---
catalog:
  uuid: 9411bee7-49f2-45cd-a524-96274bfa5765
  metadata:
    title: Information Security Manual TOP SECRET Baseline
    last-modified: 2023-04-12T04:35:47.588497Z
    version: 2023.04.12
    oscal-version: 1.0.4
    props:
    - name: resolution-tool
      value: libOSCAL-Java+xslt
    links:
    - href: https://www.cyber.gov.au/ism/oscal/v2023.04.12/artifacts/ISM_TOP_SECRET-baseline_profile.xml
      rel: source-profile
    roles:
    - id: prepared-by
      title: Document creator
    parties:
    - uuid: ae0012b5-2a98-4610-ba74-08928451a4c0
      type: organization
      name: Australian Cyber Security Centre
      short-name: ACSC
      links:
      - href: https://www.cyber.gov.au
        rel: homepage
      email-addresses:
      - asd.assist@defence.gov.au
      addresses:
      - type: work
        addr-lines:
        - Australian Cyber Security Centre
        - General enquiries
        - PO Box 5076
        city: Kingston
        state: ACT
        postal-code: "2604"
        country: AU
    responsible-parties:
    - role-id: prepared-by
      party-uuids:
      - ae0012b5-2a98-4610-ba74-08928451a4c0
  groups:
  - title: Cyber Security Principles
    props:
    - name: sort-id
      value: "catalog[1].group[02]"
    groups:
    - title: The cyber security principles
      props:
      - name: sort-id
        value: "catalog[1].group[02].group[1]"
      parts:
      - name: overview
        prose: |-
          # Purpose of the cyber security principles

          The purpose of the cyber security principles is to provide strategic guidance on how an organisation can protect their systems and data from cyber threats. These cyber security principles are grouped into four key activities: govern, protect, detect and respond.

          * Govern: Identifying and managing security risks.
          * Protect: Implementing controls to reduce security risks.
          * Detect: Detecting and understanding cyber security events to identify cyber security incidents.
          * Respond: Responding to and recovering from cyber security incidents.

          # Maturity modelling

          When implementing the cyber security principles, an organisation can use the following maturity model to assess the implementation of individual principles, groups of principles or the cyber security principles as a whole. The five levels in the maturity model are:

          * Incomplete: The cyber security principles are partially implemented or not implemented.
          * Initial: The cyber security principles are implemented, but in a poor or ad hoc manner.
          * Developing: The cyber security principles are sufficiently implemented, but on a project-by-project basis.
          * Managing: The cyber security principles are established as standard business practices and robustly implemented throughout the organisation.
          * Optimising: A deliberate focus on optimisation and continual improvement exists for the implementation of the cyber security principles throughout the organisation.
      groups:
      - title: Govern principles
        props:
        - name: sort-id
          value: "catalog[1].group[02].group[1].group[1]"
        parts:
        - name: overview
          prose: 'The govern principles are:'
        controls:
        - id: ism-principle-g1
          class: ISM-principle
          title: "Security Principle: G1"
          props:
          - name: sort-id
            value: "catalog[1].group[02].group[1].group[1].control[1]"
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-principle-g1_smt
            name: statement
            prose: A Chief Information Security Officer provides leadership and oversight of cyber security.
        - id: ism-principle-g2
          class: ISM-principle
          title: "Security Principle: G2"
          props:
          - name: sort-id
            value: "catalog[1].group[02].group[1].group[1].control[2]"
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-principle-g2_smt
            name: statement
            prose: "The identity and value of systems, applications and data is determined and documented."
        - id: ism-principle-g3
          class: ISM-principle
          title: "Security Principle: G3"
          props:
          - name: sort-id
            value: "catalog[1].group[02].group[1].group[1].control[3]"
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-principle-g3_smt
            name: statement
            prose: "The confidentiality, integrity and availability requirements for systems, applications and data are determined and documented."
        - id: ism-principle-g4
          class: ISM-principle
          title: "Security Principle: G4"
          props:
          - name: sort-id
            value: "catalog[1].group[02].group[1].group[1].control[4]"
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-principle-g4_smt
            name: statement
            prose: Security risk management processes are embedded into organisational risk management frameworks.
        - id: ism-principle-g5
          class: ISM-principle
          title: "Security Principle: G5"
          props:
          - name: sort-id
            value: "catalog[1].group[02].group[1].group[1].control[5]"
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-principle-g5_smt
            name: statement
            prose: "Security risks are identified, documented, managed and accepted both before systems and applications are authorised for use, and continuously throughout their operational life."
      - title: Protect principles
        props:
        - name: sort-id
          value: "catalog[1].group[02].group[1].group[2]"
        parts:
        - name: overview
          prose: 'The protect principles are:'
        controls:
        - id: ism-principle-p1
          class: ISM-principle
          title: "Security Principle: P1"
          props:
          - name: sort-id
            value: "catalog[1].group[02].group[1].group[2].control[01]"
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-principle-p1_smt
            name: statement
            prose: "Systems and applications are designed, deployed, maintained and decommissioned according to their value and their confidentiality, integrity and availability requirements."
        - id: ism-principle-p2
          class: ISM-principle
          title: "Security Principle: P2"
          props:
          - name: sort-id
            value: "catalog[1].group[02].group[1].group[2].control[02]"
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-principle-p2_smt
            name: statement
            prose: Systems and applications are delivered and supported by trusted suppliers.
        - id: ism-principle-p3
          class: ISM-principle
          title: "Security Principle: P3"
          props:
          - name: sort-id
            value: "catalog[1].group[02].group[1].group[2].control[03]"
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-principle-p3_smt
            name: statement
            prose: Systems and applications are designed and configured to reduce their attack surface.
        - id: ism-principle-p4
          class: ISM-principle
          title: "Security Principle: P4"
          props:
          - name: sort-id
            value: "catalog[1].group[02].group[1].group[2].control[04]"
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-principle-p4_smt
            name: statement
            prose: Systems and applications are administered in a secure and accountable manner.
        - id: ism-principle-p5
          class: ISM-principle
          title: "Security Principle: P5"
          props:
          - name: sort-id
            value: "catalog[1].group[02].group[1].group[2].control[05]"
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-principle-p5_smt
            name: statement
            prose: Security vulnerabilities in systems and applications are identified and mitigated in a timely manner.
        - id: ism-principle-p6
          class: ISM-principle
          title: "Security Principle: P6"
          props:
          - name: sort-id
            value: "catalog[1].group[02].group[1].group[2].control[06]"
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-principle-p6_smt
            name: statement
            prose: "Only trusted and supported operating systems, applications and computer code can execute on systems."
        - id: ism-principle-p7
          class: ISM-principle
          title: "Security Principle: P7"
          props:
          - name: sort-id
            value: "catalog[1].group[02].group[1].group[2].control[07]"
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-principle-p7_smt
            name: statement
            prose: Data is encrypted at rest and in transit between different systems.
        - id: ism-principle-p8
          class: ISM-principle
          title: "Security Principle: P8"
          props:
          - name: sort-id
            value: "catalog[1].group[02].group[1].group[2].control[08]"
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-principle-p8_smt
            name: statement
            prose: Data communicated between different systems is controlled and inspectable.
        - id: ism-principle-p9
          class: ISM-principle
          title: "Security Principle: P9"
          props:
          - name: sort-id
            value: "catalog[1].group[02].group[1].group[2].control[09]"
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-principle-p9_smt
            name: statement
            prose: "Data, applications and configuration settings are backed up in a secure and proven manner on a regular basis."
        - id: ism-principle-p10
          class: ISM-principle
          title: "Security Principle: P10"
          props:
          - name: sort-id
            value: "catalog[1].group[02].group[1].group[2].control[10]"
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-principle-p10_smt
            name: statement
            prose: "Only trusted and vetted personnel are granted access to systems, applications and data repositories."
        - id: ism-principle-p11
          class: ISM-principle
          title: "Security Principle: P11"
          props:
          - name: sort-id
            value: "catalog[1].group[02].group[1].group[2].control[11]"
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-principle-p11_smt
            name: statement
            prose: "Personnel are granted the minimum access to systems, applications and data repositories required for their duties."
        - id: ism-principle-p12
          class: ISM-principle
          title: "Security Principle: P12"
          props:
          - name: sort-id
            value: "catalog[1].group[02].group[1].group[2].control[12]"
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-principle-p12_smt
            name: statement
            prose: "Multiple methods are used to identify and authenticate personnel to systems, applications and data repositories."
        - id: ism-principle-p13
          class: ISM-principle
          title: "Security Principle: P13"
          props:
          - name: sort-id
            value: "catalog[1].group[02].group[1].group[2].control[13]"
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-principle-p13_smt
            name: statement
            prose: Personnel are provided with ongoing cyber security awareness training.
        - id: ism-principle-p14
          class: ISM-principle
          title: "Security Principle: P14"
          props:
          - name: sort-id
            value: "catalog[1].group[02].group[1].group[2].control[14]"
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-principle-p14_smt
            name: statement
            prose: "Physical access to systems, supporting infrastructure and facilities is restricted to authorised personnel."
      - title: Detect principles
        props:
        - name: sort-id
          value: "catalog[1].group[02].group[1].group[3]"
        parts:
        - name: overview
          prose: 'The detect principles are:'
        controls:
        - id: ism-principle-d1
          class: ISM-principle
          title: "Security Principle: D1"
          props:
          - name: sort-id
            value: "catalog[1].group[02].group[1].group[3].control[1]"
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-principle-d1_smt
            name: statement
            prose: Event logs are collected and analysed in a timely manner to detect cyber security events.
        - id: ism-principle-d2
          class: ISM-principle
          title: "Security Principle: D2"
          props:
          - name: sort-id
            value: "catalog[1].group[02].group[1].group[3].control[2]"
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-principle-d2_smt
            name: statement
            prose: Cyber security events are analysed in a timely manner to identify cyber security incidents.
      - title: Respond principles
        props:
        - name: sort-id
          value: "catalog[1].group[02].group[1].group[4]"
        parts:
        - name: overview
          prose: 'The respond principles are:'
        controls:
        - id: ism-principle-r1
          class: ISM-principle
          title: "Security Principle: R1"
          props:
          - name: sort-id
            value: "catalog[1].group[02].group[1].group[4].control[1]"
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-principle-r1_smt
            name: statement
            prose: Cyber security incidents are reported both internally and externally to relevant bodies in a timely manner.
        - id: ism-principle-r2
          class: ISM-principle
          title: "Security Principle: R2"
          props:
          - name: sort-id
            value: "catalog[1].group[02].group[1].group[4].control[2]"
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-principle-r2_smt
            name: statement
            prose: "Cyber security incidents are contained, eradicated and recovered from in a timely manner."
        - id: ism-principle-r3
          class: ISM-principle
          title: "Security Principle: R3"
          props:
          - name: sort-id
            value: "catalog[1].group[02].group[1].group[4].control[3]"
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-principle-r3_smt
            name: statement
            prose: Business continuity and disaster recovery plans are enacted when required.
  - title: Guidelines for Cyber Security Roles
    props:
    - name: sort-id
      value: "catalog[1].group[03]"
    groups:
    - title: Chief Information Security Officer
      props:
      - name: sort-id
        value: "catalog[1].group[03].group[1]"
      parts:
      - name: overview
        prose: |-
          # Required skills and experience

          The role of the Chief Information Security Officer (CISO) requires a combination of technical and soft skills, such as business acumen, leadership, communications and relationship building. Additionally, a CISO must adopt a continuous approach to learning and up-skilling in order to maintain pace with the cyber threat landscape and new technologies. It is expected that a CISO show innovation and imagination in conceiving and delivering cyber security strategies for their organisation.

          # Further information

          Further information on responding to cyber security incidents can be found in the managing cyber security incidents section of the
          [Guidelines for Cyber Security Incidents](#fe0138db-e83b-4a23-85d3-d84e1c22816f).

          Further information on cyber supply chain risk management can be found in the cyber supply chain risk management section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).

          Further information on the procurement of outsourced services can be found in the managed services and cloud services section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).

          Further information on cyber security awareness training programs can be found in the cyber security awareness training section of the
          [Guidelines for Personnel Security](#7d16ae67-87a7-4861-b939-e13ec279b5a2).
      groups:
      - title: Providing cyber security leadership and guidance
        props:
        - name: sort-id
          value: "catalog[1].group[03].group[1].group[01]"
        parts:
        - name: overview
          prose: "To provide cyber security leadership and guidance within an organisation, it is important that the organisation appoints a CISO."
        controls:
        - id: ism-0714
          class: ISM-control
          title: "Control: ism-0714"
          props:
          - name: sort-id
            value: "catalog[1].group[03].group[1].group[01].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Oct-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0714_smt
            name: statement
            prose: A CISO is appointed to provide cyber security leadership and guidance for their organisation.
      - title: Overseeing the cyber security program
        props:
        - name: sort-id
          value: "catalog[1].group[03].group[1].group[02]"
        parts:
        - name: overview
          prose: "The CISO within an organisation is responsible for overseeing their organisation’s cyber security program and ensuring compliance with cyber security policy, standards, regulations and legislation. They are likely to work with a Chief Security Officer, a Chief Information Officer and other senior executives within their organisation."
        controls:
        - id: ism-1478
          class: ISM-control
          title: "Control: ism-1478"
          props:
          - name: sort-id
            value: "catalog[1].group[03].group[1].group[02].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Oct-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1478_smt
            name: statement
            prose: "The CISO oversees their organisation’s cyber security program and ensures their organisation’s compliance with cyber security policy, standards, regulations and legislation."
        - id: ism-1617
          class: ISM-control
          title: "Control: ism-1617"
          props:
          - name: sort-id
            value: "catalog[1].group[03].group[1].group[02].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Oct-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1617_smt
            name: statement
            prose: The CISO regularly reviews and updates their organisation’s cyber security program to ensure its relevance in addressing cyber threats and harnessing business and cyber security opportunities.
        - id: ism-0724
          class: ISM-control
          title: "Control: ism-0724"
          props:
          - name: sort-id
            value: "catalog[1].group[03].group[1].group[02].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Oct-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0724_smt
            name: statement
            prose: The CISO implements cyber security measurement metrics and key performance indicators for their organisation.
      - title: Coordinating cyber security
        props:
        - name: sort-id
          value: "catalog[1].group[03].group[1].group[03]"
        parts:
        - name: overview
          prose: "The CISO is responsible for ensuring the alignment of cyber security and business objectives within their organisation. To achieve this, they should facilitate communication between cyber security and business stakeholders. This includes translating cyber security concepts and language into business concepts and language, as well as ensuring that business teams consult with cyber security teams to determine appropriate controls when planning new business projects. Additionally, as the CISO is responsible for the development of their organisation’s cyber security program, they are best placed to advise projects on the strategic direction of cyber security within their organisation."
        controls:
        - id: ism-0725
          class: ISM-control
          title: "Control: ism-0725"
          props:
          - name: sort-id
            value: "catalog[1].group[03].group[1].group[03].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0725_smt
            name: statement
            prose: "The CISO coordinates cyber security and business alignment through a cyber security steering committee or advisory board, comprising of key cyber security and business executives, which meets formally and on a regular basis."
        - id: ism-0726
          class: ISM-control
          title: "Control: ism-0726"
          props:
          - name: sort-id
            value: "catalog[1].group[03].group[1].group[03].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Oct-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0726_smt
            name: statement
            prose: The CISO coordinates security risk management activities between cyber security and business teams.
      - title: Reporting on cyber security
        props:
        - name: sort-id
          value: "catalog[1].group[03].group[1].group[04]"
        parts:
        - name: overview
          prose: |-
            The CISO is responsible for reporting cyber security matters to their organisation’s senior executive or Board. Reporting should cover:

            * the organisation’s security risk profile
            * the status of key systems and any outstanding security risks
            * any planned cyber security uplift activities
            * any recent cyber security incidents
            * expected returns on cyber security investments.

