rel": "mitigated-technique", "text": "Mitigated technique: System Binary Proxy Execution" }, { "href": "#f7271268-a1b0-5db7-8e73-63a5b2c328ff", "rel": "mitigated-technique", "text": "Mitigated technique: Command and Scripting Interpreter" } ], "parts": [ { "id": "IT.DET-04.1.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "4.2.2.1" }, { "name": "label", "value": "Action" } ], "prose": "Continuously monitor and analyse software execution behaviour on systems to detect where legitimate tools and utilities are being used for malicious purposes." }, { "id": "IT.DET-04.1.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "4.2.2.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "4.2.2.2.1" } ], "parts": [ { "id": "IT.DET-04.1.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.2.2.2.1.1" } ], "prose": "No monitoring or equivalent analysis is used to identify anomalous or unexpected use of legitimate tools and utilities on applicable systems." }, { "id": "IT.DET-04.1.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.2.2.2.1.2" } ], "prose": "Existing controls do not provide a reasonable capability to detect security-relevant patterns of legitimate software being used for malicious purposes." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "4.2.2.2.2" } ], "parts": [ { "id": "IT.DET-04.1.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.2.2.2.2.1" } ], "prose": "Monitoring or equivalent analysis covers some priority tools, execution behaviours or applicable systems, but risk-significant coverage gaps exist." }, { "id": "IT.DET-04.1.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.2.2.2.2.2" } ], "prose": "Security-relevant execution telemetry is collected, but detection rules, behavioural analytics or equivalent analysis are incomplete or not consistently operational." }, { "id": "IT.DET-04.1.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.2.2.2.2.3" } ], "prose": "Alerts relating to anomalous or unexpected software execution are generated, but they are not consistently triaged and investigated within organisationally defined timeframes." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "4.2.2.2.3" } ], "parts": [ { "id": "IT.DET-04.1.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.2.2.2.3.1" } ], "prose": "The organisation identifies the legitimate tools, utilities and execution behaviours that present heightened risk of malicious use within applicable systems." }, { "id": "IT.DET-04.1.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.2.2.2.3.2" } ], "prose": "Security-relevant telemetry and contextual information are analysed using detection rules, behavioural analytics or equivalent methods to identify anomalous or unexpected use of priority tools and utilities." }, { "id": "IT.DET-04.1.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.2.2.2.3.3" } ], "prose": "Detection coverage is periodically reviewed and adjusted in response to changes in applicable systems, threat intelligence, observed activity and the organisation’s risk profile." }, { "id": "IT.DET-04.1.FE-4", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.2.2.2.3.4" } ], "prose": "Alerts are prioritised, triaged and investigated within timeframes defined according to their assessed security risk." } ] } ] } ] } ] }, { "id": "DET-02", "class": "essentials-principle", "title": "DET-02 - Cyber security event detection", "props": [ { "name": "sort-id", "value": "4.3" } ], "parts": [ { "id": "DET-02.overview", "name": "overview", "props": [ { "name": "sort-id", "value": "4.3.1" }, { "name": "label", "value": "Principle" } ], "prose": "Anomalous or unexpected events and behaviours for systems (infrastructure, operating systems, applications and data) are analysed in a timely manner to detect cyber security events." } ], "controls": [ { "id": "IT.DET-02.1", "title": "IT.DET-02.1", "props": [ { "name": "sort-id", "value": "4.3.2" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "parts": [ { "id": "IT.DET-02.1.