{ "catalog": { "uuid": "f8da0eda-50f0-57df-bfb9-46c05f57f77f", "metadata": { "title": "Assessment evidence guide for enterprise IT - User devices OSCAL Resolved Catalog", "published": "2026-10-15T00:30:23Z", "last-modified": "2026-10-15T00:30:23Z", "version": "2026.10.15", "oscal-version": "1.2.3", "props": [ { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" }, { "name": "domain-description", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "Endpoints issued to the workforce, including desktops and laptops." }, { "name": "domain-priority-phase", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "phase-3" }, { "name": "resolution-tool", "value": "OSCAL Profile Resolver XSLT Pipeline OPRXP" } ], "links": [ { "href": "#c7d20c73-e9a9-5cfc-9f0a-3e2fa7317d70", "rel": "source-profile" }, { "href": "#16a937ca-e469-5f97-981b-d503a1b37e1e", "rel": "canonical" }, { "href": "#f2f325ed-16e8-5d6c-a4b9-fbb0836fc58d", "rel": "latest-version" }, { "href": "#9ea9ed05-3363-5856-86b1-be1c3bfec7b1", "rel": "predecessor-version" }, { "href": "#daf46df7-8de2-5cd6-af11-713e910c03fe", "rel": "successor-version" }, { "href": "#114809ce-ec9a-5213-8906-a6960ae16000", "rel": "alternate" } ], "roles": [ { "id": "prepared-by", "title": "Document creator" } ], "parties": [ { "uuid": "3d43ac72-2335-57ef-807a-e15ffad56df1", "type": "organization", "name": "Australian Cyber Security Centre", "short-name": "ACSC", "links": [ { "href": "https://www.cyber.gov.au", "rel": "website" } ], "email-addresses": [ "asd.assist@defence.gov.au" ], "addresses": [ { "type": "work", "addr-lines": [ "Australian Cyber Security Centre", "General enquiries", "PO Box 5076" ], "city": "Kingston", "state": "ACT", "postal-code": "2604", "country": "AU" } ] } ], "responsible-parties": [ { "role-id": "prepared-by", "party-uuids": [ "3d43ac72-2335-57ef-807a-e15ffad56df1" ] } ], "remarks": "Consumers of this file should refer to the [Essentials OSCAL NS 1.0](#2fa82717-6d7f-568b-ba02-e88af7e42323) page for information regarding the Essentials specific representation used in this OSCAL file." }, "groups": [ { "id": "IDE", "title": "Identify principles", "props": [ { "name": "sort-id", "value": "2" } ], "groups": [ { "id": "IDE-01", "class": "essentials-principle", "title": "IDE-01 - Asset identification", "props": [ { "name": "sort-id", "value": "2.1" } ], "parts": [ { "id": "IDE-01.overview", "name": "overview", "props": [ { "name": "sort-id", "value": "2.1.1" }, { "name": "label", "value": "Principle" } ], "prose": "Systems (infrastructure, operating systems, applications, identities, credentials and data) are continually and centrally identified and documented." } ], "controls": [ { "id": "IT.IDE-01.2", "title": "IT.IDE-01.2", "props": [ { "name": "sort-id", "value": "2.1.3" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "parts": [ { "id": "IT.IDE-01.2.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "2.1.3.1" }, { "name": "label", "value": "Action" } ], "prose": "Maintain current records of infrastructure, operating systems, applications, identities, credentials and data assets." }, { "id": "IT.IDE-01.2.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "2.1.3.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "2.1.3.2.1" } ], "parts": [ { "id": "IT.IDE-01.2.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "2.1.3.2.1.1" } ], "prose": "A maintained record of infrastructure, operating systems, applications, identities, credentials and data assets has not been established." }, { "id": "IT.IDE-01.2.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "2.1.3.2.1.2" } ], "prose": "There is no defined process for identifying, recording, reviewing and updating asset records." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "2.1.3.2.2" } ], "parts": [ { "id": "IT.IDE-01.2.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "2.1.3.2.2.1" } ], "prose": "Asset records are maintained, but identified omissions, inaccuracies or newly discovered assets are not triaged and addressed within the timeframes or tolerances defined by the organisation." }, { "id": "IT.IDE-01.2.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "2.1.3.2.2.2" } ], "prose": "A process to update the asset inventory runs on a schedule but the results are not reconciled or updated within a period defined by the organisation." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "2.1.3.2.3" } ], "parts": [ { "id": "IT.IDE-01.2.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "2.1.3.2.3.1" } ], "prose": "At each scheduled review or update, records of infrastructure, operating systems, applications, identities, credentials and data assets are complete and accurate within the tolerances defined by the organisation." }, { "id": "IT.IDE-01.2.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "2.1.3.2.3.2" } ], "prose": "A defined process identifies changes and newly discovered assets between scheduled reviews, and ensures that records are reviewed, reconciled and updated within timeframes commensurate with the associated cyber security risk." } ] } ] } ] } ] } ] }, { "id": "PRO", "title": "Protect principles", "props": [ { "name": "sort-id", "value": "3" } ], "groups": [ { "id": "PRO-01", "class": "essentials-principle", "title": "PRO-01 - Secure system lifecycle", "props": [ { "name": "sort-id", "value": "3.01" } ], "parts": [ { "id": "PRO-01.overview", "name": "overview", "props": [ { "name": "sort-id", "value": "3.01.1" }, { "name": "label", "value": "Principle" } ], "prose": "Systems (infrastructure, operating systems and applications) are planned, designed, developed, tested, deployed, maintained and decommissioned according to their business criticality ratings and security and resilience requirements using Secure by Design and Secure by Default principles and practices." } ], "controls": [ { "id": "IT.PRO-01.1", "title": "IT.PRO-01.1", "props": [ { "name": "sort-id", "value": "3.01.2" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#8506766a-663b-5c06-97d6-d810ca1c1efa", "rel": "mitigated-technique", "text": "Mitigated technique: Exploit Public-Facing Application" }, { "href": "#77ba96d0-f819-580a-9622-c823aba0d750", "rel": "mitigated-technique", "text": "Mitigated technique: Valid Accounts" }, { "href": "#ecd4f2ca-f615-539b-bf51-98fa38c69549", "rel": "mitigated-technique", "text": "Mitigated technique: Remote Services" }, { "href": "#c73e777a-81e0-53e1-a470-3a6df2f16c9e", "rel": "mitigated-technique", "text": "Mitigated technique: Exploitation for Privilege Escalation" } ], "parts": [ { "id": "IT.PRO-01.1.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.01.2.1" }, { "name": "label", "value": "Action" } ], "prose": "Design systems securely to provide visibility, enforce authorised access, protect data, minimise required and default privileges, limit exposed services and remove unnecessary functionality." }, { "id": "IT.PRO-01.1.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.01.2.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.01.2.2.1" } ], "parts": [ { "id": "IT.PRO-01.1.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.2.2.1.1" } ], "prose": "Systems are deployed with default configurations and no evidence of security design considerations." }, { "id": "IT.PRO-01.1.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.2.2.1.2" } ], "prose": "Unnecessary services, protocols or functionality remain enabled with no documented rationale." }, { "id": "IT.PRO-01.1.NE-3", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.2.2.1.3" } ], "prose": "Security telemetry is not enabled or is not considered as part of system design." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.01.2.2.2" } ], "parts": [ { "id": "IT.PRO-01.1.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.2.2.2.1" } ], "prose": "Security is considered during system design but not consistently applied across all assets." }, { "id": "IT.PRO-01.1.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.2.2.2.2" } ], "prose": "Some unnecessary services have been disabled but a systematic review has not been completed." }, { "id": "IT.PRO-01.1.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.2.2.2.3" } ], "prose": "Security telemetry is partially enabled but gaps in coverage exist." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.01.2.2.3" } ], "parts": [ { "id": "IT.PRO-01.1.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.2.2.3.1" } ], "prose": "Systems are designed and deployed with exposed services limited, required and default permissions minimised, data protections in place, authorised access enforced, and only required functionality enabled." }, { "id": "IT.PRO-01.1.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.2.2.3.2" } ], "prose": "Security telemetry is enabled by default." }, { "id": "IT.PRO-01.1.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.2.2.3.3" } ], "prose": "Evidence exists that security design decisions are recorded and reviewed during system changes." } ] } ] } ] }, { "id": "IT.PRO-01.2", "title": "IT.PRO-01.2", "props": [ { "name": "sort-id", "value": "3.01.3" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "parts": [ { "id": "IT.PRO-01.2.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.01.3.1" }, { "name": "label", "value": "Action" } ], "prose": "Secure build and deployment processes to enforce controls consistently across systems." }, { "id": "IT.PRO-01.2.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.01.3.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.01.3.2.1" } ], "parts": [ { "id": "IT.PRO-01.2.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.3.2.1.1" } ], "prose": "No controlled build or deployment process exists for applicable assets." }, { "id": "IT.PRO-01.2.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.3.2.1.2" } ], "prose": "Changes to systems are applied ad hoc, without any version control, testing or approval." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.01.3.2.2" } ], "parts": [ { "id": "IT.PRO-01.2.