            Reporting on cyber security matters should be structured by business functions, regions or legal entities and support a consolidated view of an organisation’s security risks.

            It is important that the CISO is able to translate security risks into operational risks for their organisation, including financial and legal risks, in order to enable more holistic conversations about their organisation’s risks.
        controls:
        - id: ism-0718
          class: ISM-control
          title: "Control: ism-0718"
          props:
          - name: sort-id
            value: "catalog[1].group[03].group[1].group[04].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0718_smt
            name: statement
            prose: The CISO reports directly to their organisation’s senior executive or Board on cyber security matters.
      - title: Overseeing incident response activities
        props:
        - name: sort-id
          value: "catalog[1].group[03].group[1].group[05]"
        parts:
        - name: overview
          prose: |-
            To ensure the CISO is able to accurately report to their organisation’s senior executive or Board on cyber security matters, it is important they are fully aware of all cyber security incidents within their organisation.

            The CISO is also responsible for overseeing their organisation’s response to cyber security incidents, including how internal teams respond and communicate with each other during an incident. In the event of a major cyber security incident, the CISO should be prepared to step into a crisis management role. They should understand how to bring clarity to the situation and communicate effectively with internal and external stakeholders.
        controls:
        - id: ism-0733
          class: ISM-control
          title: "Control: ism-0733"
          props:
          - name: sort-id
            value: "catalog[1].group[03].group[1].group[05].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Oct-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0733_smt
            name: statement
            prose: The CISO is fully aware of all cyber security incidents within their organisation.
        - id: ism-1618
          class: ISM-control
          title: "Control: ism-1618"
          props:
          - name: sort-id
            value: "catalog[1].group[03].group[1].group[05].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Oct-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1618_smt
            name: statement
            prose: The CISO oversees their organisation’s response to cyber security incidents.
      - title: Contributing to business continuity and disaster recovery planning
        props:
        - name: sort-id
          value: "catalog[1].group[03].group[1].group[06]"
        parts:
        - name: overview
          prose: "The CISO is responsible for contributing to the development and maintenance of their organisation’s business continuity and disaster recovery plans, with the aim to improve business resilience and ensure the continued operation of critical business processes."
        controls:
        - id: ism-0734
          class: ISM-control
          title: "Control: ism-0734"
          props:
          - name: sort-id
            value: "catalog[1].group[03].group[1].group[06].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0734_smt
            name: statement
            prose: The CISO contributes to the development and maintenance of business continuity and disaster recovery plans for their organisation to ensure that business-critical services are supported appropriately in the event of a disaster.
      - title: Developing a cyber security communications strategy
        props:
        - name: sort-id
          value: "catalog[1].group[03].group[1].group[07]"
        parts:
        - name: overview
          prose: "To facilitate cyber security cultural change across their organisation, the CISO should act as a thought leader by continually communicating their strategy and vision. A communication strategy can be helpful in achieving this. Communications should be tailored to different parts of their organisation and be topical for the intended audience."
        controls:
        - id: ism-0720
          class: ISM-control
          title: "Control: ism-0720"
          props:
          - name: sort-id
            value: "catalog[1].group[03].group[1].group[07].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0720_smt
            name: statement
            prose: "The CISO develops, implements and maintains a cyber security communications strategy for their organisation."
      - title: Working with suppliers
        props:
        - name: sort-id
          value: "catalog[1].group[03].group[1].group[08]"
        parts:
        - name: overview
          prose: "The CISO is responsible for ensuring that consistent vendor management processes are applied across their organisation, from discovery through to ongoing management. As supplier relationships come with additional security risks, the CISO should assist personnel with assessing cyber supply chain risks and understand the security impacts of entering into contracts with suppliers."
        controls:
        - id: ism-0731
          class: ISM-control
          title: "Control: ism-0731"
          props:
          - name: sort-id
            value: "catalog[1].group[03].group[1].group[08].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Oct-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0731_smt
            name: statement
            prose: The CISO oversees cyber supply chain risk management activities for their organisation.
      - title: Receiving and managing a dedicated cyber security budget
        props:
        - name: sort-id
          value: "catalog[1].group[03].group[1].group[09]"
        parts:
        - name: overview
          prose: "Receiving and managing a dedicated cyber security budget will ensure the CISO has sufficient access to funding to support their cyber security program, including cyber security uplift activities and responding to cyber security incidents."
        controls:
        - id: ism-0732
          class: ISM-control
          title: "Control: ism-0732"
          props:
          - name: sort-id
            value: "catalog[1].group[03].group[1].group[09].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Oct-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0732_smt
            name: statement
            prose: The CISO receives and manages a dedicated cyber security budget for their organisation.
      - title: Overseeing cyber security personnel
        props:
        - name: sort-id
          value: "catalog[1].group[03].group[1].group[10]"
        parts:
        - name: overview
          prose: "The CISO is responsible for the cyber security workforce within their organisation, including plans to attract, train and retain cyber security personnel. The CISO should also delegate relevant tasks to cyber security managers and other personnel as required and provide them with adequate authority and resources to perform their duties."
        controls:
        - id: ism-0717
          class: ISM-control
          title: "Control: ism-0717"
          props:
          - name: sort-id
            value: "catalog[1].group[03].group[1].group[10].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Oct-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0717_smt
            name: statement
            prose: The CISO oversees the management of cyber security personnel within their organisation.
      - title: Overseeing cyber security awareness raising
        props:
        - name: sort-id
          value: "catalog[1].group[03].group[1].group[11]"
        parts:
        - name: overview
          prose: "To ensure personnel are actively contributing to the security culture of their organisation, a cyber security awareness training program should be developed, implemented and maintained. As the CISO is responsible for cyber security within their organisation, they should oversee the development, implementation and maintenance of the cyber security awareness training program."
        controls:
        - id: ism-0735
          class: ISM-control
          title: "Control: ism-0735"
          props:
          - name: sort-id
            value: "catalog[1].group[03].group[1].group[11].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0735_smt
            name: statement
            prose: "The CISO oversees the development, implementation and maintenance of their organisation’s cyber security awareness training program."
    - title: System owners
      props:
      - name: sort-id
        value: "catalog[1].group[03].group[2]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on using the
          [Information Security Manual](#e7ce6e23-4bbb-45c1-a657-7e563c0837ed)’s six step risk management framework can be found in the applying a risk-based approach to cyber security section of
          [Using the Information Security Manual](#8a965432-7e2e-4020-86e4-b38837f9be60).

          Further information on monitoring systems and their operating environments can be found in the event logging and monitoring section of the
          [Guidelines for System Monitoring](#edc24216-f52b-4513-bcda-5fa564661999).
      groups:
      - title: System ownership and oversight
        props:
        - name: sort-id
          value: "catalog[1].group[03].group[2].group[1]"
        parts:
        - name: overview
          prose: "System owners are responsible for ensuring the secure operation of their systems. However, system owners may delegate the day-to-day management and operation of their systems to system managers."
        controls:
        - id: ism-1071
          class: ISM-control
          title: "Control: ism-1071"
          props:
          - name: sort-id
            value: "catalog[1].group[03].group[2].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1071_smt
            name: statement
            prose: Each system has a designated system owner.
        - id: ism-1525
          class: ISM-control
          title: "Control: ism-1525"
          props:
          - name: sort-id
            value: "catalog[1].group[03].group[2].group[1].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jan-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1525_smt
            name: statement
            prose: System owners register each system with its authorising officer.
      - title: Protecting systems and their resources
        props:
        - name: sort-id
          value: "catalog[1].group[03].group[2].group[2]"
        parts:
        - name: overview
          prose: |-
            Broadly, the risk management framework used by the
            [Information Security Manual](#e7ce6e23-4bbb-45c1-a657-7e563c0837ed) has six steps: define the system, select controls, implement controls, assess controls, authorise the system and monitor the system. System owners are responsible for the implementation of this six step risk management framework for each of their systems.
        controls:
        - id: ism-1633
          class: ISM-control
          title: "Control: ism-1633"
          props:
          - name: sort-id
            value: "catalog[1].group[03].group[2].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jan-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1633_smt
            name: statement
            prose: "System owners determine the type, value and security objectives for each system based on an assessment of the impact if it were to be compromised."
        - id: ism-1634
          class: ISM-control
          title: "Control: ism-1634"
          props:
          - name: sort-id
            value: "catalog[1].group[03].group[2].group[2].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1634_smt
            name: statement
            prose: System owners select controls for each system and tailor them to achieve desired security objectives.
        - id: ism-1635
          class: ISM-control
          title: "Control: ism-1635"
          props:
          - name: sort-id
            value: "catalog[1].group[03].group[2].group[2].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1635_smt
            name: statement
            prose: System owners implement controls for each system and its operating environment.
        - id: ism-1636
          class: ISM-control
          title: "Control: ism-1636"
          props:
          - name: sort-id
            value: "catalog[1].group[03].group[2].group[2].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1636_smt
            name: statement
            prose: System owners ensure controls for each system and its operating environment are assessed to determine if they have been implemented correctly and are operating as intended.
        - id: ism-0027
          class: ISM-control
          title: "Control: ism-0027"
          props:
          - name: sort-id
            value: "catalog[1].group[03].group[2].group[2].control[5]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jan-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0027_smt
            name: statement
            prose: System owners obtain authorisation to operate each system from its authorising officer based on the acceptance of the security risks associated with its operation.
        - id: ism-1526
          class: ISM-control
          title: "Control: ism-1526"
          props:
          - name: sort-id
            value: "catalog[1].group[03].group[2].group[2].control[6]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1526_smt
            name: statement
            prose: "System owners monitor each system, and associated cyber threats, security risks and controls, on an ongoing basis."
      - title: Annual reporting of system security status
        props:
        - name: sort-id
          value: "catalog[1].group[03].group[2].group[3]"
        parts:
        - name: overview
          prose: Annual reporting by system owners on the security status of their systems to their authorising officer can assist the authorising officer in maintaining awareness of the security posture of systems within their organisation.
        controls:
        - id: ism-1587
          class: ISM-control
          title: "Control: ism-1587"
          props:
          - name: sort-id
            value: "catalog[1].group[03].group[2].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Aug-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1587_smt
            name: statement
            prose: System owners report the security status of each system to its authorising officer at least annually.
  - title: Guidelines for Cyber Security Incidents
    props:
    - name: sort-id
      value: "catalog[1].group[04]"
    groups:
    - title: Managing cyber security incidents
      props:
      - name: sort-id
        value: "catalog[1].group[04].group[1]"
      parts:
      - name: overview
        prose: |-
          # Cyber security events

          A cyber security event is an occurrence of a system, service or network state indicating a possible breach of security policy, failure of safeguards or a previously unknown situation that may be relevant to security.

          # Cyber security incidents

          A cyber security incident is an unwanted or unexpected cyber security event, or a series of such events, that has either compromised business operations or has a significant probability of compromising business operations.

          # Cyber resilience

          Cyber resilience is the ability to adapt to disruptions caused by cyber security incidents while maintaining continuous business operations. This includes the ability to detect, manage and recover from cyber security incidents.

          # Detecting cyber security incidents

          One of the core elements of detecting and investigating cyber security incidents is the availability of appropriate data sources, such as event logs. The following event logs can be used by an organisation to assist with detecting and investigating cyber security incidents:

          * Cross Domain Solutions: May assist in identifying anomalous or malicious network traffic indicating an exploitation attempt or successful compromise.
          * Databases: May assist in identifying anomalous or malicious application or user behaviour indicating an exploitation attempt or successful compromise.
          * Domain Name System services: May assist in identifying attempts to resolve malicious domain names or Internet Protocol addresses indicating an exploitation attempt or successful compromise.
          * Email servers: May assist in identifying users targeted with phishing emails thereby helping to identify the initial vector of a compromise.
          * Gateways: May assist in identifying anomalous or malicious network traffic indicating an exploitation attempt or successful compromise.
          * Operating systems: May assist in identifying anomalous or malicious activity indicating an exploitation attempt or successful compromise.
          * Remote access services: May assist in identifying unusual locations of access or times of access indicating an exploitation attempt or successful compromise.
          * Security services: May assist in identifying anomalous or malicious application or network traffic indicating an exploitation attempt or successful compromise.
          * Server applications: May assist in identifying anomalous or malicious application behaviour indicating an exploitation attempt or successful compromise.
          * System access: May assist in identifying anomalous or malicious user behaviour indicating an exploitation attempt or successful compromise.
          * User applications: May assist in identifying anomalous or malicious application or user behaviour indicating an exploitation attempt or successful compromise.
          * Web applications: May assist in identifying anomalous or malicious application or user behaviour indicating an exploitation attempt or successful compromise.
          * Web proxies: May assist in identifying anomalous or malicious network traffic indicating an exploitation attempt or successful compromise.