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "4.3.2.1" }, { "name": "label", "value": "Action" } ], "prose": "Ensure event logs are normalised, time-synchronised and enriched to support correlation across systems and environments." }, { "id": "IT.DET-02.1.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "4.3.2.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "4.3.2.2.1" } ], "parts": [ { "id": "IT.DET-02.1.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.3.2.2.1.1" } ], "prose": "Logs are not time-synchronised to an authoritative source." }, { "id": "IT.DET-02.1.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.3.2.2.1.2" } ], "prose": "Logs are ingested in raw format and are neither normalised nor enriched." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "4.3.2.2.2" } ], "parts": [ { "id": "IT.DET-02.1.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.3.2.2.2.1" } ], "prose": "Logs are time-synchronised but are not normalised to a common schema." }, { "id": "IT.DET-02.1.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.3.2.2.2.2" } ], "prose": "Some enrichment is applied but critical contextual data such as asset classification or account type is missing." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "4.3.2.2.3" } ], "parts": [ { "id": "IT.DET-02.1.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.3.2.2.3.1" } ], "prose": "Logs are time-synchronised to the authoritative time source." }, { "id": "IT.DET-02.1.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.3.2.2.3.2" } ], "prose": "Logs are normalised into the common log schema and enriched with contextual metadata." }, { "id": "IT.DET-02.1.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.3.2.2.3.3" } ], "prose": "Enriched logs support correlation across relevant systems, environments and data sources in the central logging platform." } ] } ] } ] } ] } ] } ], "back-matter": { "resources": [ { "uuid": "0c6c92ee-dc6c-571a-84d7-6c89841f9847", "title": "Supply Chain Compromise", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1195/" } ] }, { "uuid": "8506766a-663b-5c06-97d6-d810ca1c1efa", "title": "Exploit Public-Facing Application", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1190/" } ] }, { "uuid": "77ba96d0-f819-580a-9622-c823aba0d750", "title": "Valid Accounts", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1078/" } ] }, { "uuid": "ecd4f2ca-f615-539b-bf51-98fa38c69549", "title": "Remote Services", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1021/" } ] }, { "uuid": "c73e777a-81e0-53e1-a470-3a6df2f16c9e", "title": "Exploitation for Privilege Escalation", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1068/" } ] }, { "uuid": "c525290c-5eea-5f39-a2fb-c2040a6e5fdb", "title": "Server Software Component", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1505/" } ] }, { "uuid": "f26268e4-32a9-5f2a-9f87-7a7fad7f68fc", "title": "Brute Force", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1110/" } ] }, { "uuid": "57fa3c84-e383-5a76-a1ac-8db584b1b7cb", "title": "Unsecured Credentials", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1552/" } ] }, { "uuid": "3dc7231b-760b-500f-8b46-e260fa7af940", "title": "Credentials from Password Stores", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1555/" } ] }, { "uuid": "5e12fa47-c2dd-5834-8f8e-aba05566851e", "title": "Account Manipulation", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1098/" } ] }, { "uuid": "adaac7e5-a0e4-56f2-ab2a-62040e289c93", "title": "Multi-Factor Authentication Request Generation", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1621/" } ] }, { "uuid": "e639c32d-d0bb-52cb-a8db-7f59a9ca3a5e", "title": "Adversary-in-the-Middle", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1557/" } ] }, { "uuid": "273a9201-4c54-5007-8c36-9c645b3caac0", "title": "Create Account", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1136/" } ] }, { "uuid": "673978f9-01a4-5122-b90f-cf2cbd9ce239", "title": "OS Credential Dumping", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1003/" } ] }, { "uuid": "21ed2a3d-b86f-584e-b811-bb9ab6a90be4", "title": "Use