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.3.2.2.1" } ], "prose": "A controlled deployment process exists but is not consistently followed for all changes." }, { "id": "IT.PRO-01.2.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.3.2.2.2" } ], "prose": "Version control is in place but pre-deployment security verification is not performed." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.01.3.2.3" } ], "parts": [ { "id": "IT.PRO-01.2.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.3.2.3.1" } ], "prose": "A controlled build and deployment process is in place and consistently followed." }, { "id": "IT.PRO-01.2.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.3.2.3.2" } ], "prose": "Configuration changes are subject to version control, testing and approval before deployment." }, { "id": "IT.PRO-01.2.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.01.3.2.3.3" } ], "prose": "Security controls are confirmed to be implemented consistently across systems following deployment processes." } ] } ] } ] } ] }, { "id": "PRO-16", "class": "essentials-principle", "title": "PRO-16 - Cyber supply chain security", "props": [ { "name": "sort-id", "value": "3.02" } ], "parts": [ { "id": "PRO-16.overview", "name": "overview", "props": [ { "name": "sort-id", "value": "3.02.1" }, { "name": "label", "value": "Principle" } ], "prose": "Cyber supply chains supporting systems (infrastructure, operating systems, applications and data) are secure, resilient and support effective and coordinated cyber security incident response." } ], "controls": [ { "id": "IT.PRO-16.1", "title": "IT.PRO-16.1", "props": [ { "name": "sort-id", "value": "3.02.2" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#0c6c92ee-dc6c-571a-84d7-6c89841f9847", "rel": "mitigated-technique", "text": "Mitigated technique: Supply Chain Compromise" }, { "href": "#c525290c-5eea-5f39-a2fb-c2040a6e5fdb", "rel": "mitigated-technique", "text": "Mitigated technique: Server Software Component" } ], "parts": [ { "id": "IT.PRO-16.1.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.02.2.1" }, { "name": "label", "value": "Action" } ], "prose": "Assess the integrity and authenticity of software, components and updates before use, and verify provenance where suitable supplier evidence is available." }, { "id": "IT.PRO-16.1.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.02.2.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.02.2.2.1" } ], "parts": [ { "id": "IT.PRO-16.1.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.2.2.1.1" } ], "prose": "No verification of software, component or update integrity or authenticity is performed before introduction into systems." }, { "id": "IT.PRO-16.1.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.2.2.1.2" } ], "prose": "Verification outcomes are not recorded or available for review." }, { "id": "IT.PRO-16.1.NE-3", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.2.2.1.3" } ], "prose": "Where verification cannot be performed, no compensating control or remediation paths are documented." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.02.2.2.2" } ], "parts": [ { "id": "IT.PRO-16.1.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.2.2.2.1" } ], "prose": "Verification is performed for some categories of software but not consistently across operating systems, applications, firmware and dependencies." }, { "id": "IT.PRO-16.1.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.2.2.2.2" } ], "prose": "Integrity or provenance checks are performed, but they do not provide sufficient assurance for all software, components or updates." }, { "id": "IT.PRO-16.1.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.2.2.2.3" } ], "prose": "Verification outcomes are recorded for some software, components or updates prior to being introduced into systems, but not consistently." }, { "id": "IT.PRO-16.1.PE-4", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.2.2.2.4" } ], "prose": "Compensating controls exist for some unverifiable components but are not formally approved or time-bound." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.02.2.2.3" } ], "parts": [ { "id": "IT.PRO-16.1.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.2.2.3.1" } ], "prose": "Verification of integrity and provenance is performed for software, components and updates across all relevant categories, and provenance is verified where suitable supplier evidence is available." }, { "id": "IT.PRO-16.1.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.2.2.3.2" } ], "prose": "Verification uses one or more mechanisms appropriate to the software, component, update and source to provide reliable assurance of integrity and provenance." }, { "id": "IT.PRO-16.1.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.2.2.3.3" } ], "prose": "Verification outcomes are recorded and available for review." }, { "id": "IT.PRO-16.1.FE-4", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.02.2.2.3.4" } ], "prose": "Where verification cannot be performed, compensating controls are applied, exceptions are time-bound and remediation paths are documented." } ] } ] } ] } ] }, { "id": "PRO-13", "class": "essentials-principle", "title": "PRO-13 - Identity, credential and access management", "props": [ { "name": "sort-id", "value": "3.03" } ], "parts": [ { "id": "PRO-13.overview", "name": "overview", "props": [ { "name": "sort-id", "value": "3.03.1" }, { "name": "label", "value": "Principle" } ], "prose": "Robust and secure identity, credential and access management is used to establish, maintain and control access to systems (infrastructure, operating systems, applications and data) and to support effective detection of identity and credential misuse." } ], "controls": [ { "id": "IT.PRO-13.1", "title": "IT.PRO-13.1", "props": [ { "name": "sort-id", "value": "3.03.2" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#77ba96d0-f819-580a-9622-c823aba0d750", "rel": "mitigated-technique", "text": "Mitigated technique: Valid Accounts" }, { "href": "#f26268e4-32a9-5f2a-9f87-7a7fad7f68fc", "rel": "mitigated-technique", "text": "Mitigated technique: Brute Force" } ], "parts": [ { "id": "IT.PRO-13.1.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.03.2.1" }, { "name": "label", "value": "Action" } ], "prose": "Identify and disable or remove default and unused accounts regularly, permitting exceptions only where the account is documented, justified, hardened and monitored." }, { "id": "IT.PRO-13.1.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.03.2.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.03.2.2.1" } ], "parts": [ { "id": "IT.PRO-13.1.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.2.2.1.1" } ], "prose": "No review of default or unused accounts has been conducted within the review period defined by the organisation." }, { "id": "IT.PRO-13.1.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.2.2.1.2" } ], "prose": "Default vendor accounts remain enabled on production systems without appropriate documentation, justification, hardening and monitoring in place for their use." }, { "id": "IT.PRO-13.1.NE-3", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.2.2.1.3" } ], "prose": "No process exists to identify accounts that have not authenticated within a defined period." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.03.2.2.2" } ], "parts": [ { "id": "IT.PRO-13.1.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.2.2.2.1" } ], "prose": "A review has been conducted but does not cover all assets." }, { "id": "IT.PRO-13.1.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.2.2.2.2" } ], "prose": "Default accounts have been identified but some remain enabled without documented justification." }, { "id": "IT.PRO-13.1.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.2.2.2.3" } ], "prose": "Unused accounts are identified but remediation is incomplete or delayed beyond defined timeframes." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.03.2.2.3" } ], "parts": [ { "id": "IT.PRO-13.1.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.2.2.3.1" } ], "prose": "A review of accounts has been completed within the defined review period covering all assets." }, { "id": "IT.PRO-13.1.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.2.2.3.2" } ], "prose": "Default accounts are disabled or have approved justification for remaining active, with appropriate monitoring and compensating controls for their use in place." }, { "id": "IT.PRO-13.1.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.2.2.3.3" } ], "prose": "Accounts that show no evidence of use, other than approved emergency access accounts, are identified and either disabled or removed in accordance with defined timeframes." } ] } ] } ] }, { "id": "IT.PRO-13.4", "title": "IT.PRO-13.4", "props": [ { "name": "sort-id", "value": "3.03.5" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#77ba96d0-f819-580a-9622-c823aba0d750", "rel": "mitigated-technique", "text": "Mitigated technique: Valid Accounts" }, { "href": "#5e12fa47-c2dd-5834-8f8e-aba05566851e", "rel": "mitigated-technique", "text": "Mitigated technique: Account Manipulation" }, { "href": "#f26268e4-32a9-5f2a-9f87-7a7fad7f68fc", "rel": "mitigated-technique", "text": "Mitigated technique: Brute Force" }, { "href": "#ecd4f2ca-f615-539b-bf51-98fa38c69549", "rel": "mitigated-technique", "text": "Mitigated technique: Remote Services" }, { "href": "#adaac7e5-a0e4-56f2-ab2a-62040e289c93", "rel": "mitigated-technique", "text": "Mitigated technique: Multi-Factor Authentication Request Generation" }, { "href": "#e639c32d-d0bb-52cb-a8db-7f59a9ca3a5e", "rel": "mitigated-technique", "text": "Mitigated technique: Adversary-in-the-Middle" } ], "parts": [ { "id": "IT.PRO-13.4.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.03.5.1" }, { "name": "label", "value": "Action" } ], "prose": "Use phishing-resistant MFA for users authenticating to systems, including from untrusted, external or high-risk locations." }, { "id": "IT.PRO-13.4.