          # Further information

          Further information on event logging can be found in the event logging and monitoring section of the
          [Guidelines for System Monitoring](#edc24216-f52b-4513-bcda-5fa564661999).

          Further information on incident response plans can be found in the system-specific security documentation section of the
          [Guidelines for Security Documentation](#578d0434-6b3f-46f3-aad8-c7ac75c2ebcc).

          Further information on establishing and operating a trusted insider program can be found in the Carnegie Mellon University’s Software Engineering Institute’s
          [Common Sense Guide to Mitigating Insider Threats](#cad720b4-e47a-437d-b272-6958e738131d) publication.

          Further information on reporting of cyber security incidents by service providers can be found in the managed services and cloud services section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).

          Further information on
          [reporting cybercrime incidents](#188466f6-be12-49ce-b99a-981e54b1663e) and
          [reporting cyber security incidents](#626d3582-3caf-49d6-89d5-4b8fdbbf1f31) is available from the ACSC.
      groups:
      - title: Incident management policy
        props:
        - name: sort-id
          value: "catalog[1].group[04].group[1].group[1]"
        parts:
        - name: overview
          prose: |-
            Establishing an incident management policy can increase the likelihood of successfully planning for, detecting and responding to malicious activity on networks and hosts, such as cyber security events and cyber security incidents. In doing so, an incident management policy will likely cover the following:

            * responsibilities for planning for, detecting and responding to cyber security incidents
            * resources assigned to cyber security incident planning, detection and response activities
            * guidelines for triaging and responding to cyber security events and cyber security incidents.

            Furthermore, as part of maintaining the incident management policy, it is important that it is, along with its associated incident response plan, exercised at least annually to ensure it remains fit for purpose.
        controls:
        - id: ism-0576
          class: ISM-control
          title: "Control: ism-0576"
          props:
          - name: sort-id
            value: "catalog[1].group[04].group[1].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "9"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0576_smt
            name: statement
            prose: "An incident management policy, and associated incident response plan, is developed, implemented and maintained."
        - id: ism-1784
          class: ISM-control
          title: "Control: ism-1784"
          props:
          - name: sort-id
            value: "catalog[1].group[04].group[1].group[1].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1784_smt
            name: statement
            prose: "The incident management policy, including the associated incident response plan, is exercised at least annually."
      - title: Cyber security incident register
        props:
        - name: sort-id
          value: "catalog[1].group[04].group[1].group[2]"
        parts:
        - name: overview
          prose: "Developing, implementing and maintaining a cyber security incident register can assist with ensuring that appropriate remediation activities are undertaken in response to cyber security incidents. In addition, the types and frequency of cyber security incidents, along with the costs of any remediation activities, can be used as an input to future risk assessment activities."
        controls:
        - id: ism-0125
          class: ISM-control
          title: "Control: ism-0125"
          props:
          - name: sort-id
            value: "catalog[1].group[04].group[1].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0125_smt
            name: statement
            prose: "A cyber security incident register is developed, implemented and maintained."
        - id: ism-1803
          class: ISM-control
          title: "Control: ism-1803"
          props:
          - name: sort-id
            value: "catalog[1].group[04].group[1].group[2].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1803_smt
            name: statement
            prose: |-
              A cyber security incident register contains the following for each cyber security incident:

              * the date the cyber security incident occurred
              * the date the cyber security incident was discovered
              * a description of the cyber security incident
              * any actions taken in response to the cyber security incident
              * to whom the cyber security incident was reported.
      - title: Trusted insider program
        props:
        - name: sort-id
          value: "catalog[1].group[04].group[1].group[3]"
        parts:
        - name: overview
          prose: |-
            As a trusted insider’s system access and knowledge of business processes often makes them harder to detect, establishing and maintaining a trusted insider program can assist an organisation to detect and respond to trusted insider threats before they occur, or limit damage if they do occur. In doing so, an organisation will likely obtain the most benefit by logging and analysing the following user activities:

            * excessive copying or modification of files
            * unauthorised or excessive use of removable media
            * connecting devices capable of data storage to systems
            * unusual system usage outside of normal business hours
            * excessive data access or printing compared to their peers
            * data transfers to unauthorised cloud services or webmail
            * use of unauthorised Virtual Private Networks, file transfer applications or anonymity networks.
        controls:
        - id: ism-1625
          class: ISM-control
          title: "Control: ism-1625"
          props:
          - name: sort-id
            value: "catalog[1].group[04].group[1].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1625_smt
            name: statement
            prose: "A trusted insider program is developed, implemented and maintained."
        - id: ism-1626
          class: ISM-control
          title: "Control: ism-1626"
          props:
          - name: sort-id
            value: "catalog[1].group[04].group[1].group[3].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Nov-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1626_smt
            name: statement
            prose: Legal advice is sought regarding the development and implementation of a trusted insider program.
      - title: Access to sufficient data sources and tools
        props:
        - name: sort-id
          value: "catalog[1].group[04].group[1].group[4]"
        parts:
        - name: overview
          prose: "Successful detection of cyber security incidents requires trained cyber security personnel with access to sufficient data sources, such as event logs, that are complemented by tools that support both manual and automated analysis. As such, it is important that during system design and development activities, functionality is added to systems to ensure that sufficient data sources can be captured and provided to cyber security personnel."
        controls:
        - id: ism-0120
          class: ISM-control
          title: "Control: ism-0120"
          props:
          - name: sort-id
            value: "catalog[1].group[04].group[1].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: May-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0120_smt
            name: statement
            prose: Cyber security personnel have access to sufficient data sources and tools to ensure that systems can be monitored for key indicators of compromise.
      - title: Reporting cyber security incidents
        props:
        - name: sort-id
          value: "catalog[1].group[04].group[1].group[5]"
        parts:
        - name: overview
          prose: "Reporting cyber security incidents to an organisation’s Chief Information Security Officer, or one of their delegates, as soon as possible after they occur or are discovered provides senior management with the opportunity to assess the impact to their organisation and to oversee any incident response activities. Note, an organisation should also be cognisant of any legislative obligations in regards to reporting cyber security incidents to authorities, customers or the public."
        controls:
        - id: ism-0123
          class: ISM-control
          title: "Control: ism-0123"
          props:
          - name: sort-id
            value: "catalog[1].group[04].group[1].group[5].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-0123_smt
            name: statement
            prose: "Cyber security incidents are reported to an organisation’s Chief Information Security Officer, or one of their delegates, as soon as possible after they occur or are discovered."
      - title: Reporting cyber security incidents to the ACSC
        props:
        - name: sort-id
          value: "catalog[1].group[04].group[1].group[6]"
        parts:
        - name: overview
          prose: |-
            The Australian Cyber Security Centre (ACSC) uses the cyber security incident reports it receives as the basis for providing assistance to organisations. Cyber security incident reports are also used by the ACSC to identify trends and maintain an accurate threat environment picture. The ACSC utilises this understanding to assist in the development of new and updated cyber security advice, capabilities, and techniques to better prevent and respond to evolving cyber threats. An organisation is recommended to internally coordinate their reporting of cyber security incidents to the ACSC.

            The types of cyber security incidents that should be reported to the ACSC include:

            * suspicious activities, such as privileged account lockouts and unusual remote access activities
            * compromise of sensitive or classified data
            * unauthorised access or attempts to access a system
            * emails with suspicious attachments or links
            * denial-of-service attacks
            * ransomware attacks
            * suspected tampering of ICT equipment.
        controls:
        - id: ism-0140
          class: ISM-control
          title: "Control: ism-0140"
          props:
          - name: sort-id
            value: "catalog[1].group[04].group[1].group[6].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: May-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-0140_smt
            name: statement
            prose: Cyber security incidents are reported to the ACSC.
    - title: Responding to cyber security incidents
      props:
      - name: sort-id
        value: "catalog[1].group[04].group[2]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on incident response plans can be found in the system-specific security documentation section of the
          [Guidelines for Security Documentation](#578d0434-6b3f-46f3-aad8-c7ac75c2ebcc).

          Further information on handling malicious code infections can be found in National Institute of Standards and Technology Special Publication 800-61 Rev. 2,
          [Computer Security Incident Handling Guide](#f48c0d05-5173-4c8e-8748-e5591518c1fb).
      groups:
      - title: Enacting incident response plans
        props:
        - name: sort-id
          value: "catalog[1].group[04].group[2].group[1]"
        parts:
        - name: overview
          prose: "Following a cyber security incident being identified, an organisation’s incident response plan should be enacted."
        controls:
        - id: ism-1819
          class: ISM-control
          title: "Control: ism-1819"
          props:
          - name: sort-id
            value: "catalog[1].group[04].group[2].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1819_smt
            name: statement
            prose: "Following the identification of a cyber security incident, an organisation’s incident response plan is enacted."
      - title: Handling and containing data spills
        props:
        - name: sort-id
          value: "catalog[1].group[04].group[2].group[2]"
        parts:
        - name: overview
          prose: "When a data spill occurs, an organisation should inform data owners and restrict access to the data. In doing so, affected systems can be powered off, have their network connectivity removed or have additional access controls applied to the data. It should be noted though that powering off systems could destroy data that would be useful for forensic investigations. Furthermore, users should be made aware of appropriate actions to take in the event of a data spill, such as not deleting, copying, printing or emailing the data."
        controls:
        - id: ism-0133
          class: ISM-control
          title: "Control: ism-0133"
          props:
          - name: sort-id
            value: "catalog[1].group[04].group[2].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0133_smt
            name: statement
            prose: "When a data spill occurs, data owners are advised and access to the data is restricted."
      - title: Handling and containing malicious code infections
        props:
        - name: sort-id
          value: "catalog[1].group[04].group[2].group[3]"
        parts:
        - name: overview
          prose: "Taking immediate remediation steps after the discovery of malicious code can minimise the time and cost spent eradicating and recovering from the infection. As a priority, all infected systems and media should be isolated to prevent the infection from spreading. Once isolated, infected systems and media can be scanned by antivirus software to potentially remove the infection or recover data. It is important to note though, a complete system restoration from a known good backup or rebuild may be the only reliable way to ensure that malicious code can be truly eradicated or data recovered."
        controls:
        - id: ism-0917
          class: ISM-control
          title: "Control: ism-0917"
          props:
          - name: sort-id
            value: "catalog[1].group[04].group[2].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Oct-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0917_smt
            name: statement
            prose: |-
              When malicious code is detected, the following steps are taken to handle the infection:

              * the infected systems are isolated
              * all previously connected media used in the period leading up to the infection are scanned for signs of infection and isolated if necessary
              * antivirus software is used to remove the infection from infected systems and media
              * if the infection cannot be reliably removed, systems are restored from a known good backup or rebuilt.
      - title: Handling and containing intrusions
        props:
        - name: sort-id
          value: "catalog[1].group[04].group[2].group[4]"
        parts:
        - name: overview
          prose: |-
            When an intrusion is detected on a system, an organisation may wish to allow the intrusion to continue for a short period of time in order to fully understand the extent of the compromise and to assist with planning intrusion remediation activities. However, an organisation allowing an intrusion to continue in order to collect data or evidence should first establish with their legal advisors whether such activities would be breaching the
            [Telecommunications (Interception and Access) Act 1979](#e4c07309-9ca8-40b7-9571-4f6c032180a1).

            To increase the likelihood of intrusion remediation activities successfully removing an adversary from their system, an organisation can take preventative measures to ensure the adversary has limited forewarning and awareness of planned intrusion remediation activities. Specifically, using an alternative system to plan and coordinate intrusion remediation activities will prevent alerting the adversary if they have already compromised email, messaging or collaboration services. In addition, conducting intrusion remediation activities in a coordinated manner during the same planned outage will prevent forewarning the adversary, thereby depriving them of sufficient time to establish alternative access points or persistence methods on the system.

            Following intrusion remediation activities, an organisation should determine whether the adversary has been successfully removed from the system, including whether or not they have since reacquired access. This can be achieved, in part, by capturing and analysing network traffic for at least seven days following remediation activities.
        controls:
        - id: ism-0137
          class: ISM-control
          title: "Control: ism-0137"
          props:
          - name: sort-id
            value: "catalog[1].group[04].group[2].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0137_smt
            name: statement
            prose: Legal advice is sought before allowing intrusion activity to continue on a system for the purpose of collecting further data or evidence.
        - id: ism-1609
          class: ISM-control
          title: "Control: ism-1609"
          props:
          - name: sort-id
            value: "catalog[1].group[04].group[2].group[4].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1609_smt
            name: statement
            prose: System owners are consulted before allowing intrusion activity to continue on a system for the purpose of collecting further data or evidence.
        - id: ism-1731
          class: ISM-control
          title: "Control: ism-1731"
          props:
          - name: sort-id
            value: "catalog[1].group[04].group[2].group[4].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1731_smt
            name: statement
            prose: Planning and coordination of intrusion remediation activities are conducted on a separate system to that which has been compromised.
        - id: ism-1732
          class: ISM-control
          title: "Control: ism-1732"
          props:
          - name: sort-id
            value: "catalog[1].group[04].group[2].group[4].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1732_smt
            name: statement
            prose: "To the extent possible, all intrusion remediation activities are conducted in a coordinated manner during the same planned outage."
        - id: ism-1213
          class: ISM-control
          title: "Control: ism-1213"
          props:
          - name: sort-id
            value: "catalog[1].group[04].group[2].group[4].control[5]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1213_smt
            name: statement
            prose: "Following intrusion remediation activities, full network traffic is captured for at least seven days and analysed to determine whether the adversary has been successfully removed from the system."
      - title: Maintaining the integrity of evidence
        props:
        - name: sort-id
          value: "catalog[1].group[04].group[2].group[5]"
        parts:
        - name: overview
          prose: "When gathering evidence following a cyber security incident, it is important that it is gathered in an appropriate manner and that its integrity is maintained. In addition, if the ACSC is requested to assist with investigations, no actions which could affect the integrity of evidence should be carried out before the ACSC becomes involved."
        controls:
        - id: ism-0138
          class: ISM-control
          title: "Control: ism-0138"
          props:
          - name: sort-id
            value: "catalog[1].group[04].group[2].group[5].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0138_smt
            name: statement
            prose: |-
              The integrity of evidence gathered during an investigation is maintained by investigators:

              * recording all of their actions
              * maintaining a proper chain of custody
              * following all instructions provided by relevant law enforcement agencies.
  - title: Guidelines for Procurement and Outsourcing
    props:
    - name: sort-id
      value: "catalog[1].group[05]"
    groups:
    - title: Cyber supply chain risk management
      props:
      - name: sort-id
        value: "catalog[1].group[05].group[1]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on cyber supply chain risk management can be found in the Australian Cyber Security Centre (ACSC)’s
          [Cyber Supply Chain Risk Management](#37f65b5b-ce8c-4137-9c84-41678af1e70e) and
          [Identifying Cyber Supply Chain Risks](#85ee803a-b711-443b-98bf-b279de8fbed0) publications.