Alternate Authentication Material", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1550/" } ] }, { "uuid": "54a1fec4-ca8d-56ee-a1b0-5e06e29d844b", "title": "Steal or Forge Kerberos Tickets", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1558/" } ] }, { "uuid": "7b9a147e-3ff0-575d-bd46-8175e912f663", "title": "Disable or Modify Tools", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1685/" } ] }, { "uuid": "d8919c75-5d9c-55c2-a60c-bd8be81e044a", "title": "Modify Registry", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1112/" } ] }, { "uuid": "c6a132f7-7135-56d6-964b-df4430105d5b", "title": "Create or Modify System Process", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1543/" } ] }, { "uuid": "c63496b4-4278-579d-9285-096cb1827bff", "title": "Windows Management Instrumentation", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1047/" } ] }, { "uuid": "6c7783e0-7afa-53d9-a1d1-14609e950bb8", "title": "Network Service Discovery", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1046/" } ] }, { "uuid": "7c507df2-5896-514c-96a0-e5a3d03e185c", "title": "External Remote Services", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1133/" } ] }, { "uuid": "bc8e7bf7-de00-5611-971b-03f8177737f5", "title": "User Execution", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1204/" } ] }, { "uuid": "f7271268-a1b0-5db7-8e73-63a5b2c328ff", "title": "Command and Scripting Interpreter", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1059/" } ] }, { "uuid": "c8a8aa25-4f5d-5499-ace7-6c4f319dc2d2", "title": "Exploitation of Remote Services", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1210/" } ] }, { "uuid": "1efe1353-9697-5390-88a4-c28d87de2074", "title": "Exploitation for Client Execution", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1203/" } ] }, { "uuid": "3cdb8a7b-7078-504c-b939-b63f740335c9", "title": "Process Injection", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1055/" } ] }, { "uuid": "49f81937-6239-545c-9a71-294e320e4648", "title": "System Binary Proxy Execution", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1218/" } ] }, { "uuid": "b2a1e1f4-45e5-53cc-9ab8-a7a506d574aa", "title": "Data Encrypted for Impact", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1486/" } ] }, { "uuid": "3997970a-d2c2-5d3f-9dcc-8beed16e06a6", "title": "Inhibit System Recovery", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1490/" } ] }, { "uuid": "7b503e3a-a051-5a53-840d-4cef38895687", "title": "Data from Local System", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1005/" } ] }, { "uuid": "ed204c2e-7780-55e0-aac2-a2d59bf66243", "title": "Lateral Tool Transfer", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1570/" } ] }, { "uuid": "f51dc9c1-1ce7-5584-bd1e-806c874d4643", "title": "Exfiltration Over C2 Channel", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1041/" } ] }, { "uuid": "9beb23c7-6abc-50ab-87b7-f905d080ed37", "title": "Exfiltration Over Alternative Protocol", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1048/" } ] }, { "uuid": "662f9ea9-efe4-5d65-aa67-0010a55a54a8", "title": "Proxy", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1090/" } ] }, { "uuid": "c7c4f0fd-45f9-58a1-8f0a-243542353021", "title": "Phishing", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1566/" } ] }, { "uuid": "3ac03f01-05e0-5771-abbe-c297d2f3384f", "title": "Ingress Tool Transfer", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1105/" } ] }, { "uuid": "46785cc3-484c-58a6-aae3-b25173f54a61", "title": "Indicator Removal", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1070/" } ] }, { "uuid": "1e75ca1e-24c7-5a0a-a27b-088768d2a2d5", "title": "Assessment evidence guide for enterprise IT - Critical processes and services OSCAL Resolved Catalog v2026.10.15", "props": [ { "name": "published", "value": "2026-10-15T00:30:23Z" }, { "name": "version", "value": "v2026.10.15" } ], "rlinks": [ { "href": "https://www.cyber.gov.au/e4eit/oscal/v2026.10.15/artifacts/E4EIT_critical-processes-and-services-domain_resolved-catalog.xml", "media-type": "application/xml" }, { "href": "https://www.cyber.gov.au/e4eit/oscal/v2026.10.15/artifacts/E4EIT_critical-processes-and-services-domain_resolved-catalog.json", "media-type": "application/json" }, { "href": "https://www.cyber.gov.au/e4eit/oscal/v2026.10.15/artifacts/E4EIT_critical-processes-and-services-domain_resolved-catalog.yaml", "media-type": "application/oscal+yaml" } ] }, { "uuid": "cb13e6fc-647d-5c9d-81d1-c8c490595922", "title": "Assessment evidence guide for enterprise IT - Critical processes and services OSCAL Profile v2026.10.15", "props": [ { "name": "published", "value": "2026-10-15T00:30:23Z" }, { "name": "version", "value": "v2026.10.15" } ], "rlinks": [ { "href": "https://www.cyber.gov.au/e4eit/oscal/v2026.10.15/artifacts/E4EIT_critical-processes-and-services-domain_profile.xml", "media-type": "application/xml" }, { "href": "https://www.cyber.gov.au/e4eit/oscal/v2026.10.15/artifacts/E4EIT_critical-processes-and-services-domain_profile.json", "media-type": "application/json" }, { "href": "https://www.cyber.gov.au/e4eit/oscal/v2026.10.15/artifacts/E4EIT_critical-processes-and-services-domain_profile.yaml", "media-type": "application/oscal+yaml" } ] }, { "uuid": "20c472de-94f3-5364-88c7-f20f7b41bccd", "title": "Assessment evidence guide for enterprise IT - Critical processes and services OSCAL Resolved Catalog - latest version", "rlinks": [ { "href": "https://www.cyber.gov.au/e4eit/oscal/latest-version/artifacts/E4EIT_critical-processes-and-services-domain_resolved-catalog.xml", "media-type": "application/xml" }, { "href": "https://www.cyber.gov.au/e4eit/oscal/latest-version/artifacts/E4EIT_critical-processes-and-services-domain_resolved-catalog.json", "media-type": "application/json" }, { "href": "https://www.cyber.gov.au/e4eit/oscal/latest-version/artifacts/E4EIT_critical-processes-and-services-domain_resolved-catalog.yaml", "media-type": "application/oscal+yaml" } ] }, { "uuid": "6938000d-2c69-5a06-baf1-eda3e1059b77", "title": "Assessment evidence guide for enterprise IT - Critical processes and services OSCAL Resolved Catalog v2026.10.15 - predecessor version", "rlinks": [ { "href": "https://www.cyber.gov.au/e4eit/oscal/v2026.10.15/predecessor-version/artifacts/E4EIT_critical-processes-and-services-domain_resolved-catalog.xml", "media-type": "application/xml" }, { "href": "https://www.cyber.gov.au/e4eit/oscal/v2026.10.15/predecessor-version/artifacts/E4EIT_critical-processes-and-services-domain_resolved-catalog.json", "media-type": "application/json" }, { "href": "https://www.cyber.gov.au/e4eit/oscal/v2026.10.15/predecessor-version/artifacts/E4EIT_critical-processes-and-services-domain_resolved-catalog.yaml", "media-type": "application/oscal+yaml" } ] }, { "uuid": "f70506c3-e6da-56e5-b0d6-db7aa4832d7c", "title": "Assessment evidence guide for enterprise IT - Critical processes and services OSCAL Resolved Catalog v2026.10.15 - successor version", "rlinks": [ { "href": "https://www.cyber.gov.au/e4eit/oscal/v2026.10.15/successor-version/artifacts/E4EIT_critical-processes-and-services-domain_resolved-catalog.xml", "media-type": "application/xml" }, { "href": "https://www.cyber.gov.au/e4eit/oscal/v2026.10.15/successor-version/artifacts/E4EIT_critical-processes-and-services-domain_resolved-catalog.json", "media-type": "application/json" }, { "href": "https://www.cyber.gov.au/e4eit/oscal/v2026.10.15/successor-version/artifacts/E4EIT_critical-processes-and-services-domain_resolved-catalog.yaml", "media-type": "application/oscal+yaml" } ] }, { "uuid": "749a4f98-ab3d-5c34-a269-635125a18aab", "title": "Assessment evidence guide for enterprise IT", "props": [ { "name": "published", "value": "2026-10-15T00:00:00+11:00" }, { "name": "version", "value": "2026-10-15" } ], "rlinks": [ { "href": "https://www.cyber.gov.au/e4eit/pdf/v2026.10.15-pdf", "media-type": "application/pdf" } ] }, { "uuid": "c1350084-c4c2-5447-affd-185f1ef2f6c2", "title": "Essentials OSCAL NS 1.0", "rlinks": [ { "href": "https://www.cyber.gov.au/ns/essentials/oscal/1.0" } ] } ] } } }