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.03.5.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.03.5.2.1" } ], "parts": [ { "id": "IT.PRO-13.4.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.5.2.1.1" } ], "prose": "Phishing-resistant MFA is not enforced for interactive user authentication to systems." }, { "id": "IT.PRO-13.4.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.5.2.1.2" } ], "prose": "MFA is deployed but uses non-phishing-resistant methods, such as SMS, voice, or push-only authentication instead of phishing-resistant MFA." }, { "id": "IT.PRO-13.4.NE-3", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.5.2.1.3" } ], "prose": "No access policies differentiate between trusted and untrusted, external or high-risk locations." }, { "id": "IT.PRO-13.4.NE-4", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.5.2.1.4" } ], "prose": "Access from untrusted, external or high-risk locations is permitted without MFA, or with non-phishing-resistant MFA." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.03.5.2.2" } ], "parts": [ { "id": "IT.PRO-13.4.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.5.2.2.1" } ], "prose": "Phishing-resistant MFA is deployed for some but not all systems within scope." }, { "id": "IT.PRO-13.4.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.5.2.2.2" } ], "prose": "Access policies exist but do not cover all organisationally defined high-risk location categories." }, { "id": "IT.PRO-13.4.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.5.2.2.3" } ], "prose": "Exceptions or alternative authentication pathways allow routine or recurring authentication without phishing-resistant MFA, or emergency access arrangements are not adequately restricted, monitored, tested or reviewed." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.03.5.2.3" } ], "parts": [ { "id": "IT.PRO-13.4.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.5.2.3.1" } ], "prose": "Phishing-resistant MFA is enforced for all routine interactive user authentication to systems within scope." }, { "id": "IT.PRO-13.4.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.5.2.3.2" } ], "prose": "Phishing-resistant MFA is enforced for routine authentication attempts from untrusted, external or high-risk locations." }, { "id": "IT.PRO-13.4.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.5.2.3.3" } ], "prose": "Customer-facing services provide a phishing-resistant MFA option for authentication." }, { "id": "IT.PRO-13.4.FE-4", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.5.2.3.4" } ], "prose": "Emergency access arrangements are periodically tested and reviewed to confirm that they remain operational, appropriately protected and limited to their intended purpose. Credentials or authentication factors used for emergency access are securely managed and are not used for routine administration." } ] } ] } ] }, { "id": "IT.PRO-13.5", "title": "IT.PRO-13.5", "props": [ { "name": "sort-id", "value": "3.03.6" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#f26268e4-32a9-5f2a-9f87-7a7fad7f68fc", "rel": "mitigated-technique", "text": "Mitigated technique: Brute Force" }, { "href": "#77ba96d0-f819-580a-9622-c823aba0d750", "rel": "mitigated-technique", "text": "Mitigated technique: Valid Accounts" }, { "href": "#e639c32d-d0bb-52cb-a8db-7f59a9ca3a5e", "rel": "mitigated-technique", "text": "Mitigated technique: Adversary-in-the-Middle" } ], "parts": [ { "id": "IT.PRO-13.5.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.03.6.1" }, { "name": "label", "value": "Action" } ], "prose": "Disable legacy authentication protocols or, where this is not feasible, restrict and monitor their use, apply compensating controls and establish a time-bound decommissioning plan." }, { "id": "IT.PRO-13.5.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.03.6.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.03.6.2.1" } ], "parts": [ { "id": "IT.PRO-13.5.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.6.2.1.1" } ], "prose": "Legacy authentication protocols that cannot enforce modern authentication controls remain enabled and in active use without restriction." }, { "id": "IT.PRO-13.5.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.6.2.1.2" } ], "prose": "No assessment has been conducted to identify which legacy authentication protocols are in use within the environment." }, { "id": "IT.PRO-13.5.NE-3", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.6.2.1.3" } ], "prose": "Authentication mechanisms transmitting credentials in cleartext or using weak cryptographic primitives remain enabled and no action has been taken to disable them." }, { "id": "IT.PRO-13.5.NE-4", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.6.2.1.4" } ], "prose": "Where legacy protocols are retained, no compensating controls, no monitoring and no decommissioning timelines are in place." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.03.6.2.2" } ], "parts": [ { "id": "IT.PRO-13.5.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.6.2.2.1" } ], "prose": "Legacy authentication protocols have been identified and are partially restricted but some remain enabled across systems within scope without justification." }, { "id": "IT.PRO-13.5.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.6.2.2.2" } ], "prose": "An assessment has been conducted but does not cover all in-scope systems, or the inventory of legacy protocols in use is not maintained." }, { "id": "IT.PRO-13.5.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.6.2.2.3" } ], "prose": "Some weak authentication mechanisms have been disabled but others remain enabled without documented justification or remediation plan." }, { "id": "IT.PRO-13.5.PE-4", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.6.2.2.4" } ], "prose": "Compensating controls exist for some retained legacy protocols but monitoring is inconsistent or decommissioning timelines are not defined." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.03.6.2.3" } ], "parts": [ { "id": "IT.PRO-13.5.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.6.2.3.1" } ], "prose": "Legacy authentication protocols that cannot enforce modern authentication controls have been identified and disabled across systems within scope, excluding documented and risk accepted exceptions." }, { "id": "IT.PRO-13.5.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.6.2.3.2" } ], "prose": "An assessment of legacy authentication protocol use has been conducted across in-scope systems and the inventory is maintained." }, { "id": "IT.PRO-13.5.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.6.2.3.3" } ], "prose": "Where retention is necessary, compensating controls are applied and decommissioning timelines are recorded and tracked." }, { "id": "IT.PRO-13.5.FE-4", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.6.2.3.4" } ], "prose": "Ongoing use of legacy authentication protocols is regularly risk reviewed, accepted and recorded in the organisation’s risk register." } ] } ] } ] }, { "id": "IT.PRO-13.6", "title": "IT.PRO-13.6", "props": [ { "name": "sort-id", "value": "3.03.7" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#f26268e4-32a9-5f2a-9f87-7a7fad7f68fc", "rel": "mitigated-technique", "text": "Mitigated technique: Brute Force" }, { "href": "#77ba96d0-f819-580a-9622-c823aba0d750", "rel": "mitigated-technique", "text": "Mitigated technique: Valid Accounts" } ], "parts": [ { "id": "IT.PRO-13.6.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.03.7.1" }, { "name": "label", "value": "Action" } ], "prose": "Ensure that user, machine, system and service account credentials are unique per system or account, particularly in high-privilege contexts." }, { "id": "IT.PRO-13.6.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.03.7.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.03.7.2.1" } ], "parts": [ { "id": "IT.PRO-13.6.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.7.2.1.1" } ], "prose": "Local administrator credentials are shared across the device fleet, or service or privileged account credentials are routinely reused across systems." }, { "id": "IT.PRO-13.6.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.7.2.1.2" } ], "prose": "Credential uniqueness is not enforced for applicable user, machine, system or service identities." }, { "id": "IT.PRO-13.6.NE-3", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.7.2.1.3" } ], "prose": "Credential uniqueness has not been addressed in high-privilege contexts, including domain administration, cloud administration or automation platforms." }, { "id": "IT.PRO-13.6.NE-4", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.7.2.1.4" } ], "prose": "Where credential uniqueness cannot be enforced, neither compensating controls nor remediation paths are in place." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.03.7.2.2" } ], "parts": [ { "id": "IT.PRO-13.6.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.7.2.2.1" } ], "prose": "Local administrator credential uniqueness has been implemented for some device populations but coverage is incomplete across the device fleet." }, { "id": "IT.PRO-13.6.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.7.2.2.2" } ], "prose": "A technical mechanism is in place but applies to only a subset of credential types or systems within scope." }, { "id": "IT.PRO-13.6.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.7.2.2.3" } ], "prose": "Credential uniqueness has been addressed in some high-privilege contexts but gaps remain in others." }, { "id": "IT.PRO-13.6.PE-4", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.7.2.2.4" } ], "prose": "Compensating controls exist for some shared credentials but monitoring is inconsistent or remediation plans do not exist." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.03.7.2.3" } ], "parts": [ { "id": "IT.PRO-13.6.