          Further information on cyber supply chain risk management can also be found in:

          * Canadian Centre for Cyber Security’s Cyber supply chain: An approach to assessing risk
          * New Zealand’s National Cyber Security Centre’s Supply Chain Cyber Security: In Safe Hands
          * United Kingdom’s National Cyber Security Centre’s Supply chain security guidance.
          * Further information on cyber supply chain risk management can also be found in the United States’ Cybersecurity \& Infrastructure Security Agency’s ICT supply chain resource library.

          Further information on cyber supply chain integrity can be found in National Institute of Standards and Technology Special Publication 800-161 Rev. 1,
          [Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations](#0d7243fc-65f0-4b4e-9358-bf4f6e0e34d7).

          Further information on outsourced products and services can be found in the Attorney-General’s Department’s
          [Protective Security Policy Framework](#92679127-f61d-486a-a93e-df2a26dfb07a),
          [Security governance for contracted goods and service providers](#8bb7bf2c-a933-4a80-8ad7-ca4426839c5d) policy.

          Further information on the procurement and use of evaluated applications and ICT equipment can be found in the evaluated product procurement and evaluated product use sections of the
          [Guidelines for Evaluated Products](#a699a3aa-828d-479b-b50b-98127bb19437).
      groups:
      - title: Cyber supply chain risk management activities
        props:
        - name: sort-id
          value: "catalog[1].group[05].group[1].group[1]"
        parts:
        - name: overview
          prose: |-
            Cyber supply chain risk management activities should be conducted during the earliest possible stage of procurement of applications, ICT equipment and services. In particular, an organisation should consider the security risks that may arise as systems, software and hardware are being designed, built, stored, delivered, installed, operated, maintained and decommissioned. This includes identifying and managing jurisdictional, governance, privacy and security risks associated with the use of suppliers, such as application developers, ICT equipment manufacturers, service providers and other organisations involved in distribution channels. For example, outsourced cloud services may be located offshore and subject to lawful and covert data collection without their customers’ knowledge. Additionally, use of offshore services introduces jurisdictional risks as foreign countries’ laws could change with little warning. Finally, foreign owned suppliers operating in Australia may be subject to a foreign government’s lawful access to data belonging to their customers.

            In managing cyber supply chain risks, it is important that an organisation preferences suppliers that have demonstrated a commitment to the security of their products and services – including throughout distribution channels. In addition, suppliers should have a strong track record of transparency and maintaining the security of their own systems and cyber supply chains. Also, in some cases, a shared responsibly model which clearly defines the responsibilities of suppliers and their customers can be highly beneficial.
        controls:
        - id: ism-1631
          class: ISM-control
          title: "Control: ism-1631"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[1].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1631_smt
            name: statement
            prose: "Suppliers of applications, ICT equipment and services associated with systems are identified."
        - id: ism-1452
          class: ISM-control
          title: "Control: ism-1452"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[1].group[1].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1452_smt
            name: statement
            prose: "A supply chain risk assessment is performed for suppliers of applications, ICT equipment and services in order to assess the impact to a system’s security risk profile."
        - id: ism-1567
          class: ISM-control
          title: "Control: ism-1567"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[1].group[1].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1567_smt
            name: statement
            prose: Suppliers identified as high risk by a cyber supply chain risk assessment are not used.
        - id: ism-1568
          class: ISM-control
          title: "Control: ism-1568"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[1].group[1].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1568_smt
            name: statement
            prose: "Applications, ICT equipment and services are chosen from suppliers that have demonstrated a commitment to the security of their products and services."
        - id: ism-1632
          class: ISM-control
          title: "Control: ism-1632"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[1].group[1].control[5]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1632_smt
            name: statement
            prose: "Applications, ICT equipment and services are chosen from suppliers that have a strong track record of transparency and maintaining the security of their own systems and cyber supply chains."
        - id: ism-1569
          class: ISM-control
          title: "Control: ism-1569"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[1].group[1].control[6]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1569_smt
            name: statement
            prose: "A shared responsibility model is created, documented and shared between suppliers and their customers in order to articulate the security responsibilities of each party."
      - title: Supplier relationship management
        props:
        - name: sort-id
          value: "catalog[1].group[05].group[1].group[2]"
        parts:
        - name: overview
          prose: "Developing, implementing and maintaining a supplier relationship management policy can assist an organisation in identifying, prioritising and maintaining strong relationships with suppliers that have demonstrated a commitment to the security of their products and services. In doing so, these suppliers should be recorded on an approved supplier list."
        controls:
        - id: ism-1785
          class: ISM-control
          title: "Control: ism-1785"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[1].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1785_smt
            name: statement
            prose: "A supplier relationship management policy is developed, implemented and maintained."
        - id: ism-1786
          class: ISM-control
          title: "Control: ism-1786"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[1].group[2].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1786_smt
            name: statement
            prose: "An approved supplier list is developed, implemented and maintained."
      - title: "Sourcing applications, ICT equipment and services"
        props:
        - name: sort-id
          value: "catalog[1].group[05].group[1].group[3]"
        parts:
        - name: overview
          prose: |-
            In sourcing applications, ICT equipment and services, an organisation should use trusted suppliers that they have previously vetted as part of cyber supply chain risk management assessments and subsequently recorded on their approved supplier list.

            Furthermore, in order to support system availability, an organisation should aim to identify multiple potential suppliers for critical applications, ICT equipment and services. This coupled with keeping sufficient spares of critical ICT equipment in reserve, can assist in mitigating the impact of cyber supply chain disruptions.
        controls:
        - id: ism-1787
          class: ISM-control
          title: "Control: ism-1787"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[1].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1787_smt
            name: statement
            prose: "Applications, ICT equipment and services are sourced from approved suppliers."
        - id: ism-1788
          class: ISM-control
          title: "Control: ism-1788"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[1].group[3].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1788_smt
            name: statement
            prose: "Multiple potential suppliers are identified for sourcing critical applications, ICT equipment and services."
        - id: ism-1789
          class: ISM-control
          title: "Control: ism-1789"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[1].group[3].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1789_smt
            name: statement
            prose: Sufficient spares of critical ICT equipment are sourced and kept in reserve.
      - title: "Delivery of applications, ICT equipment and services"
        props:
        - name: sort-id
          value: "catalog[1].group[05].group[1].group[4]"
        parts:
        - name: overview
          prose: |-
            As part of the delivery of applications, ICT equipment and services, measures should be implemented to protect their integrity, noting that such measures will differ depending on whether delivery relates to digital or physical distribution channels. For example, applications may benefit from delivery via encrypted communication channels while ICT equipment may benefit from tracking and tamper-evident packaging. In doing so, such measures are only beneficial if they are assessed as part of acceptance of products and services. In all cases, suppliers should be consulted on how best to confirm the integrity of their products and services.

            While ensuring the integrity of applications, ICT equipment and services is important, so is ensuring their authenticity. For example, a counterfeit product or service securely delivered is still a counterfeit product or service that may not operate as intended or pose a risk to the security of a system. To assist in identifying counterfeit products and services, suppliers should be consulted on how best to confirm the authenticity of their products and services.
        controls:
        - id: ism-1790
          class: ISM-control
          title: "Control: ism-1790"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[1].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1790_smt
            name: statement
            prose: "Applications, ICT equipment and services are delivered in a manner that maintains their integrity."
        - id: ism-1791
          class: ISM-control
          title: "Control: ism-1791"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[1].group[4].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1791_smt
            name: statement
            prose: "The integrity of applications, ICT equipment and services are assessed as part of acceptance of products and services."
        - id: ism-1792
          class: ISM-control
          title: "Control: ism-1792"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[1].group[4].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1792_smt
            name: statement
            prose: "The authenticity of applications, ICT equipment and services are assessed as part of acceptance of products and services."
    - title: Managed services and cloud services
      props:
      - name: sort-id
        value: "catalog[1].group[05].group[2]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on the use of outsourced cloud services can be found in the service continuity for online services section of the
          [Guidelines for Networking](#f145ff5b-d396-4248-8f48-621349d6f0ed).

          Further information on the use of outsourced gateway services can be found in the gateways section of the
          [Guidelines for Gateways](#e8bde527-526c-4a6a-b66f-05228f09dd7b).

          Further information on managed service providers can be found in the ACSC’s
          [How to Manage Your Security When Engaging a Managed Service Provider](#45899752-c83f-4976-bc99-03f6824a0793) and
          [Questions to Ask Managed Service Providers](#76068c96-8d89-4c37-9eef-03488d5e1b1d) publications.

          Further information on the definition of cloud computing can be found in National Institute of Standards and Technology Special Publication 800-145,
          [The NIST Definition of Cloud Computing](#c17600e6-8b13-4d6e-a380-035b51a71b73).

          Further information on securing cloud services can be found in the ACSC’s
          [Cloud Computing Security Considerations](#d7e72166-b127-4249-bf93-3a7467c53f1d),
          [Cloud Computing Security for Cloud Service Providers](#347eee88-cb61-44b9-81ce-ab97dd08387c) and
          [Cloud Computing Security for Tenants](#b959caf4-8b60-4b82-9552-963754841bb7) publications.

          Further information on conducting security assessments of cloud service providers can be found in the ACSC’s
          [Anatomy of a Cloud Assessment and Authorisation](#b6479d9a-43c9-41f2-9dbc-2bb689c8e6d8) and
          [Cloud Assessment and Authorisation – Frequently Asked Questions](#dda788b6-183b-4e89-8254-8c4b5d0540a0) publications.

          Further information on
          [the purpose of IRAP](#84d3cbab-ab84-4981-a4f7-2bd469c8deaf), and
          [a list of current IRAP assessors](#bdd11ace-cb4e-470a-92ad-556c79b6c14a), is available from the ACSC.

          Further information on the whole-of-government policy for secure cloud computing can be found in the Digital Transformation Agency’s
          [Secure Cloud Strategy](#6ba86dff-e078-4896-8884-344e491a9cc4) publication.

          Further information on reporting cyber security incidents can be found in the reporting cyber security incidents section of the
          [Guidelines for Cyber Security Incidents](#fe0138db-e83b-4a23-85d3-d84e1c22816f).
      groups:
      - title: Managed services
        props:
        - name: sort-id
          value: "catalog[1].group[05].group[2].group[1]"
        parts:
        - name: overview
          prose: "Managed service providers manage the services of an organisation on their behalf. This may include application services, authentication services, backup services, desktop services, enterprise mobility services, gateway services, hosting services, network services, procurement services, security services, support services, and many other business-related services. In doing so, managed service providers may manage services from their customers’ premises or their own premises. In considering security risks associated with managed services, an organisation should consider all managed service providers that have access to their facilities, systems or data."
        controls:
        - id: ism-1736
          class: ISM-control
          title: "Control: ism-1736"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[2].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1736_smt
            name: statement
            prose: "A managed service register is developed, implemented, maintained and verified on a regular basis."
        - id: ism-1737
          class: ISM-control
          title: "Control: ism-1737"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[2].group[1].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1737_smt
            name: statement
            prose: |-
              A managed service register contains the following for each managed service:

              * managed service provider’s name
              * managed service’s name
              * purpose for using the managed service
              * sensitivity or classification of data involved
              * due date for the next security assessment of the managed service
              * contractual arrangements for the managed service
              * point of contact for users of the managed service
              * 24/7 contact details for the managed service provider.
      - title: Assessment of managed service providers
        props:
        - name: sort-id
          value: "catalog[1].group[05].group[2].group[2]"
        parts:
        - name: overview
          prose: "Managed service providers will need to undergo regular security assessments by an Infosec Registered Assessor Program (IRAP) assessor to determine their security posture and security risks associated with their use. Following an initial security assessment by an IRAP assessor, subsequent security assessments should focus on any new services that are being offered as well as any security-related changes that have occurred since the previous security assessment."
        controls:
        - id: ism-1793
          class: ISM-control
          title: "Control: ism-1793"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[2].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1793_smt
            name: statement
            prose: Managed service providers and their managed services undergo a security assessment by an IRAP assessor at least every 24 months.
      - title: Outsourced cloud services
        props:
        - name: sort-id
          value: "catalog[1].group[05].group[2].group[3]"
        parts:
        - name: overview
          prose: "Outsourcing can be a cost-effective option for providing cloud services, as well as potentially delivering a superior service. However, outsourcing can affect an organisation’s security risk profile. Ultimately, an organisation will still need to decide whether a particular outsourced cloud service represents an acceptable security risk and, if appropriate to do so, authorise it for their own use."
        controls:
        - id: ism-1637
          class: ISM-control
          title: "Control: ism-1637"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[2].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1637_smt
            name: statement
            prose: "An outsourced cloud service register is developed, implemented, maintained and verified on a regular basis."
        - id: ism-1638
          class: ISM-control
          title: "Control: ism-1638"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[2].group[3].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1638_smt
            name: statement
            prose: |-
              An outsourced cloud service register contains the following for each outsourced cloud service:

              * cloud service provider’s name
              * cloud service’s name
              * purpose for using the cloud service
              * sensitivity or classification of data involved
              * due date for the next security assessment of the cloud service
              * contractual arrangements for the cloud service
              * point of contact for users of the cloud service
              * 24/7 contact details for the cloud service provider.
        - id: ism-1529
          class: ISM-control
          title: "Control: ism-1529"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[2].group[3].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1529_smt
            name: statement
            prose: Only community or private clouds are used for outsourced SECRET and TOP SECRET cloud services.
      - title: Assessment of outsourced cloud service providers
        props:
        - name: sort-id
          value: "catalog[1].group[05].group[2].group[4]"
        parts:
        - name: overview
          prose: "Outsourced cloud service providers and their cloud services will need to undergo regular security assessments by an IRAP assessor to determine their security posture and security risks associated with their use. Following an initial security assessment by an IRAP assessor, subsequent security assessments should focus on any new cloud services that are being offered as well as any security-related changes that have occurred since the previous security assessment."
        controls:
        - id: ism-1570
          class: ISM-control
          title: "Control: ism-1570"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[2].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1570_smt
            name: statement
            prose: Outsourced cloud service providers and their cloud services undergo a security assessment by an IRAP assessor at least every 24 months.
      - title: Contractual security requirements with service providers
        props:
        - name: sort-id
          value: "catalog[1].group[05].group[2].group[5]"
        parts:
        - name: overview
          prose: |-
            Obligations for protecting data are no different when using a managed service or cloud service than when using an in-house service. As such, contractual arrangements with service providers should address how data entrusted to them, including to any of their subcontractors, will be protected both during contractual arrangements and following the completion or termination of contractual arrangements. However, in some cases an organisation may require managed services or cloud services to be used before all security requirements have been implemented by a service provider. In such cases, contractual arrangements with service providers should include appropriate timeframes for the implementation of security requirements and break clauses if these are not achieved.

            In addition, although data ownership resides with service providers’ customers, this can become less clear in some circumstances, such as when legal action is taken and a service provider is asked to provide access to, or data from, their assets. To mitigate the likelihood of data being unavailable or compromised, an organisation can document the types of data and its ownership in contractual arrangements with service providers.

            Furthermore, an organisation may make the decision to move from their current service provider for strategic, operational or governance reasons. This may involve changing to another service provider, moving to a different service with the same service provider or moving back to an on-premises solution. In many cases, transferring data and functionality between old and new services or systems will be desired. Service providers can assist their customers by ensuring data is as portable as possible and that as much data can be exported as possible. As such, data should be stored in a documented format, preferably an open standard, noting that undocumented or proprietary formats may make it more difficult for an organisation to perform backup, service migration or service decommissioning activities.

            Finally, to ensure that an organisation is given sufficient time to download their data or move to another service provider should a service provider cease offering a particular service, a one month notification period should be documented in contractual arrangements with service providers.
        controls:
        - id: ism-1395
          class: ISM-control
          title: "Control: ism-1395"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[2].group[5].control[01]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1395_smt
            name: statement
            prose: "Service providers, including any subcontractors, provide an appropriate level of protection for any data entrusted to them or their services."
        - id: ism-0072
          class: ISM-control
          title: "Control: ism-0072"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[2].group[5].control[02]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "9"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0072_smt
            name: statement
            prose: "Security requirements associated with the confidentiality, integrity and availability of data are documented in contractual arrangements with service providers and reviewed on a regular and ongoing basis to ensure they remain fit for purpose."
        - id: ism-1571
          class: ISM-control
          title: "Control: ism-1571"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[2].group[5].control[03]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1571_smt
            name: statement
            prose: The right to verify compliance with security requirements is documented in contractual arrangements with service providers.
        - id: ism-1738
          class: ISM-control
          title: "Control: ism-1738"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[2].group[5].control[04]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1738_smt
            name: statement
            prose: The right to verify compliance with security requirements documented in contractual arrangements with service providers is exercised on a regular and ongoing basis.
        - id: ism-1804
          class: ISM-control
          title: "Control: ism-1804"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[2].group[5].control[05]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1804_smt
            name: statement
            prose: Break clauses associated with failure to meet security requirements are documented in contractual arrangements with service providers.
        - id: ism-0141
          class: ISM-control
          title: "Control: ism-0141"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[2].group[5].control[06]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0141_smt
            name: statement
            prose: The requirement for service providers to report cyber security incidents to a designated point of contact as soon as possible after they occur or are discovered is documented in contractual arrangements with service providers.
        - id: ism-1794
          class: ISM-control
          title: "Control: ism-1794"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[2].group[5].control[07]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1794_smt
            name: statement
            prose: A minimum notification period of one month by service providers for significant changes to their own service provider arrangements is documented in contractual arrangements with service providers.
        - id: ism-1451
          class: ISM-control
          title: "Control: ism-1451"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[2].group[5].control[08]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1451_smt
            name: statement
            prose: Types of data and its ownership is documented in contractual arrangements with service providers.
        - id: ism-1572
          class: ISM-control
          title: "Control: ism-1572"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[2].group[5].control[09]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1572_smt
            name: statement
            prose: "The regions or availability zones where data will be processed, stored and communicated is documented in contractual arrangements with service providers."
        - id: ism-1573
          class: ISM-control
          title: "Control: ism-1573"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[2].group[5].control[10]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1573_smt
            name: statement
            prose: Access to all logs relating to an organisation’s data and services is documented in contractual arrangements with service providers.
        - id: ism-1574
          class: ISM-control
          title: "Control: ism-1574"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[2].group[5].control[11]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1574_smt
            name: statement
            prose: "The storage of data in a portable manner that allows for backups, service migration and service decommissioning without any loss of data is documented in contractual arrangements with service providers."
        - id: ism-1575
          class: ISM-control
          title: "Control: ism-1575"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[2].group[5].control[12]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1575_smt
            name: statement
            prose: A minimum notification period of one month for the cessation of any services by a service provider is documented in contractual arrangements with service providers.
      - title: Access to systems and data by service providers
        props:
        - name: sort-id
          value: "catalog[1].group[05].group[2].group[6]"
        parts:
        - name: overview
          prose: "To perform their contracted duties, service providers may need to access their customers’ systems and data. However, without proper controls in place, this could leave systems and data vulnerable – especially when access occurs from outside of Australian borders. As such, an organisation should ensure that their systems and data are not accessed or administered by service providers unless such requirements, and associated measures to control such requirements, are documented in contractual arrangements with service providers. In doing so, it is important that sufficient measures are also in place to detect and record any unauthorised access, such as customer support representatives or platform engineers accessing encryption keys. In such cases, the service provider should immediately report the cyber security incident to their customer and make available all logs pertaining to the unauthorised access."
        controls:
        - id: ism-1073
          class: ISM-control
          title: "Control: ism-1073"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[2].group[6].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1073_smt
            name: statement
            prose: An organisation’s systems and data are not accessed or administered by a service provider unless a contractual arrangement exists between the organisation and the service provider to do so.
        - id: ism-1576
          class: ISM-control
          title: "Control: ism-1576"
          props:
          - name: sort-id
            value: "catalog[1].group[05].group[2].group[6].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1576_smt
            name: statement
            prose: "If an organisation’s systems or data are accessed or administered by a service provider in an unauthorised manner, the organisation is immediately notified."
  - title: Guidelines for Security Documentation
    props:
    - name: sort-id
      value: "catalog[1].group[06]"
    groups:
    - title: Development and maintenance of security documentation
      props:
      - name: sort-id
        value: "catalog[1].group[06].group[1]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on system-specific security documentation, such as a system security plan, incident response plan, continuous monitoring plan, security assessment report and plan of action and milestones, can be found in the following section of these guidelines.

          Further information on business continuity and disaster recovery plans can be found in the Chief Information Security Officer section of the
          [Guidelines for Cyber Security Roles](#626dab35-81ab-45fe-8c12-0faff1c23c07).

          Further information on cyber security communication strategies can be found in the Chief Information Security Officer section of the
          [Guidelines for Cyber Security Roles](#626dab35-81ab-45fe-8c12-0faff1c23c07).

          Further information on incident management policy can be found in the managing cyber security incidents section of the
          [Guidelines for Cyber Security Incidents](#fe0138db-e83b-4a23-85d3-d84e1c22816f).

          Further information on cyber security incident registers can be found in the managing cyber security incidents section of the
          [Guidelines for Cyber Security Incidents](#fe0138db-e83b-4a23-85d3-d84e1c22816f).

          Further information on supplier relationship management policy can be found in the cyber supply chain risk management section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).

          Further information on approved supplier lists can be found in the cyber supply chain risk management section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).

          Further information on managed service registers can be found in the managed services and cloud services section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).

          Further information on outsourced cloud service registers can be found in the managed services and cloud services section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).

          Further information on authorised Radio Frequency and infrared device registers can be found in the facilities and systems section of the
          [Guidelines for Physical Security](#4deea7ea-18a2-4fd7-8b25-0b3603215df2).

          Further information on cable registers can be found in the cabling infrastructure section of the
          [Guidelines for Communications Infrastructure](#4defa9a8-c5f5-4b39-8b0a-537f14d9d14d).

          Further information on floor plan diagrams can be found in the cabling infrastructure section of the
          [Guidelines for Communications Infrastructure](#4defa9a8-c5f5-4b39-8b0a-537f14d9d14d).

          Further information on cable labelling processes and procedures can be found in the cabling infrastructure section of the
          [Guidelines for Communications Infrastructure](#4defa9a8-c5f5-4b39-8b0a-537f14d9d14d).

          Further information on telephone system usage policy can be found in the telephone systems section of the
          [Guidelines for Communications Systems](#3a7b903b-ed0d-450d-9123-60f6f8fd5dd2).

          Further information on denial of service response plans for video conferencing and Internet Protocol telephony services can be found in the video conferencing and Internet Protocol telephony section of the
          [Guidelines for Communications Systems](#3a7b903b-ed0d-450d-9123-60f6f8fd5dd2).

          Further information on fax machine and multifunction device usage policy can be found in the fax machines and multifunction devices section of the
          [Guidelines for Communications Systems](#3a7b903b-ed0d-450d-9123-60f6f8fd5dd2).

          Further information on mobile device management policy can be found in the mobile device management section of the
          [Guidelines for Enterprise Mobility](#9a8f5a63-bcd5-45a8-9f9c-974fc796ac95).

          Further information on mobile device usage policy can be found in the mobile device usage section of the
          [Guidelines for Enterprise Mobility](#9a8f5a63-bcd5-45a8-9f9c-974fc796ac95).

          Further information on mobile device emergency sanitisation processes and procedures can be found in the mobile device usage section of the
          [Guidelines for Enterprise Mobility](#9a8f5a63-bcd5-45a8-9f9c-974fc796ac95).

          Further information on ICT equipment management policy can be found in the ICT equipment usage section of the
          [Guidelines for ICT Equipment](#db2e237c-2dbc-4a1f-bae7-9cb63a1f1dc3).

          Further information on ICT equipment registers can be found in the ICT equipment usage section of the
          [Guidelines for ICT Equipment](#db2e237c-2dbc-4a1f-bae7-9cb63a1f1dc3).

          Further information on ICT equipment sanitisation processes and procedures can be found in the ICT equipment sanitisation and destruction section of the
          [Guidelines for ICT Equipment](#db2e237c-2dbc-4a1f-bae7-9cb63a1f1dc3).

          Further information on ICT equipment destruction processes and procedures can be found in the ICT equipment sanitisation and destruction section of the
          [Guidelines for ICT Equipment](#db2e237c-2dbc-4a1f-bae7-9cb63a1f1dc3).

          Further information on ICT equipment disposal processes and procedures can be found in the ICT equipment disposal section of the
          [Guidelines for ICT Equipment](#db2e237c-2dbc-4a1f-bae7-9cb63a1f1dc3).

          Further information on media management policy can be found in the media usage section of the
          [Guidelines for Media](#b594c9c0-b42f-4f06-b643-38023275a5c7).

          Further information on removable media usage policy can be found in the media usage section of the
          [Guidelines for Media](#b594c9c0-b42f-4f06-b643-38023275a5c7).

          Further information on removable media registers can be found in the media usage section of the
          [Guidelines for Media](#b594c9c0-b42f-4f06-b643-38023275a5c7).

          Further information on media sanitisation processes and procedures can be found in the media sanitisation section of the
          [Guidelines for Media](#b594c9c0-b42f-4f06-b643-38023275a5c7).

          Further information on media destruction processes and procedures can be found in the media destruction section of the
          [Guidelines for Media](#b594c9c0-b42f-4f06-b643-38023275a5c7).

          Further information on media disposal processes and procedures can be found in the media disposal section of the
          [Guidelines for Media](#b594c9c0-b42f-4f06-b643-38023275a5c7).

          Further information on system administration processes and procedures can be found in the system administration section of the
          [Guidelines for System Management](#c6ca6620-ccd5-4c5d-b97c-9d92f1162948).

          Further information on patch management processes and procedures can be found in the system patching section of the
          [Guidelines for System Management](#c6ca6620-ccd5-4c5d-b97c-9d92f1162948).

          Further information on software registers can be found in the system patching section of the
          [Guidelines for System Management](#c6ca6620-ccd5-4c5d-b97c-9d92f1162948).

          Further information on digital preservation policy can be found in the data backup and restoration section of the
          [Guidelines for System Management](#c6ca6620-ccd5-4c5d-b97c-9d92f1162948).

          Further information on data backup processes and procedures can be found in the data backup and restoration section of the
          [Guidelines for System Management](#c6ca6620-ccd5-4c5d-b97c-9d92f1162948).