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.7.2.3.1" } ], "prose": "Credentials for applicable local administrative accounts are unique to each system or account." }, { "id": "IT.PRO-13.6.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.7.2.3.2" } ], "prose": "Credential uniqueness is consistently enforced for applicable user, machine, system and service identities." }, { "id": "IT.PRO-13.6.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.7.2.3.3" } ], "prose": "Credential uniqueness is enforced consistently in high-privilege contexts, with managed identities or equivalent capabilities used in preference to shared static credentials wherever feasible." }, { "id": "IT.PRO-13.6.FE-4", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.03.7.2.3.4" } ], "prose": "Where uniqueness cannot be enforced, compensating controls are applied, the use of the shared credentials is monitored, and a remediation plan exists." } ] } ] } ] } ] }, { "id": "PRO-12", "class": "essentials-principle", "title": "PRO-12 - Least privilege access", "props": [ { "name": "sort-id", "value": "3.04" } ], "parts": [ { "id": "PRO-12.overview", "name": "overview", "props": [ { "name": "sort-id", "value": "3.04.1" }, { "name": "label", "value": "Principle" } ], "prose": "Users are granted the minimum access to systems (infrastructure, operating systems, applications and data) required to undertake their duties or functions." } ], "controls": [ { "id": "IT.PRO-12.1", "title": "IT.PRO-12.1", "props": [ { "name": "sort-id", "value": "3.04.2" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#5e12fa47-c2dd-5834-8f8e-aba05566851e", "rel": "mitigated-technique", "text": "Mitigated technique: Account Manipulation" } ], "parts": [ { "id": "IT.PRO-12.1.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.04.2.1" }, { "name": "label", "value": "Action" } ], "prose": "Periodically review and update access privileges in alignment with current roles, duties and business requirements." }, { "id": "IT.PRO-12.1.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.04.2.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.04.2.2.1" } ], "parts": [ { "id": "IT.PRO-12.1.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.2.2.1.1" } ], "prose": "Access privileges are not reviewed against current roles, duties and business requirements." }, { "id": "IT.PRO-12.1.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.2.2.1.2" } ], "prose": "Access reviews do not identify privileges that are no longer required." }, { "id": "IT.PRO-12.1.NE-3", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.2.2.1.3" } ], "prose": "Access privileges are not updated when personnel roles, duties or business requirements change." }, { "id": "IT.PRO-12.1.NE-4", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.2.2.1.4" } ], "prose": "Access privileges are not mapped to roles, duties and business requirements." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.04.2.2.2" } ], "parts": [ { "id": "IT.PRO-12.1.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.2.2.2.1" } ], "prose": "Access reviews are conducted for some accounts or systems, but coverage is incomplete." }, { "id": "IT.PRO-12.1.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.2.2.2.2" } ], "prose": "Reviews identify excessive or obsolete privileges, but updates are incomplete or not completed within timeframes defined by the organisation." }, { "id": "IT.PRO-12.1.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.2.2.2.3" } ], "prose": "A process to review access privileges exists but only occurs on an ad hoc basis." }, { "id": "IT.PRO-12.1.PE-4", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.2.2.2.4" } ], "prose": "Some access privileges are mapped to roles, duties and business requirements, but not all." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.04.2.2.3" } ], "parts": [ { "id": "IT.PRO-12.1.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.2.2.3.1" } ], "prose": "Access privileges for all applicable accounts and systems are reviewed within a cycle defined by the organisation and aligned with current roles, duties and business requirements." }, { "id": "IT.PRO-12.1.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.2.2.3.2" } ], "prose": "Privileges identified as excessive or obsolete are removed or updated within timeframes defined by the organisation." }, { "id": "IT.PRO-12.1.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.2.2.3.3" } ], "prose": "Review outcomes and resulting access changes are documented and available as evidence." }, { "id": "IT.PRO-12.1.FE-4", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.04.2.2.3.4" } ], "prose": "Access privileges are mapped to current roles, duties and business requirements." } ] } ] } ] } ] }, { "id": "PRO-04", "class": "essentials-principle", "title": "PRO-04 - Secure configuration management", "props": [ { "name": "sort-id", "value": "3.06" } ], "parts": [ { "id": "PRO-04.overview", "name": "overview", "props": [ { "name": "sort-id", "value": "3.06.1" }, { "name": "label", "value": "Principle" } ], "prose": "Systems (infrastructure, operating systems and applications) are securely configured to approved and maintained baselines, including by reducing attack surfaces and attack paths, with configurations continually monitored and consistently enforced." } ], "controls": [ { "id": "IT.PRO-04.1", "title": "IT.PRO-04.1", "props": [ { "name": "sort-id", "value": "3.06.2" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#c525290c-5eea-5f39-a2fb-c2040a6e5fdb", "rel": "mitigated-technique", "text": "Mitigated technique: Server Software Component" }, { "href": "#c63496b4-4278-579d-9285-096cb1827bff", "rel": "mitigated-technique", "text": "Mitigated technique: Windows Management Instrumentation" }, { "href": "#6c7783e0-7afa-53d9-a1d1-14609e950bb8", "rel": "mitigated-technique", "text": "Mitigated technique: Network Service Discovery" }, { "href": "#673978f9-01a4-5122-b90f-cf2cbd9ce239", "rel": "mitigated-technique", "text": "Mitigated technique: OS Credential Dumping" } ], "parts": [ { "id": "IT.PRO-04.1.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.06.2.1" }, { "name": "label", "value": "Action" } ], "prose": "Define approved configuration baselines, informed by vendor and industry hardening guidance, that disable or remove unnecessary services, insecure settings, and unsupported or weak communication protocols." }, { "id": "IT.PRO-04.1.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.06.2.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.06.2.2.1" } ], "parts": [ { "id": "IT.PRO-04.1.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.2.2.1.1" } ], "prose": "No documented configuration baseline exists for assets." }, { "id": "IT.PRO-04.1.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.2.2.1.2" } ], "prose": "Systems are deployed with vendor defaults and no documented hardening has been applied." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.06.2.2.2" } ], "parts": [ { "id": "IT.PRO-04.1.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.2.2.2.1" } ], "prose": "A baseline exists but does not address all applicable asset types." }, { "id": "IT.PRO-04.1.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.2.2.2.2" } ], "prose": "The baseline is documented but has not been reviewed or updated within the cycle defined by the organisation." }, { "id": "IT.PRO-04.1.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.2.2.2.3" } ], "prose": "The baseline exists but rationale for configuration decisions is not documented." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.06.2.2.3" } ], "parts": [ { "id": "IT.PRO-04.1.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.2.2.3.1" } ], "prose": "A documented and approved baseline exists for all applicable asset types." }, { "id": "IT.PRO-04.1.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.2.2.3.2" } ], "prose": "The baseline disables or removes unnecessary services, insecure settings, and unsupported or weak communication protocols." }, { "id": "IT.PRO-04.1.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.2.2.3.3" } ], "prose": "Configuration decisions are documented with rationale to support drift assessment." }, { "id": "IT.PRO-04.1.FE-4", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.2.2.3.4" } ], "prose": "The baseline is reviewed and updated on a cycle defined by the organisation." } ] } ] } ] }, { "id": "IT.PRO-04.2", "title": "IT.PRO-04.2", "props": [ { "name": "sort-id", "value": "3.06.3" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#8506766a-663b-5c06-97d6-d810ca1c1efa", "rel": "mitigated-technique", "text": "Mitigated technique: Exploit Public-Facing Application" }, { "href": "#7c507df2-5896-514c-96a0-e5a3d03e185c", "rel": "mitigated-technique", "text": "Mitigated technique: External Remote Services" }, { "href": "#bc8e7bf7-de00-5611-971b-03f8177737f5", "rel": "mitigated-technique", "text": "Mitigated technique: User Execution" }, { "href": "#f7271268-a1b0-5db7-8e73-63a5b2c328ff", "rel": "mitigated-technique", "text": "Mitigated technique: Command and Scripting Interpreter" } ], "parts": [ { "id": "IT.PRO-04.2.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.06.3.1" }, { "name": "label", "value": "Action" } ], "prose": "Deploy approved configuration baselines on systems, including infrastructure, operating systems and applications." }, { "id": "IT.PRO-04.2.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.06.3.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.06.3.2.1" } ], "parts": [ { "id": "IT.PRO-04.2.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.3.2.1.1" } ], "prose": "Approved baselines have not been applied to assets." }, { "id": "IT.PRO-04.2.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.3.2.1.2" } ], "prose": "Baseline deployment has not been validated through technical assessment." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.06.3.2.2" } ], "parts": [ { "id": "IT.PRO-04.2.