          Further information on data restoration processes and procedures can be found in the data backup and restoration section of the
          [Guidelines for System Management](#c6ca6620-ccd5-4c5d-b97c-9d92f1162948).

          Further information on event logging policy can be found in the event logging and monitoring section of the
          [Guidelines for System Monitoring](#edc24216-f52b-4513-bcda-5fa564661999).

          Further information on vulnerability disclosure policy can be found in the application development section of the
          [Guidelines for Software Development](#506198a8-7ae8-4c95-8b7b-2a4833cfab4b).

          Further information on vulnerability disclosure processes and procedures can be found in the application development section of the
          [Guidelines for Software Development](#506198a8-7ae8-4c95-8b7b-2a4833cfab4b).

          Further information on database registers can be found in the databases section of the
          [Guidelines for Database Systems](#3f349d16-11a1-459a-a299-c9446aea7597).

          Further information on email usage policy can be found in the email usage section of the
          [Guidelines for Email](#ab73fa95-f213-4041-915e-a8ccbdf74331).

          Further information on network diagrams can be found in the network design and configuration section of the
          [Guidelines for Networking](#f145ff5b-d396-4248-8f48-621349d6f0ed).

          Further information on cryptographic key management processes and procedures can be found in the cryptographic fundamentals section of the
          [Guidelines for Cryptography](#195abe87-bb1e-4006-8b42-eaecca4d51f1).

          Further information on web usage policy can be found in the web proxies section of the
          [Guidelines for Gateways](#e8bde527-526c-4a6a-b66f-05228f09dd7b).

          Further information on data transfer processes and procedures can be found in the data transfers section of the
          [Guidelines for Data Transfers](#1eefdaf7-3991-4ba2-9439-79565f508c44).
      groups:
      - title: Cyber security strategy
        props:
        - name: sort-id
          value: "catalog[1].group[06].group[1].group[1]"
        parts:
        - name: overview
          prose: "A cyber security strategy sets out an organisation’s guiding principles, objectives and priorities for cyber security, typically over a three to five year period. In addition, a cyber security strategy may also cover an organisation’s threat environment, cyber security initiatives or investments the organisation plans to make as part of its cyber security program. Without a cyber security strategy, an organisation risks failing to adequately plan for and manage security and business risks within their organisation."
        controls:
        - id: ism-0039
          class: ISM-control
          title: "Control: ism-0039"
          props:
          - name: sort-id
            value: "catalog[1].group[06].group[1].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0039_smt
            name: statement
            prose: "A cyber security strategy is developed, implemented and maintained."
      - title: Approval of security documentation
        props:
        - name: sort-id
          value: "catalog[1].group[06].group[1].group[2]"
        parts:
        - name: overview
          prose: "If security documentation is not reviewed and approved by an appropriate authority, system owners risk failing in their duty to ensure that appropriate controls have been identified and implemented for systems and their operating environments. In doing so, it is important that a system’s security architecture, as outlined within the system security plan and supported by the incident response plan and continuous monitoring plan, is approved by the system’s authorising officer prior to the development of the system."
        controls:
        - id: ism-0047
          class: ISM-control
          title: "Control: ism-0047"
          props:
          - name: sort-id
            value: "catalog[1].group[06].group[1].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: May-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0047_smt
            name: statement
            prose: Organisational-level security documentation is approved by the Chief Information Security Officer while system-specific security documentation is approved by the system’s authorising officer.
        - id: ism-1739
          class: ISM-control
          title: "Control: ism-1739"
          props:
          - name: sort-id
            value: "catalog[1].group[06].group[1].group[2].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1739_smt
            name: statement
            prose: A system’s security architecture is approved prior to the development of the system.
      - title: Maintenance of security documentation
        props:
        - name: sort-id
          value: "catalog[1].group[06].group[1].group[3]"
        parts:
        - name: overview
          prose: "Threat environments are dynamic. If security documentation is not kept up-to-date to reflect the current threat environment, policies, processes and procedures may cease to be effective. In such a situation, resources could be devoted to cyber security initiatives or investments that have reduced effectiveness or are no longer relevant."
        controls:
        - id: ism-0888
          class: ISM-control
          title: "Control: ism-0888"
          props:
          - name: sort-id
            value: "catalog[1].group[06].group[1].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: May-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0888_smt
            name: statement
            prose: "Security documentation is reviewed at least annually and includes a ‘current as at \\[date\\]’ or equivalent statement."
      - title: Communication of security documentation
        props:
        - name: sort-id
          value: "catalog[1].group[06].group[1].group[4]"
        parts:
        - name: overview
          prose: "It is important that once security documentation has been approved, it is published and communicated to all stakeholders. If security documentation is not communicated to stakeholders they will be unaware of what policies and procedures have been implemented for systems."
        controls:
        - id: ism-1602
          class: ISM-control
          title: "Control: ism-1602"
          props:
          - name: sort-id
            value: "catalog[1].group[06].group[1].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Aug-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1602_smt
            name: statement
            prose: "Security documentation, including notification of subsequent changes, is communicated to all stakeholders."
    - title: System-specific security documentation
      props:
      - name: sort-id
        value: "catalog[1].group[06].group[2]"
      parts:
      - name: overview
        prose: |-
          # System-specific security documentation

          System-specific security documentation, such as a system security plan, incident response plan, continuous monitoring plan, security assessment report, and plan of action and milestones, supports the accurate and consistent application of policies, processes and procedures for systems. As such, it is important that they are developed by personnel with a good understanding of business requirements, technologies being used and cyber security matters.

          System-specific security documentation may be presented in a number of formats, including in wikis or other forms of document repositories. Furthermore, depending on the documentation framework used, details common to multiple systems could be consolidated into higher level security documentation.

          # Further information

          To assist with the development of system-specific security documentation, a system security plan annex template, and an equivalent cloud controls matrix template, are available from the Australian Cyber Security Centre’s
          [Information Security Manual](#e7ce6e23-4bbb-45c1-a657-7e563c0837ed) webpage.
      groups:
      - title: System security plan
        props:
        - name: sort-id
          value: "catalog[1].group[06].group[2].group[1]"
        parts:
        - name: overview
          prose: |-
            The system security plan provides a description of a system and includes an annex that describes the controls that have been identified for the system.

            There can be many stakeholders involved in developing and maintaining a system security plan. This can include representatives from:

            * cyber security teams
            * project teams who deliver the capability (including contractors)
            * support teams who operate and support the capability
            * data owners for data processed, stored or communicated by the system
            * users for whom the capability is being developed.
        controls:
        - id: ism-0041
          class: ISM-control
          title: "Control: ism-0041"
          props:
          - name: sort-id
            value: "catalog[1].group[06].group[2].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0041_smt
            name: statement
            prose: Systems have a system security plan that includes a description of the system and an annex that covers both applicable controls from this document and any additional controls that have been identified.
      - title: Incident response plan
        props:
        - name: sort-id
          value: "catalog[1].group[06].group[2].group[2]"
        parts:
        - name: overview
          prose: "Having an incident response plan ensures that when a cyber security incident occurs, a plan is in place to respond appropriately to the situation. In most situations, the aim of the response will be to prevent the cyber security incident from escalating, restore any impacted system or data, and preserve any evidence."
        controls:
        - id: ism-0043
          class: ISM-control
          title: "Control: ism-0043"
          props:
          - name: sort-id
            value: "catalog[1].group[06].group[2].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0043_smt
            name: statement
            prose: |-
              Systems have an incident response plan that covers the following:

              * guidelines on what constitutes a cyber security incident
              * the types of cyber security incidents likely to be encountered and the expected response to each type
              * how to report cyber security incidents, internally to an organisation and externally to relevant authorities
              * other parties which need to be informed in the event of a cyber security incident
              * the authority, or authorities, responsible for investigating and responding to cyber security incidents
              * the criteria by which an investigation of a cyber security incident would be requested from a law enforcement agency, the Australian Cyber Security Centre or other relevant authority
              * the steps necessary to ensure the integrity of evidence relating to a cyber security incident
              * system contingency measures or a reference to such details if they are located in a separate document.
      - title: Continuous monitoring plan
        props:
        - name: sort-id
          value: "catalog[1].group[06].group[2].group[3]"
        parts:
        - name: overview
          prose: |-
            A continuous monitoring plan can assist an organisation in proactively identifying, prioritising and responding to security vulnerabilities. Measures to monitor and manage security vulnerabilities in systems can also provide an organisation with a wealth of valuable information about their exposure to cyber threats, as well as assisting them to determine security risks associated with the operation of their systems. Undertaking continuous monitoring activities is important as cyber threats and the effectiveness of controls will change over time.

            Three types of continuous monitoring activities are vulnerability assessments, vulnerability scans and penetration tests. A vulnerability assessment typically consists of a review of a system’s architecture or an in-depth hands-on assessment while a vulnerability scan involves using software tools to conduct automated checks for known security vulnerabilities. In each case, the goal is to identify as many security vulnerabilities as possible. A penetration test however is designed to exercise real-world scenarios in an attempt to achieve a specific goal, such as compromising critical system components or data. Regardless of the continuous monitoring activities chosen, they should be conducted by suitably skilled personnel independent of the system being assessed. Such personnel can be internal to an organisation or from a third party. This ensures that there is no conflict of interest, perceived or otherwise, and that the activities are undertaken in an objective manner.
        controls:
        - id: ism-1163
          class: ISM-control
          title: "Control: ism-1163"
          props:
          - name: sort-id
            value: "catalog[1].group[06].group[2].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "8"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1163_smt
            name: statement
            prose: |-
              Systems have a continuous monitoring plan that includes:

              * conducting vulnerability scans for systems at least monthly
              * conducting vulnerability assessments or penetration tests for systems at least annually
              * analysing identified security vulnerabilities to determine their potential impact
              * implementing mitigations based on risk, effectiveness and cost.
      - title: Security assessment report
        props:
        - name: sort-id
          value: "catalog[1].group[06].group[2].group[4]"
        parts:
        - name: overview
          prose: "At the conclusion of a security assessment for a system, a security assessment report should be produced by the assessor. This will assist the system owner in performing any initial remediation actions as well as guiding the development of the system’s plan of action and milestones."
        controls:
        - id: ism-1563
          class: ISM-control
          title: "Control: ism-1563"
          props:
          - name: sort-id
            value: "catalog[1].group[06].group[2].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1563_smt
            name: statement
            prose: |-
              At the conclusion of a security assessment for a system, a security assessment report is produced by the assessor and covers:

              * the scope of the security assessment
              * the system’s strengths and weaknesses
              * security risks associated with the operation of the system
              * the effectiveness of the implementation of controls
              * any recommended remediation actions.
      - title: Plan of action and milestones
        props:
        - name: sort-id
          value: "catalog[1].group[06].group[2].group[5]"
        parts:
        - name: overview
          prose: "At the conclusion of a security assessment for a system, and after the production of a security assessment report by the assessor, a plan of action and milestones should be produced by the system owner. This will assist with tracking any of the system’s identified weaknesses and recommended remediation actions identified during the security assessment."
        controls:
        - id: ism-1564
          class: ISM-control
          title: "Control: ism-1564"
          props:
          - name: sort-id
            value: "catalog[1].group[06].group[2].group[5].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: May-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1564_smt
            name: statement
            prose: "At the conclusion of a security assessment for a system, a plan of action and milestones is produced by the system owner."
  - title: Guidelines for Physical Security
    props:
    - name: sort-id
      value: "catalog[1].group[07]"
    groups:
    - title: Facilities and systems
      props:
      - name: sort-id
        value: "catalog[1].group[07].group[1]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on the certification and accreditation authorities for physical security can be found in the Attorney-General’s Department (AGD)’s
          [Protective Security Policy Framework](#92679127-f61d-486a-a93e-df2a26dfb07a) (PSPF),
          [Entity facilities](#5424f156-70cd-4ff9-a80e-ff459706bf55) policy.

          Further information on the physical security requirements for specific security zones can be found in AGD’s PSPF,
          [Entity facilities](#5424f156-70cd-4ff9-a80e-ff459706bf55) policy.

          Further information on selecting security zones, security containers and secure rooms for the protection of ICT equipment can be found in AGD’s PSPF,
          [Physical security for entity resources](#6e456a92-f405-4151-88ca-5621aa23519b) policy.

          Further information on emanation security considerations associated with usage of RF devices in SECRET and TOP SECRET areas can be found in the emanation security section of the
          [Guidelines for Communications Infrastructure](#4defa9a8-c5f5-4b39-8b0a-537f14d9d14d).
      groups:
      - title: Physical access to systems
        props:
        - name: sort-id
          value: "catalog[1].group[07].group[1].group[1]"
        parts:
        - name: overview
          prose: |-
            The application of the defence-in-depth principle to the protection of systems is enhanced through the use of successive layers of physical security. The first layer of physical security being the use of a security zone for facilities containing systems.

            Deployable platforms should also meet physical security requirements. Notably, physical security certification authorities dealing with deployable platforms may have specific requirements that supersede the controls in these guidelines. This may include perimeter controls, building standards and manning levels. As such, an organisation implementing deployable platforms should contact their physical security certification authority to seek additional guidance.
        controls:
        - id: ism-0810
          class: ISM-control
          title: "Control: ism-0810"
          props:
          - name: sort-id
            value: "catalog[1].group[07].group[1].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: O
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: P
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0810_smt
            name: statement
            prose: Systems are secured in facilities that meet the requirements for a security zone suitable for their sensitivity or classification.
      - title: "Physical access to servers, network devices and cryptographic equipment"
        props:
        - name: sort-id
          value: "catalog[1].group[07].group[1].group[2]"
        parts:
        - name: overview
          prose: "The second layer of physical security is the use of an additional security zone for a server room or communications room. This is then further supplemented by the use of security containers or secure rooms for the protection of servers, network devices and cryptographic equipment."
        controls:
        - id: ism-1053
          class: ISM-control
          title: "Control: ism-1053"
          props:
          - name: sort-id
            value: "catalog[1].group[07].group[1].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: O
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: P
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1053_smt
            name: statement
            prose: "Servers, network devices and cryptographic equipment are secured in server rooms or communications rooms that meet the requirements for a security zone suitable for their sensitivity or classification."
        - id: ism-1530
          class: ISM-control
          title: "Control: ism-1530"
          props:
          - name: sort-id
            value: "catalog[1].group[07].group[1].group[2].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: O
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: P
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1530_smt
            name: statement
            prose: "Servers, network devices and cryptographic equipment are secured in security containers or secure rooms suitable for their sensitivity or classification taking into account the combination of security zones they reside in."
        - id: ism-0813
          class: ISM-control
          title: "Control: ism-0813"
          props:
          - name: sort-id
            value: "catalog[1].group[07].group[1].group[2].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0813_smt
            name: statement
            prose: "Server rooms, communications rooms, security containers and secure rooms are not left in unsecured states."
        - id: ism-1074
          class: ISM-control
          title: "Control: ism-1074"
          props:
          - name: sort-id
            value: "catalog[1].group[07].group[1].group[2].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1074_smt
            name: statement
            prose: "Keys or equivalent access mechanisms to server rooms, communications rooms, security containers and secure rooms are appropriately controlled."
      - title: Physical access to network devices in public areas
        props:
        - name: sort-id
          value: "catalog[1].group[07].group[1].group[3]"
        parts:
        - name: overview
          prose: |-
            Unprotected network devices in public areas could lead to accidental or deliberate physical damage resulting in an interruption of services. Alternatively, unauthorised access to network devices may allow an adversary to reset them to factory default settings, thereby removing any controls, or connect directly to them in order to bypass network access controls. Even if access to network devices is not gained by resetting them to factory default settings, it is highly likely that it will cause an interruption of services.

            Physical access to network devices can be restricted through the implementation of physical security, such as using enclosures that prevent access to their console ports and factory reset buttons, mounting them on ceilings or behind walls, or securing them in security containers.
        controls:
        - id: ism-1296
          class: ISM-control
          title: "Control: ism-1296"
          props:
          - name: sort-id
            value: "catalog[1].group[07].group[1].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1296_smt
            name: statement
            prose: Physical security is implemented to protect network devices in public areas from physical damage or unauthorised access.
      - title: Bringing Radio Frequency and infrared devices into facilities
        props:
        - name: sort-id
          value: "catalog[1].group[07].group[1].group[4]"
        parts:
        - name: overview
          prose: |-
            Radio Frequency (RF) devices, such as mobile devices, wireless keyboards and Bluetooth devices, as well as infrared (IR) devices, can pose a security risk to an organisation, especially when they are capable of recording or transmitting audio or data. In SECRET and TOP SECRET areas, it is important that an organisation understands the security risks associated with the introduction of RF and IR devices and develop, implement and maintain a register of those that have been authorised for use in such environments.

            In deciding which RF or IR devices to authorise to be brought into SECRET and TOP SECRET areas, an organisation should consider any mitigating measures already in place, such as whether IR communications would be prevented from travelling outside secured spaces, whether systems of different sensitives or classifications are used in the same spaces, and if any temporary or permanent method of blocking RF or IR transmissions has been applied to the facility.
        controls:
        - id: ism-1543
          class: ISM-control
          title: "Control: ism-1543"
          props:
          - name: sort-id
            value: "catalog[1].group[07].group[1].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1543_smt
            name: statement
            prose: "An authorised RF and IR device register for SECRET and TOP SECRET areas is developed, implemented, maintained and verified on a regular basis."
        - id: ism-0225
          class: ISM-control
          title: "Control: ism-0225"
          props:
          - name: sort-id
            value: "catalog[1].group[07].group[1].group[4].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0225_smt
            name: statement
            prose: Unauthorised RF and IR devices are not brought into SECRET and TOP SECRET areas.
        - id: ism-0829
          class: ISM-control
          title: "Control: ism-0829"
          props:
          - name: sort-id
            value: "catalog[1].group[07].group[1].group[4].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0829_smt
            name: statement
            prose: Security measures are used to detect and respond to unauthorised RF devices in SECRET and TOP SECRET areas.
      - title: Preventing observation by unauthorised people
        props:
        - name: sort-id
          value: "catalog[1].group[07].group[1].group[5]"
        parts:
        - name: overview
          prose: "Without sufficient perimeter security, the inside of a facility is often observable by unauthorised people, such as via direct observation or by using equipment with a telephoto lens. Ensuring systems, in particular workstation displays and keyboards, are not visible through windows, such as via the use of blinds, curtains, privacy films or workstation positioning, will assist in reducing this security risk."
        controls:
        - id: ism-0164
          class: ISM-control
          title: "Control: ism-0164"
          props:
          - name: sort-id
            value: "catalog[1].group[07].group[1].group[5].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0164_smt
            name: statement
            prose: "Unauthorised people are prevented from observing systems, in particular workstation displays and keyboards, within facilities."
    - title: ICT equipment and media
      props:
      - name: sort-id
        value: "catalog[1].group[07].group[2]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on the handling of ICT equipment can be found in the ICT equipment usage section of the
          [Guidelines for ICT Equipment](#db2e237c-2dbc-4a1f-bae7-9cb63a1f1dc3).

          Further information on the handling of media can be found in the media usage section of the
          [Guidelines for Media](#b594c9c0-b42f-4f06-b643-38023275a5c7).

          Further information on encrypting media can be found in the cryptographic fundamentals section of the
          [Guidelines for Cryptography](#195abe87-bb1e-4006-8b42-eaecca4d51f1).

          Further information on selecting security zones, security containers and secure rooms for the protection of ICT equipment can be found in AGD’s PSPF,
          [Physical security for entity resources](#6e456a92-f405-4151-88ca-5621aa23519b) policy.
      groups:
      - title: Securing ICT equipment and media
        props:
        - name: sort-id
          value: "catalog[1].group[07].group[2].group[1]"
        parts:
        - name: overview
          prose: |-
            ICT equipment and media needs to be secured when not in use. This can be achieved by implementing one of the following approaches:

            * securing ICT equipment and media in an appropriate security container or secure room
            * using ICT equipment without hard drives and sanitising memory at shut down
            * encrypting hard drives of ICT equipment and sanitising memory at shut down
            * sanitising memory of ICT equipment at shut down and removing and securing any hard drives.

            If none of the above approaches are feasible, an organisation may wish to minimise the potential impact of not securing ICT equipment when not in use. This can be achieved by preventing sensitive or classified data from being stored on hard drives, storing user profiles and documents on network shares, removing temporary user data at logoff, scrubbing virtual memory at shut down, and sanitising memory at shut down. It should be noted though that there is no guarantee that such measures will always work effectively or will not be bypassed due to unexpected circumstances, such as the loss of power. Therefore, hard drives in such cases will retain their sensitivity or classification for the purposes of reuse, reclassification, declassification, sanitisation, destruction and disposal.
        controls:
        - id: ism-0161
          class: ISM-control
          title: "Control: ism-0161"
          props:
          - name: sort-id
            value: "catalog[1].group[07].group[2].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0161_smt
            name: statement
            prose: ICT equipment and media are secured when not in use.
  - title: Guidelines for Personnel Security
    props:
    - name: sort-id
      value: "catalog[1].group[08]"
    groups:
    - title: Cyber security awareness training
      props:
      - name: sort-id
        value: "catalog[1].group[08].group[1]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on telephone system usage can be found in the telephone systems section of the
          [Guidelines for Communications Systems](#3a7b903b-ed0d-450d-9123-60f6f8fd5dd2).

          Further information on fax machine and multifunction device usage can be found in the fax machines and multifunction devices section of the
          [Guidelines for Communications Systems](#3a7b903b-ed0d-450d-9123-60f6f8fd5dd2).

          Further information on mobile device usage can be found in the mobile device usage section of the
          [Guidelines for Enterprise Mobility](#9a8f5a63-bcd5-45a8-9f9c-974fc796ac95).

          Further information on removable media usage can be found in the media usage section of the
          [Guidelines for Media](#b594c9c0-b42f-4f06-b643-38023275a5c7).

          Further information on email usage can be found in the email usage section of the
          [Guidelines for Email](#ab73fa95-f213-4041-915e-a8ccbdf74331).

          Further information on web usage can be found in the web proxies section of the
          [Guidelines for Gateways](#e8bde527-526c-4a6a-b66f-05228f09dd7b).

          Further information on detecting socially engineered messages be found in the Australian Cyber Security Centre (ACSC)’s
          [Detecting Socially Engineered Messages](#efddc783-51dc-48ac-a53e-a5dd56c17fd0) publication.

          Further information on business email compromise can be found in the ACSC’s
          [Protecting Against Business Email Compromise](#98951624-a06e-4d9a-96a3-f89ac944bcaa) publication.

          Further information on the use of social media can be found in the ACSC’s
          [Security Tips for Social Media and Messaging Apps](#c78caaed-9931-4197-b21e-bc4e9979a51a) publication.

          Further information on the sanitisation of documents before posting them to authorised online services can be found in the ACSC’s
          [An Examination of the Redaction Functionality of Adobe Acrobat Pro DC 2017](#c3e69683-1e95-40df-bd1f-f86a3fa3a9c1) publication.

          Further information on
          [reporting cybercrime incidents](#188466f6-be12-49ce-b99a-981e54b1663e) and
          [reporting cyber security incidents](#626d3582-3caf-49d6-89d5-4b8fdbbf1f31) is available from the ACSC.
      groups:
      - title: Providing cyber security awareness training
        props:
        - name: sort-id
          value: "catalog[1].group[08].group[1].group[1]"
        parts:
        - name: overview
          prose: "An organisation should ensure that cyber security awareness training is provided to all personnel in order to assist them in understanding their security responsibilities. Furthermore, the content of cyber security awareness training should be tailored to the needs of specific groups of personnel. For example, personnel with responsibilities beyond that of a normal user will require tailored privileged user training."
        controls:
        - id: ism-0252
          class: ISM-control
          title: "Control: ism-0252"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[1].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0252_smt
            name: statement
            prose: |-
              Cyber security awareness training is undertaken annually by all personnel and covers:

              * the purpose of the cyber security awareness training
              * security appointments and contacts
              * authorised use of systems and their resources
              * protection of systems and their resources
              * reporting of cyber security incidents and suspected compromises of systems and their resources.
        - id: ism-1565
          class: ISM-control
          title: "Control: ism-1565"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[1].group[1].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1565_smt
            name: statement
            prose: Tailored privileged user training is undertaken annually by all privileged users.
      - title: Managing and reporting suspicious changes to banking details or payment requests
        props:
        - name: sort-id
          value: "catalog[1].group[08].group[1].group[2]"
        parts:
        - name: overview
          prose: |-
            Business email compromise, a form of financial fraud, is when an adversary attempts to scam an organisation out of money or assets with the assistance of a compromised email account. An adversary will typically attempt to achieve this via invoice fraud, employee impersonation or company impersonation.

            With invoice fraud, an adversary will compromise a vendor’s email account and through it have access to legitimate invoices. The adversary will then edit contact and bank details on invoices and send them to customers with the compromised email account. Customers will then pay the invoices, thinking that they are paying the vendor, but instead be sending money to the adversary’s bank account.

            With employee impersonation, an adversary will compromise an organisation’s email account and impersonate an employee via email. This is then used to commit financial fraud in a number of ways. One common method is to impersonate a person in a position of authority, such as a Chief Executive Officer or Chief Financial Officer, and have a false invoice raised. Another method is to request a change to an employee’s banking details. The funds from the false invoice or the employee’s salary is then sent to the adversary’s bank account.

            With company impersonation, an adversary registers a domain with a name similar to another organisation. The adversary then impersonates that organisation in an email to a vendor and requests a quote for a quantity of expensive assets, such as laptops, and subsequently negotiates for the assets to be delivered to them prior to payment. The assets are then delivered to a location specified by the adversary, with the invoice being sent to the legitimate organisation who never ordered or received the assets.

            To mitigate business email compromise, personnel should be educated to look for the following warning signs:

            * an unexpected request for a change of banking details
            * an urgent payment request, or threats of serious consequences if payment is not made
            * unexpected payment requests from a person in a position of authority, particularly if payment requests are unusual from this person
            * an email received from a suspicious email address, such as an email address not matching an organisation’s name.