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.3.2.2.1" } ], "prose": "Approved baselines have been implemented where available, but some relevant asset types are not covered by an approved baseline." }, { "id": "IT.PRO-04.2.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.3.2.2.2" } ], "prose": "Deployment has occurred but validation through technical assessment is incomplete or not current." }, { "id": "IT.PRO-04.2.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.3.2.2.3" } ], "prose": "Approved baselines have been deployed, but coverage for all applicable assets is inconsistent." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.06.3.2.3" } ], "parts": [ { "id": "IT.PRO-04.2.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.3.2.3.1" } ], "prose": "Approved baselines have been applied to all applicable assets." }, { "id": "IT.PRO-04.2.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.3.2.3.2" } ], "prose": "Deployment has been validated through technical assessment." }, { "id": "IT.PRO-04.2.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.3.2.3.3" } ], "prose": "Coverage metrics are available demonstrating deployment completeness." } ] } ] } ] }, { "id": "IT.PRO-04.3", "title": "IT.PRO-04.3", "props": [ { "name": "sort-id", "value": "3.06.4" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#7b9a147e-3ff0-575d-bd46-8175e912f663", "rel": "mitigated-technique", "text": "Mitigated technique: Disable or Modify Tools" }, { "href": "#d8919c75-5d9c-55c2-a60c-bd8be81e044a", "rel": "mitigated-technique", "text": "Mitigated technique: Modify Registry" } ], "parts": [ { "id": "IT.PRO-04.3.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.06.4.1" }, { "name": "label", "value": "Action" } ], "prose": "Detect and respond to configuration drift using scheduled technical assessments and, where supported, automated monitoring, based on system criticality and change rate." }, { "id": "IT.PRO-04.3.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.06.4.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.06.4.2.1" } ], "parts": [ { "id": "IT.PRO-04.3.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.4.2.1.1" } ], "prose": "No mechanism exists to detect configuration drift from approved baselines." }, { "id": "IT.PRO-04.3.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.4.2.1.2" } ], "prose": "Assessments to detect configuration drift have not been conducted within the review period defined by the organisation." }, { "id": "IT.PRO-04.3.NE-3", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.4.2.1.3" } ], "prose": "Assessments do not systematically identify instances of configuration drift for assets." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.06.4.2.2" } ], "parts": [ { "id": "IT.PRO-04.3.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.4.2.2.1" } ], "prose": "Drift detection is in place but does not cover all applicable assets." }, { "id": "IT.PRO-04.3.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.4.2.2.2" } ], "prose": "Drift is detected but the remediation process is informal or response timeframes are not defined." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.06.4.2.3" } ], "parts": [ { "id": "IT.PRO-04.3.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.4.2.3.1" } ], "prose": "Automated configuration monitoring or regular technical assessments detect drift across the applicable assets, occurring at a frequency based on system criticality and change rate." }, { "id": "IT.PRO-04.3.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.4.2.3.2" } ], "prose": "A documented remediation process exists with defined response timeframes aligned to severity." }, { "id": "IT.PRO-04.3.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.06.4.2.3.3" } ], "prose": "Drift events are tracked to closure with evidence of remediation." } ] } ] } ] } ] }, { "id": "PRO-06", "class": "essentials-principle", "title": "PRO-06 - Vulnerability management", "props": [ { "name": "sort-id", "value": "3.07" } ], "parts": [ { "id": "PRO-06.overview", "name": "overview", "props": [ { "name": "sort-id", "value": "3.07.1" }, { "name": "label", "value": "Principle" } ], "prose": "Vulnerabilities in systems (infrastructure, operating systems, applications and data) are identified, documented, validated and prioritised for remediation or mitigation in a timely manner, with all remediation and mitigation actions verified for effectiveness." } ], "controls": [ { "id": "IT.PRO-06.1", "title": "IT.PRO-06.1", "props": [ { "name": "sort-id", "value": "3.07.2" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#8506766a-663b-5c06-97d6-d810ca1c1efa", "rel": "mitigated-technique", "text": "Mitigated technique: Exploit Public-Facing Application" }, { "href": "#c73e777a-81e0-53e1-a470-3a6df2f16c9e", "rel": "mitigated-technique", "text": "Mitigated technique: Exploitation for Privilege Escalation" }, { "href": "#c8a8aa25-4f5d-5499-ace7-6c4f319dc2d2", "rel": "mitigated-technique", "text": "Mitigated technique: Exploitation of Remote Services" }, { "href": "#1efe1353-9697-5390-88a4-c28d87de2074", "rel": "mitigated-technique", "text": "Mitigated technique: Exploitation for Client Execution" } ], "parts": [ { "id": "IT.PRO-06.1.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.07.2.1" }, { "name": "label", "value": "Action" } ], "prose": "Identify known software and configuration weaknesses of assets through continuous and repeatable assessment activities, including vulnerability scanning activities." }, { "id": "IT.PRO-06.1.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.07.2.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.07.2.2.1" } ], "parts": [ { "id": "IT.PRO-06.1.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.2.2.1.1" } ], "prose": "Vulnerability scanning activities are not undertaken." }, { "id": "IT.PRO-06.1.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.2.2.1.2" } ], "prose": "No routine vulnerability assessment activity has been conducted within a period defined by the organisation." }, { "id": "IT.PRO-06.1.NE-3", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.2.2.1.3" } ], "prose": "Advisories for relevant software and configuration weaknesses for organisational assets are not reviewed and assessed for impact." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.07.2.2.2" } ], "parts": [ { "id": "IT.PRO-06.1.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.2.2.2.1" } ], "prose": "Vulnerability scanning is deployed but does not cover all applicable assets." }, { "id": "IT.PRO-06.1.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.2.2.2.2" } ], "prose": "Vulnerability scans are conducted but results are not reviewed and prioritised within timeframes defined by the organisation." }, { "id": "IT.PRO-06.1.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.2.2.2.3" } ], "prose": "Vulnerability scans are conducted but frequency is not regular enough to enable timely response." }, { "id": "IT.PRO-06.1.PE-4", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.2.2.2.4" } ], "prose": "Scanning covers software vulnerabilities but not configuration weaknesses." }, { "id": "IT.PRO-06.1.PE-5", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.2.2.2.5" } ], "prose": "Advisories for relevant software and configuration weaknesses for organisational assets are reviewed on an ad hoc basis, or only for some assets." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.07.2.2.3" } ], "parts": [ { "id": "IT.PRO-06.1.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.2.2.3.1" } ], "prose": "All applicable assets are included in routine vulnerability scanning, and scanning frequency enables timely response." }, { "id": "IT.PRO-06.1.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.2.2.3.2" } ], "prose": "Scanning covers both software vulnerabilities and configuration weaknesses." }, { "id": "IT.PRO-06.1.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.2.2.3.3" } ], "prose": "Results are reviewed and prioritised within timeframes defined by the organisation." }, { "id": "IT.PRO-06.1.FE-4", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.2.2.3.4" } ], "prose": "Advisories for relevant software and configuration weaknesses in all organisational assets are regularly reviewed and assessed for impact." } ] } ] } ] }, { "id": "IT.PRO-06.2", "title": "IT.PRO-06.2", "props": [ { "name": "sort-id", "value": "3.07.3" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#8506766a-663b-5c06-97d6-d810ca1c1efa", "rel": "mitigated-technique", "text": "Mitigated technique: Exploit Public-Facing Application" }, { "href": "#c73e777a-81e0-53e1-a470-3a6df2f16c9e", "rel": "mitigated-technique", "text": "Mitigated technique: Exploitation for Privilege Escalation" }, { "href": "#c8a8aa25-4f5d-5499-ace7-6c4f319dc2d2", "rel": "mitigated-technique", "text": "Mitigated technique: Exploitation of Remote Services" }, { "href": "#1efe1353-9697-5390-88a4-c28d87de2074", "rel": "mitigated-technique", "text": "Mitigated technique: Exploitation for Client Execution" } ], "parts": [ { "id": "IT.PRO-06.2.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.07.3.1" }, { "name": "label", "value": "Action" } ], "prose": "Apply security patches or updates within defined risk-based timeframes or automatically where operational impact is low." }, { "id": "IT.PRO-06.2.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.07.3.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.07.3.2.1" } ], "parts": [ { "id": "IT.PRO-06.2.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.3.2.1.1" } ], "prose": "No defined patching timeframes exist for applicable assets." }, { "id": "IT.PRO-06.2.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.3.2.1.2" } ], "prose": "Patches are not applied or are applied on an ad hoc basis with no tracking." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.07.3.2.2" } ], "parts": [ { "id": "IT.PRO-06.2.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.3.2.2.1" } ], "prose": "Expected patching timeframes are defined by the organisation but are not consistently met." }, { "id": "IT.PRO-06.2.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.3.2.2.2" } ], "prose": "Patches are applied but compensating controls are not documented where operational constraints prevent timely patching." }, { "id": "IT.PRO-06.2.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.3.2.2.3" } ], "prose": "Patching coverage metrics exist but show significant gaps." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.07.3.2.3" } ], "parts": [ { "id": "IT.PRO-06.2.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.3.2.3.1" } ], "prose": "Risk-based patching timeframes defined by the organisation are in place and consistently met." }, { "id": "IT.PRO-06.2.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.3.2.3.2" } ], "prose": "Patching is prioritised based on vulnerability severity, exposure and exploit availability." }, { "id": "IT.PRO-06.2.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.3.2.3.3" } ], "prose": "Where operational constraints prevent timely patching, compensating controls are documented and approved." }, { "id": "IT.PRO-06.2.FE-4", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.3.2.3.4" } ], "prose": "Patching coverage metrics account for all applicable assets, with any exclusions identified and formally risk accepted." }, { "id": "IT.PRO-06.2.FE-5", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.3.2.3.5" } ], "prose": "Automatic patching of assets is applied where available and the organisation has determined operational impact is low." } ] } ] } ] }, { "id": "IT.PRO-06.3", "title": "IT.PRO-06.3", "props": [ { "name": "sort-id", "value": "3.07.4" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#8506766a-663b-5c06-97d6-d810ca1c1efa", "rel": "mitigated-technique", "text": "Mitigated technique: Exploit Public-Facing Application" }, { "href": "#c73e777a-81e0-53e1-a470-3a6df2f16c9e", "rel": "mitigated-technique", "text": "Mitigated technique: Exploitation for Privilege Escalation" }, { "href": "#c8a8aa25-4f5d-5499-ace7-6c4f319dc2d2", "rel": "mitigated-technique", "text": "Mitigated technique: Exploitation of Remote Services" }, { "href": "#1efe1353-9697-5390-88a4-c28d87de2074", "rel": "mitigated-technique", "text": "Mitigated technique: Exploitation for Client Execution" } ], "parts": [ { "id": "IT.PRO-06.3.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.07.4.1" }, { "name": "label", "value": "Action" } ], "prose": "Remediate or mitigate vulnerabilities exceeding defined risk thresholds within defined timeframes based on exploitation, exposure, criticality, impact and compensating controls, and verify treatment effectiveness." }, { "id": "IT.PRO-06.3.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.07.4.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.07.4.2.1" } ], "parts": [ { "id": "IT.PRO-06.3.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.4.2.1.1" } ], "prose": "No risk thresholds are defined for vulnerability remediation." }, { "id": "IT.PRO-06.3.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.4.2.1.2" } ], "prose": "Vulnerabilities exceeding acceptable risk levels are not tracked or remediated." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.07.4.2.2" } ], "parts": [ { "id": "IT.PRO-06.3.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.4.2.2.1" } ], "prose": "Risk thresholds are defined but vulnerabilities exceeding them are not consistently remediated within defined timeframes." }, { "id": "IT.PRO-06.3.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.4.2.2.2" } ], "prose": "Compensating controls are applied in some cases but are not formally documented or approved." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.07.4.2.3" } ], "parts": [ { "id": "IT.PRO-06.3.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.4.2.3.1" } ], "prose": "Risk thresholds defined by the organisation exist, and vulnerabilities exceeding them are remediated or have approved compensating controls within organisationally defined timeframes." }, { "id": "IT.PRO-06.3.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.4.2.3.2" } ], "prose": "Remediation and mitigation actions are tracked to closure with verification that actions reduced the risk as intended." }, { "id": "IT.PRO-06.3.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.07.4.2.3.3" } ], "prose": "The process is sustained, with historical data demonstrating consistent performance across organisationally defined reporting periods." } ] } ] } ] } ] }, { "id": "PRO-07", "class": "essentials-principle", "title": "PRO-07 - Trustworthy software", "props": [ { "name": "sort-id", "value": "3.08" } ], "parts": [ { "id": "PRO-07.overview", "name": "overview", "props": [ { "name": "sort-id", "value": "3.08.1" }, { "name": "label", "value": "Principle" } ], "prose": "Systems (operating systems and applications) only permit the execution of software that is supported, verified and authorised." } ], "controls": [ { "id": "IT.PRO-07.1", "title": "IT.PRO-07.1", "props": [ { "name": "sort-id", "value": "3.08.2" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#7b9a147e-3ff0-575d-bd46-8175e912f663", "rel": "mitigated-technique", "text": "Mitigated technique: Disable or Modify Tools" }, { "href": "#bc8e7bf7-de00-5611-971b-03f8177737f5", "rel": "mitigated-technique", "text": "Mitigated technique: User Execution" }, { "href": "#f7271268-a1b0-5db7-8e73-63a5b2c328ff", "rel": "mitigated-technique", "text": "Mitigated technique: Command and Scripting Interpreter" }, { "href": "#c63496b4-4278-579d-9285-096cb1827bff", "rel": "mitigated-technique", "text": "Mitigated technique: Windows Management Instrumentation" }, { "href": "#3cdb8a7b-7078-504c-b939-b63f740335c9", "rel": "mitigated-technique", "text": "Mitigated technique: Process Injection" }, { "href": "#49f81937-6239-545c-9a71-294e320e4648", "rel": "mitigated-technique", "text": "Mitigated technique: System Binary Proxy Execution" } ], "parts": [ { "id": "IT.PRO-07.1.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.08.2.1" }, { "name": "label", "value": "Action" } ], "prose": "Permit only supported, verified and organisation-authorised software to execute on systems, with exceptions minimised, formally risk accepted, time-bound, monitored and regularly reviewed." }, { "id": "IT.PRO-07.1.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.08.2.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.08.2.2.1" } ], "parts": [ { "id": "IT.PRO-07.1.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.2.2.1.1" } ], "prose": "Unsupported, unverified or unauthorised software can execute without restriction." }, { "id": "IT.PRO-07.1.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.2.2.1.2" } ], "prose": "The list of approved software does not exist." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.08.2.2.2" } ], "parts": [ { "id": "IT.PRO-07.1.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.2.2.2.1" } ], "prose": "Execution restriction controls are deployed but do not cover all applicable assets." }, { "id": "IT.PRO-07.1.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.2.2.2.2" } ], "prose": "The organisation maintains a list of approved software, but it has not been reviewed within timeframes defined by the organisation." }, { "id": "IT.PRO-07.1.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.2.2.2.3" } ], "prose": "Execution restrictions are in place but integrity verification of approved software is not performed." }, { "id": "IT.PRO-07.1.PE-4", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.2.2.2.4" } ], "prose": "Exceptions to execution restrictions are granted without formal approval or time-bounding." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.08.2.2.3" } ], "parts": [ { "id": "IT.PRO-07.1.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.2.2.3.1" } ], "prose": "Controls restrict execution to supported, organisation-authorised and integrity-verified software on all applicable assets." }, { "id": "IT.PRO-07.1.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.2.2.3.2" } ], "prose": "The organisation maintains a list of approved software and reviews it within the timeframes defined by the organisation." }, { "id": "IT.PRO-07.1.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.2.2.3.3" } ], "prose": "Integrity of permitted software is verified using trusted mechanisms appropriate to the software and its source." }, { "id": "IT.PRO-07.1.FE-4", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.2.2.3.4" } ], "prose": "Exceptions are formally approved, documented, time-bound and reviewed on a regular cycle defined by the organisation." } ] } ] } ] }, { "id": "IT.PRO-07.2", "title": "IT.PRO-07.2", "props": [ { "name": "sort-id", "value": "3.08.3" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#7b9a147e-3ff0-575d-bd46-8175e912f663", "rel": "mitigated-technique", "text": "Mitigated technique: Disable or Modify Tools" }, { "href": "#bc8e7bf7-de00-5611-971b-03f8177737f5", "rel": "mitigated-technique", "text": "Mitigated technique: User Execution" }, { "href": "#f7271268-a1b0-5db7-8e73-63a5b2c328ff", "rel": "mitigated-technique", "text": "Mitigated technique: Command and Scripting Interpreter" }, { "href": "#c63496b4-4278-579d-9285-096cb1827bff", "rel": "mitigated-technique", "text": "Mitigated technique: Windows Management Instrumentation" }, { "href": "#3cdb8a7b-7078-504c-b939-b63f740335c9", "rel": "mitigated-technique", "text": "Mitigated technique: Process Injection" }, { "href": "#49f81937-6239-545c-9a71-294e320e4648", "rel": "mitigated-technique", "text": "Mitigated technique: System Binary Proxy Execution" } ], "parts": [ { "id": "IT.PRO-07.2.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "3.08.3.1" }, { "name": "label", "value": "Action" } ], "prose": "Restrict administrative and management tooling to approved software sets and executed from only authorised, known locations." }, { "id": "IT.PRO-07.2.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "3.08.3.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "3.08.3.2.1" } ], "parts": [ { "id": "IT.PRO-07.2.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.3.2.1.1" } ], "prose": "No approved administrative toolset is defined." }, { "id": "IT.PRO-07.2.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.3.2.1.2" } ], "prose": "No restrictions are placed on the location administrative tooling can be executed from." }, { "id": "IT.PRO-07.2.NE-3", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.3.2.1.3" } ], "prose": "No controls prevent unapproved administrative tools, including tools commonly used in post-compromise activity, from executing on managed assets." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "3.08.3.2.2" } ], "parts": [ { "id": "IT.PRO-07.2.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.3.2.2.1" } ], "prose": "An approved toolset is defined but not consistently enforced across all assets." }, { "id": "IT.PRO-07.2.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.3.2.2.2" } ], "prose": "Administrative tooling is configured to execute from known locations, but privileged users can still run tooling from unapproved locations." }, { "id": "IT.PRO-07.2.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.3.2.2.3" } ], "prose": "Some unapproved administrative tools are blocked but enforcement gaps exist." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "3.08.3.2.3" } ], "parts": [ { "id": "IT.PRO-07.2.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.3.2.3.1" } ], "prose": "A defined and enforced approved toolset exists for administrative and management activities, and execution is limited to authorised, known locations." }, { "id": "IT.PRO-07.2.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "3.08.3.2.3.2" } ], "prose": "Administrative and management tooling outside the approved set is blocked from execution, including from unauthorised locations." } ] } ] } ] } ] } ] }, { "id": "DET", "title": "Detect principles", "props": [ { "name": "sort-id", "value": "4" } ], "groups": [ { "id": "DET-01", "class": "essentials-principle", "title": "DET-01 - Centralised event logging", "props": [ { "name": "sort-id", "value": "4.1" } ], "parts": [ { "id": "DET-01.overview", "name": "overview", "props": [ { "name": "sort-id", "value": "4.1.1" }, { "name": "label", "value": "Principle" } ], "prose": "Security-relevant event logs and configuration changes for systems (infrastructure, operating systems, applications and data) are centrally collected, protected against unauthorised modification or deletion, and retained to support effective cyber security event detection and investigation." } ], "controls": [ { "id": "IT.DET-01.1", "title": "IT.DET-01.1", "props": [ { "name": "sort-id", "value": "4.1.2" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#46785cc3-484c-58a6-aae3-b25173f54a61", "rel": "mitigated-technique", "text": "Mitigated technique: Indicator Removal" }, { "href": "#7b9a147e-3ff0-575d-bd46-8175e912f663", "rel": "mitigated-technique", "text": "Mitigated technique: Disable or Modify Tools" } ], "parts": [ { "id": "IT.DET-01.1.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "4.1.2.1" }, { "name": "label", "value": "Action" } ], "prose": "Protect event logs from unauthorised access, modification or deletion, including by encrypting them during transit and at rest and securing the systems and accounts used to store, manage and analyse them." }, { "id": "IT.DET-01.1.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "4.1.2.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "4.1.2.2.1" } ], "parts": [ { "id": "IT.DET-01.1.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.2.2.1.1" } ], "prose": "Logs generated by applicable assets are not protected from modification or deletion." }, { "id": "IT.DET-01.1.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.2.2.1.2" } ], "prose": "Log access is not restricted to authorised roles with a business need." }, { "id": "IT.DET-01.1.NE-3", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.2.2.1.3" } ], "prose": "Logs are neither encrypted during transit nor at rest." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "4.1.2.2.2" } ], "parts": [ { "id": "IT.DET-01.1.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.2.2.2.1" } ], "prose": "Logs are forwarded but integrity protections are not in place at the source." }, { "id": "IT.DET-01.1.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.2.2.2.2" } ], "prose": "Log access is restricted but some roles retain the ability to modify or delete logs." }, { "id": "IT.DET-01.1.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.2.2.2.3" } ], "prose": "Logs are encrypted during transit but are not protected with encryption at rest (or vice versa)." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "4.1.2.2.3" } ], "parts": [ { "id": "IT.DET-01.1.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.2.2.3.1" } ], "prose": "Logs are protected against modification or deletion." }, { "id": "IT.DET-01.1.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.2.2.3.2" } ], "prose": "Logs are encrypted in transit and at rest." }, { "id": "IT.DET-01.1.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.2.2.3.3" } ], "prose": "Access to logs is restricted to authorised roles with a business need." } ] } ] } ] }, { "id": "IT.DET-01.2", "title": "IT.DET-01.2", "props": [ { "name": "sort-id", "value": "4.1.3" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "links": [ { "href": "#46785cc3-484c-58a6-aae3-b25173f54a61", "rel": "mitigated-technique", "text": "Mitigated technique: Indicator Removal" }, { "href": "#7b9a147e-3ff0-575d-bd46-8175e912f663", "rel": "mitigated-technique", "text": "Mitigated technique: Disable or Modify Tools" } ], "parts": [ { "id": "IT.DET-01.2.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "4.1.3.1" }, { "name": "label", "value": "Action" } ], "prose": "Forward high-value, security-relevant event logs and configuration changes from infrastructure, operating systems and applications to a central log storage capability." }, { "id": "IT.DET-01.2.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "4.1.3.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "4.1.3.2.1" } ], "parts": [ { "id": "IT.DET-01.2.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.3.2.1.1" } ], "prose": "Security-relevant logs from assets are not forwarded to a central logging capability." }, { "id": "IT.DET-01.2.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.3.2.1.2" } ], "prose": "High-value, security-relevant event logs or configuration changes from infrastructure, operating systems or applications are not forwarded." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "4.1.3.2.2" } ], "parts": [ { "id": "IT.DET-01.2.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.3.2.2.1" } ], "prose": "High-value, security-relevant event logs are forwarded, but coverage gaps are identified or completeness has not been validated." }, { "id": "IT.DET-01.2.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.3.2.2.2" } ], "prose": "Configuration change logs are forwarded inconsistently." }, { "id": "IT.DET-01.2.PE-3", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.3.2.2.3" } ], "prose": "The utility of security log sources is reviewed, but on an ad hoc basis rather than according to a defined schedule." }, { "id": "IT.DET-01.2.PE-4", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.3.2.2.4" } ], "prose": "Log forwarding is in place but latency is excessive for effective detection." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "4.1.3.2.3" } ], "parts": [ { "id": "IT.DET-01.2.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.3.2.3.1" } ], "prose": "High-value security-relevant event logs and configuration changes from all relevant infrastructure, operating systems and application sources are forwarded to the central logging capability." }, { "id": "IT.DET-01.2.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.3.2.3.2" } ], "prose": "Security log sources are reviewed at regular intervals to ensure their continued utility in detecting and responding to changing adversary techniques." }, { "id": "IT.DET-01.2.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.3.2.3.3" } ], "prose": "Log completeness has been validated against the expected log sources." }, { "id": "IT.DET-01.2.FE-4", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.1.3.2.3.4" } ], "prose": "Logs are forwarded at a frequency that enables timely detection." } ] } ] } ] } ] }, { "id": "DET-02", "class": "essentials-principle", "title": "DET-02 - Cyber security event detection", "props": [ { "name": "sort-id", "value": "4.3" } ], "parts": [ { "id": "DET-02.overview", "name": "overview", "props": [ { "name": "sort-id", "value": "4.3.1" }, { "name": "label", "value": "Principle" } ], "prose": "Anomalous or unexpected events and behaviours for systems (infrastructure, operating systems, applications and data) are analysed in a timely manner to detect cyber security events." } ], "controls": [ { "id": "IT.DET-02.1", "title": "IT.DET-02.1", "props": [ { "name": "sort-id", "value": "4.3.2" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "boundary-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "identity-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "critical-processes-and-services" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "privileged-environments" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "business-systems" }, { "name": "domain", "ns": "https://www.cyber.gov.au/ns/essentials/oscal/1.0", "value": "user-devices" } ], "parts": [ { "id": "IT.DET-02.1.action", "name": "statement", "class": "essentials-action", "props": [ { "name": "sort-id", "value": "4.3.2.1" }, { "name": "label", "value": "Action" } ], "prose": "Ensure event logs are normalised, time-synchronised and enriched to support correlation across systems and environments." }, { "id": "IT.DET-02.1.indicators-of-good-practice", "name": "statement", "class": "indicators-of-good-practice", "title": "Indicators of Good Practice", "props": [ { "name": "sort-id", "value": "4.3.2.2" } ], "parts": [ { "name": "item", "class": "indicator-group", "title": "Not effective", "props": [ { "name": "sort-id", "value": "4.3.2.2.1" } ], "parts": [ { "id": "IT.DET-02.1.NE-1", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.3.2.2.1.1" } ], "prose": "Logs are not time-synchronised to an authoritative source." }, { "id": "IT.DET-02.1.NE-2", "name": "item", "class": "not-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.3.2.2.1.2" } ], "prose": "Logs are ingested in raw format and are neither normalised nor enriched." } ] }, { "name": "item", "class": "indicator-group", "title": "Partially effective", "props": [ { "name": "sort-id", "value": "4.3.2.2.2" } ], "parts": [ { "id": "IT.DET-02.1.PE-1", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.3.2.2.2.1" } ], "prose": "Logs are time-synchronised but are not normalised to a common schema." }, { "id": "IT.DET-02.1.PE-2", "name": "item", "class": "partially-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.3.2.2.2.2" } ], "prose": "Some enrichment is applied but critical contextual data such as asset classification or account type is missing." } ] }, { "name": "item", "class": "indicator-group", "title": "Fully effective", "props": [ { "name": "sort-id", "value": "4.3.2.2.3" } ], "parts": [ { "id": "IT.DET-02.1.FE-1", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.3.2.2.3.1" } ], "prose": "Logs are time-synchronised to the authoritative time source." }, { "id": "IT.DET-02.1.FE-2", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.3.2.2.3.2" } ], "prose": "Logs are normalised into the common log schema and enriched with contextual metadata." }, { "id": "IT.DET-02.1.FE-3", "name": "item", "class": "fully-effective-indicator-statement", "props": [ { "name": "sort-id", "value": "4.3.2.2.3.3" } ], "prose": "Enriched logs support correlation across relevant systems, environments and data sources in the central logging platform." } ] } ] } ] } ] } ] } ], "back-matter": { "resources": [ { "uuid": "0c6c92ee-dc6c-571a-84d7-6c89841f9847", "title": "Supply Chain Compromise", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1195/" } ] }, { "uuid": "8506766a-663b-5c06-97d6-d810ca1c1efa", "title": "Exploit Public-Facing Application", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1190/" } ] }, { "uuid": "77ba96d0-f819-580a-9622-c823aba0d750", "title": "Valid Accounts", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1078/" } ] }, { "uuid": "ecd4f2ca-f615-539b-bf51-98fa38c69549", "title": "Remote Services", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1021/" } ] }, { "uuid": "c73e777a-81e0-53e1-a470-3a6df2f16c9e", "title": "Exploitation for Privilege Escalation", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1068/" } ] }, { "uuid": "c525290c-5eea-5f39-a2fb-c2040a6e5fdb", "title": "Server Software Component", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1505/" } ] }, { "uuid": "f26268e4-32a9-5f2a-9f87-7a7fad7f68fc", "title": "Brute Force", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1110/" } ] }, { "uuid": "5e12fa47-c2dd-5834-8f8e-aba05566851e", "title": "Account Manipulation", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1098/" } ] }, { "uuid": "adaac7e5-a0e4-56f2-ab2a-62040e289c93", "title": "Multi-Factor Authentication Request Generation", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1621/" } ] }, { "uuid": "e639c32d-d0bb-52cb-a8db-7f59a9ca3a5e", "title": "Adversary-in-the-Middle", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1557/" } ] }, { "uuid": "673978f9-01a4-5122-b90f-cf2cbd9ce239", "title": "OS Credential Dumping", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1003/" } ] }, { "uuid": "7b9a147e-3ff0-575d-bd46-8175e912f663", "title": "Disable or Modify Tools", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1685/" } ] }, { "uuid": "d8919c75-5d9c-55c2-a60c-bd8be81e044a", "title": "Modify Registry", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1112/" } ] }, { "uuid": "c63496b4-4278-579d-9285-096cb1827bff", "title": "Windows Management Instrumentation", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1047/" } ] }, { "uuid": "6c7783e0-7afa-53d9-a1d1-14609e950bb8", "title": "Network Service Discovery", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1046/" } ] }, { "uuid": "7c507df2-5896-514c-96a0-e5a3d03e185c", "title": "External Remote Services", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1133/" } ] }, { "uuid": "bc8e7bf7-de00-5611-971b-03f8177737f5", "title": "User Execution", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1204/" } ] }, { "uuid": "f7271268-a1b0-5db7-8e73-63a5b2c328ff", "title": "Command and Scripting Interpreter", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1059/" } ] }, { "uuid": "c8a8aa25-4f5d-5499-ace7-6c4f319dc2d2", "title": "Exploitation of Remote Services", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1210/" } ] }, { "uuid": "1efe1353-9697-5390-88a4-c28d87de2074", "title": "Exploitation for Client Execution", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1203/" } ] }, { "uuid": "3cdb8a7b-7078-504c-b939-b63f740335c9", "title": "Process Injection", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1055/" } ] }, { "uuid": "49f81937-6239-545c-9a71-294e320e4648", "title": "System Binary Proxy Execution", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1218/" } ] }, { "uuid": "46785cc3-484c-58a6-aae3-b25173f54a61", "title": "Indicator Removal", "rlinks": [ { "href": "https://attack.mitre.org/versions/v19/techniques/T1070/" } ] }, { "uuid": "16a937ca-e469-5f97-981b-d503a1b37e1e", "title": "Assessment evidence guide for enterprise IT - User devices OSCAL Resolved Catalog v2026.10.15", "props": [ { "name": "published", "value": "2026-10-15T00:30:23Z" }, { "name": "version", "value": "v2026.10.15" } ], "rlinks": [ { "href": "https://www.cyber.gov.au/e4eit/oscal/v2026.10.15/artifacts/E4EIT_user-devices-domain_resolved-catalog.xml", "media-type": "application/xml" }, { "href": "https://www.cyber.gov.au/e4eit/oscal/v2026.10.15/artifacts/E4EIT_user-devices-domain_resolved-catalog.json", "media-type": "application/json" }, { "href": "https://www.cyber.gov.au/e4eit/oscal/v2026.10.15/artifacts/E4EIT_user-devices-domain_resolved-catalog.yaml", "media-type": "application/oscal+yaml" } ] }, { "uuid": "c7d20c73-e9a9-5cfc-9f0a-3e2fa7317d70", "title": "Assessment evidence guide for enterprise IT - User devices OSCAL Profile v2026.10.15", "props": [ { "name": "published", "value": "2026-10-15T00:30:23Z" }, { "name": "version", "value": "v2026.10.15" } ], "rlinks": [ { "href": "https://www.cyber.gov.au/e4eit/oscal/v2026.10.15/artifacts/E4EIT_user-devices-domain_profile.xml", "media-type": "application/xml" }, { "href": "https://www.cyber.gov.au/e4eit/oscal/v2026.10.15/artifacts/E4EIT_user-devices-domain_profile.json", "media-type": "application/json" }, { "href": "https://www.cyber.gov.au/e4eit/oscal/v2026.10.15/artifacts/E4EIT_user-devices-domain_profile.yaml", "media-type": "application/oscal+yaml" } ] }, { "uuid": "f2f325ed-16e8-5d6c-a4b9-fbb0836fc58d", "title": "Assessment evidence guide for enterprise IT - User devices OSCAL Resolved Catalog - latest version", "rlinks": [ { "href": "https://www.cyber.gov.au/e4eit/oscal/latest-version/artifacts/E4EIT_user-devices-domain_resolved-catalog.xml", "media-type": "application/xml" }, { "href": "https://www.cyber.gov.au/e4eit/oscal/latest-version/artifacts/E4EIT_user-devices-domain_resolved-catalog.json", "media-type": "application/json" }, { "href": "https://www.cyber.gov.au/e4eit/oscal/latest-version/artifacts/E4EIT_user-devices-domain_resolved-catalog.yaml", "media-type": "application/oscal+yaml" } ] }, { "uuid": "9ea9ed05-3363-5856-86b1-be1c3bfec7b1", "title": "Assessment evidence guide for enterprise IT - User devices OSCAL Resolved Catalog v2026.10.15 - predecessor version", "rlinks": [ { "href": "https://www.cyber.gov.au/e4eit/oscal/v2026.10.15/predecessor-version/artifacts/E4EIT_user-devices-domain_resolved-catalog.xml", "media-type": "application/xml" }, { "href": "https://www.cyber.gov.au/e4eit/oscal/v2026.10.15/predecessor-version/artifacts/E4EIT_user-devices-domain_resolved-catalog.json", "media-type": "application/json" }, { "href": "https://www.cyber.gov.au/e4eit/oscal/v2026.10.15/predecessor-version/artifacts/E4EIT_user-devices-domain_resolved-catalog.yaml", "media-type": "application/oscal+yaml" } ] }, { "uuid": "daf46df7-8de2-5cd6-af11-713e910c03fe", "title": "Assessment evidence guide for enterprise IT - User devices OSCAL Resolved Catalog v2026.10.15 - successor version", "rlinks": [ { "href": "https://www.cyber.gov.au/e4eit/oscal/v2026.10.15/successor-version/artifacts/E4EIT_user-devices-domain_resolved-catalog.xml", "media-type": "application/xml" }, { "href": "https://www.cyber.gov.au/e4eit/oscal/v2026.10.15/successor-version/artifacts/E4EIT_user-devices-domain_resolved-catalog.json", "media-type": "application/json" }, { "href": "https://www.cyber.gov.au/e4eit/oscal/v2026.10.15/successor-version/artifacts/E4EIT_user-devices-domain_resolved-catalog.yaml", "media-type": "application/oscal+yaml" } ] }, { "uuid": "114809ce-ec9a-5213-8906-a6960ae16000", "title": "Assessment evidence guide for enterprise IT", "props": [ { "name": "published", "value": "2026-10-15T00:00:00+11:00" }, { "name": "version", "value": "2026-10-15" } ], "rlinks": [ { "href": "https://www.cyber.gov.au/e4eit/pdf/v2026.10.15-pdf", "media-type": "application/pdf" } ] }, { "uuid": "2fa82717-6d7f-568b-ba02-e88af7e42323", "title": "Essentials OSCAL NS 1.0", "rlinks": [ { "href": "https://www.cyber.gov.au/ns/essentials/oscal/1.0" } ] } ] } } }