            In dealing with such situations, personnel should have clear guidance to verify bank account details; think critically before actioning unusual payment requests; and have a process to report threatening demands for immediate action, pressure for secrecy, or requests to circumvent normal business processes and procedures.
        controls:
        - id: ism-1740
          class: ISM-control
          title: "Control: ism-1740"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[1].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1740_smt
            name: statement
            prose: "Personnel dealing with banking details and payment requests are advised of what business email compromise is, how to manage such situations and how to report it."
      - title: Reporting suspicious contact via online services
        props:
        - name: sort-id
          value: "catalog[1].group[08].group[1].group[3]"
        parts:
        - name: overview
          prose: "Online services, such as email, internet forums, messaging apps and direct messaging on social media, can be used by an adversary in an attempt to elicit sensitive or classified information from personnel. As such, personnel should be advised of what suspicious contact via online services is and how to report it."
        controls:
        - id: ism-0817
          class: ISM-control
          title: "Control: ism-0817"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[1].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jan-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0817_smt
            name: statement
            prose: Personnel are advised of what suspicious contact via online services is and how to report it.
      - title: Posting work information to online services
        props:
        - name: sort-id
          value: "catalog[1].group[08].group[1].group[4]"
        parts:
        - name: overview
          prose: "Personnel should be advised to take special care not to post work information to online services unless authorised to do so, especially in internet forums and on social media. Even information that appears to be benign in isolation could, along with other information, have a considerable security impact. In addition, to ensure that personal opinions of individuals are not misinterpreted, personnel should be advised to maintain separate work and personal accounts for online services, especially when using social media."
        controls:
        - id: ism-0820
          class: ISM-control
          title: "Control: ism-0820"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[1].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jan-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0820_smt
            name: statement
            prose: Personnel are advised to not post work information to unauthorised online services and to report cases where such information is posted.
        - id: ism-1146
          class: ISM-control
          title: "Control: ism-1146"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[1].group[4].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1146_smt
            name: statement
            prose: Personnel are advised to maintain separate work and personal accounts for online services.
      - title: Posting personal information to online services
        props:
        - name: sort-id
          value: "catalog[1].group[08].group[1].group[5]"
        parts:
        - name: overview
          prose: "Personnel should be advised that any personal information they post to online services, such as social media, could be used by an adversary to develop a detailed understanding of their lifestyle and interests. In turn, this information could be used to build trust in order to elicit sensitive or classified information from them, or influence them to undertake specific actions, such as opening malicious email attachments or visiting malicious websites. Furthermore, posting information on movements and activities may allow an adversary to time attempted financial fraud to align with when a person in a position of authority will be uncontactable, such as attending meetings or travelling. Finally, encouraging personnel to use any available privacy settings for online services can reduce security risks by restricting who can view their information as well as their interactions with such services."
        controls:
        - id: ism-0821
          class: ISM-control
          title: "Control: ism-0821"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[1].group[5].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Oct-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0821_smt
            name: statement
            prose: Personnel are advised of security risks associated with posting personal information to online services and are encouraged to use any available privacy settings to restrict who can view such information.
      - title: Sending and receiving files via online services
        props:
        - name: sort-id
          value: "catalog[1].group[08].group[1].group[6]"
        parts:
        - name: overview
          prose: "When personnel send and receive files via unauthorised online services, such as messaging apps and social media, they often bypass controls put in place to detect and quarantine malicious code. Advising personnel to send and receive files via authorised online services instead will ensure files are appropriately protected and scanned for malicious code."
        controls:
        - id: ism-0824
          class: ISM-control
          title: "Control: ism-0824"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[1].group[6].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0824_smt
            name: statement
            prose: Personnel are advised not to send or receive files via unauthorised online services.
    - title: Access to systems and their resources
      props:
      - name: sort-id
        value: "catalog[1].group[08].group[2]"
      parts:
      - name: overview
        prose: |-
          # Security clearances

          Where these guidelines refer to security clearances, it applies to Australian security clearances or security clearances from a foreign government which are formally recognised by Australia.

          # Further information

          Further information on access to government resources, including required security clearances, can be found in the Attorney-General’s Department’s
          [Protective Security Policy Framework](#92679127-f61d-486a-a93e-df2a26dfb07a),
          [Access to information](#3e4cd135-5fa3-4a1e-a192-1793ff42067c) policy.

          Further information on access to highly sensitive government resources, including required briefings, can be found in the Government Security Committee’s Australian Government Security Caveat Guidelines. This publication is available from the Protective Security Policy GovTEAMS community or the Australian Security Intelligence Organisation by email.

          Further information on restricting the use of privileged accounts can be found in the ACSC’s
          [Restricting Administrative Privileges](#3ccea9a8-a728-4f5b-a0a8-43f2f206f76b) publication.

          Further information on administering systems and applications can be found in the system administration section of the
          [Guidelines for System Management](#c6ca6620-ccd5-4c5d-b97c-9d92f1162948).

          Further information on event logging can be found in the event logging and monitoring section of the
          [Guidelines for System Monitoring](#edc24216-f52b-4513-bcda-5fa564661999).
      groups:
      - title: System access requirements
        props:
        - name: sort-id
          value: "catalog[1].group[08].group[2].group[01]"
        parts:
        - name: overview
          prose: "Documenting access requirements for a system and its resources can assist in determining if personnel have the appropriate authorisation, security clearance, briefings and need-to-know to access the system and its resources. Types of users for which access requirements should be documented include unprivileged users, privileged users, foreign nationals and contractors."
        controls:
        - id: ism-0432
          class: ISM-control
          title: "Control: ism-0432"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[01].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0432_smt
            name: statement
            prose: Access requirements for a system and its resources are documented in its system security plan.
        - id: ism-0434
          class: ISM-control
          title: "Control: ism-0434"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[01].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0434_smt
            name: statement
            prose: "Personnel undergo appropriate employment screening and, where necessary, hold an appropriate security clearance before being granted access to a system and its resources."
        - id: ism-0435
          class: ISM-control
          title: "Control: ism-0435"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[01].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Aug-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0435_smt
            name: statement
            prose: Personnel receive any necessary briefings before being granted access to a system and its resources.
      - title: User identification
        props:
        - name: sort-id
          value: "catalog[1].group[08].group[2].group[02]"
        parts:
        - name: overview
          prose: "Having uniquely identifiable users ensures accountability for access to a system and its resources. Furthermore, where a system processes, stores or communicates Australian Eyes Only (AUSTEO), Australian Government Access Only (AGAO) or Releasable To (REL) data, and foreign nationals have access to the system, it is important that the foreign nationals are identified as such."
        controls:
        - id: ism-0414
          class: ISM-control
          title: "Control: ism-0414"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[02].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Aug-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0414_smt
            name: statement
            prose: Personnel granted access to a system and its resources are uniquely identifiable.
        - id: ism-0415
          class: ISM-control
          title: "Control: ism-0415"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[02].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Aug-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0415_smt
            name: statement
            prose: "The use of shared user accounts is strictly controlled, and personnel using such accounts are uniquely identifiable."
        - id: ism-1583
          class: ISM-control
          title: "Control: ism-1583"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[02].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Aug-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1583_smt
            name: statement
            prose: Personnel who are contractors are identified as such.
        - id: ism-0420
          class: ISM-control
          title: "Control: ism-0420"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[02].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "11"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0420_smt
            name: statement
            prose: "Where a system processes, stores or communicates AUSTEO, AGAO or REL data, personnel who are foreign nationals are identified as such, including by their specific nationality."
      - title: Unprivileged access to systems
        props:
        - name: sort-id
          value: "catalog[1].group[08].group[2].group[03]"
        parts:
        - name: overview
          prose: |-
            Personnel seeking access to systems, applications and data repositories should have a genuine business requirement validated by their manager or another appropriate authority.

            In addition, unprivileged access event logs can assist in monitoring the security posture of systems, detecting malicious behaviour and contributing to investigations following cyber security incidents. To facilitate such activities, unprivileged access event logs should be captured and stored centrally.
        controls:
        - id: ism-0405
          class: ISM-control
          title: "Control: ism-0405"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[03].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0405_smt
            name: statement
            prose: "Requests for unprivileged access to systems, applications and data repositories are validated when first requested."
        - id: ism-1566
          class: ISM-control
          title: "Control: ism-1566"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[03].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1566_smt
            name: statement
            prose: Use of unprivileged access is logged.
        - id: ism-1714
          class: ISM-control
          title: "Control: ism-1714"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[03].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1714_smt
            name: statement
            prose: Unprivileged access event logs are stored centrally.
      - title: Unprivileged access to systems by foreign nationals
        props:
        - name: sort-id
          value: "catalog[1].group[08].group[2].group[04]"
        parts:
        - name: overview
          prose: "Due to the extra sensitivities associated with AUSTEO, AGAO and REL data, foreign access to such data is strictly controlled."
        controls:
        - id: ism-0409
          class: ISM-control
          title: "Control: ism-0409"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[04].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "8"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0409_smt
            name: statement
            prose: "Foreign nationals, including seconded foreign nationals, do not have access to systems that process, store or communicate AUSTEO or REL data unless effective controls are in place to ensure such data is not accessible to them."
        - id: ism-0411
          class: ISM-control
          title: "Control: ism-0411"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[04].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0411_smt
            name: statement
            prose: "Foreign nationals, excluding seconded foreign nationals, do not have access to systems that process, store or communicate AGAO data unless effective controls are in place to ensure such data is not accessible to them."
      - title: Privileged access to systems
        props:
        - name: sort-id
          value: "catalog[1].group[08].group[2].group[05]"
        parts:
        - name: overview
          prose: |-
            Privileged accounts are considered to be those which can alter or circumvent a system’s controls. This can also apply to users who have only limited privileges, such as software developers, but can still bypass controls. A privileged account often has the ability to modify system configurations, account privileges, event logs and security configurations for applications.

            Privileged users, and in some cases privileged service accounts, are often targeted by an adversary as they can potentially give full access to systems. As such, ensuring that privileged accounts do not have the ability to access the internet, email and web services minimises opportunities for these accounts to be compromised.

            Finally, privileged access event logs, privileged account management event logs and privileged group management logs can assist in monitoring the security posture of systems, detecting malicious behaviour and contributing to investigations following cyber security incidents. To facilitate such activities, privileged access event logs, privileged account management event logs and privileged group management logs should be captured and stored centrally.
        controls:
        - id: ism-1507
          class: ISM-control
          title: "Control: ism-1507"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[05].control[01]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1507_smt
            name: statement
            prose: Requests for privileged access to systems and applications are validated when first requested.
        - id: ism-1733
          class: ISM-control
          title: "Control: ism-1733"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[05].control[02]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1733_smt
            name: statement
            prose: Requests for privileged access to data repositories are validated when first requested.
        - id: ism-1508
          class: ISM-control
          title: "Control: ism-1508"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[05].control[03]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1508_smt
            name: statement
            prose: Privileged access to systems and applications is limited to only what is required for users and services to undertake their duties.
        - id: ism-1175
          class: ISM-control
          title: "Control: ism-1175"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[05].control[04]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1175_smt
            name: statement
            prose: "Privileged user accounts are prevented from accessing the internet, email and web services."
        - id: ism-1653
          class: ISM-control
          title: "Control: ism-1653"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[05].control[05]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1653_smt
            name: statement
            prose: "Privileged service accounts are prevented from accessing the internet, email and web services."
        - id: ism-1649
          class: ISM-control
          title: "Control: ism-1649"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[05].control[06]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1649_smt
            name: statement
            prose: Just-in-time administration is used for administering systems and applications.
        - id: ism-0445
          class: ISM-control
          title: "Control: ism-0445"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[05].control[07]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0445_smt
            name: statement
            prose: Privileged users are assigned a dedicated privileged account to be used solely for tasks requiring privileged access.
        - id: ism-1263
          class: ISM-control
          title: "Control: ism-1263"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[05].control[08]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1263_smt
            name: statement
            prose: Unique privileged accounts are used for administering individual server applications.
        - id: ism-1509
          class: ISM-control
          title: "Control: ism-1509"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[05].control[09]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1509_smt
            name: statement
            prose: Privileged access events are logged.
        - id: ism-1651
          class: ISM-control
          title: "Control: ism-1651"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[05].control[10]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1651_smt
            name: statement
            prose: Privileged access event logs are stored centrally.
        - id: ism-1650
          class: ISM-control
          title: "Control: ism-1650"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[05].control[11]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1650_smt
            name: statement
            prose: Privileged account and group management events are logged.
        - id: ism-1652
          class: ISM-control
          title: "Control: ism-1652"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[05].control[12]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1652_smt
            name: statement
            prose: Privileged account and group management event logs are stored centrally.
      - title: Privileged access to systems by foreign nationals
        props:
        - name: sort-id
          value: "catalog[1].group[08].group[2].group[06]"
        parts:
        - name: overview
          prose: "As privileged accounts often have the ability to bypass a system’s controls, it is strongly encouraged that foreign nationals are not given privileged access to systems that process, store or communicate AUSTEO, AGAO or REL data."
        controls:
        - id: ism-0446
          class: ISM-control
          title: "Control: ism-0446"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[06].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0446_smt
            name: statement
            prose: "Foreign nationals, including seconded foreign nationals, do not have privileged access to systems that process, store or communicate AUSTEO or REL data."
        - id: ism-0447
          class: ISM-control
          title: "Control: ism-0447"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[06].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0447_smt
            name: statement
            prose: "Foreign nationals, excluding seconded foreign nationals, do not have privileged access to systems that process, store or communicate AGAO data."
      - title: Suspension of access to systems
        props:
        - name: sort-id
          value: "catalog[1].group[08].group[2].group[07]"
        parts:
        - name: overview
          prose: "Removing or suspending access to systems, applications and data repositories can prevent them from being accessed when there is no longer a legitimate business requirement for their use, such as when personnel change duties, leave an organisation or are detected undertaking malicious activities."
        controls:
        - id: ism-0430
          class: ISM-control
          title: "Control: ism-0430"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[07].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0430_smt
            name: statement
            prose: "Access to systems, applications and data repositories is removed or suspended on the same day personnel no longer have a legitimate requirement for access."
        - id: ism-1591
          class: ISM-control
          title: "Control: ism-1591"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[07].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Aug-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1591_smt
            name: statement
            prose: "Access to systems, applications and data repositories is removed or suspended as soon as practicable when personnel are detected undertaking malicious activities."
        - id: ism-1404
          class: ISM-control
          title: "Control: ism-1404"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[07].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1404_smt
            name: statement
            prose: Unprivileged access to systems and applications is automatically disabled after 45 days of inactivity.
        - id: ism-1648
          class: ISM-control
          title: "Control: ism-1648"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[07].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1648_smt
            name: statement
            prose: Privileged access to systems and applications is automatically disabled after 45 days of inactivity.
        - id: ism-1716
          class: ISM-control
          title: "Control: ism-1716"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[07].control[5]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1716_smt
            name: statement
            prose: Access to data repositories is automatically disabled after 45 days of inactivity.
        - id: ism-1647
          class: ISM-control
          title: "Control: ism-1647"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[07].control[6]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1647_smt
            name: statement
            prose: Privileged access to systems and applications is automatically disabled after 12 months unless revalidated.
        - id: ism-1734
          class: ISM-control
          title: "Control: ism-1734"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[07].control[7]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1734_smt
            name: statement
            prose: Privileged access to data repositories is automatically disabled after 12 months unless revalidated.
      - title: Recording authorisation for personnel to access systems
        props:
        - name: sort-id
          value: "catalog[1].group[08].group[2].group[08]"
        parts:
        - name: overview
          prose: "Retaining records of system account requests will assist in maintaining personnel accountability. This is needed to ensure there is a record of all personnel authorised to access a system, their user identification, who provided the authorisation, when the authorisation was granted and when the access was last reviewed."
        controls:
        - id: ism-0407
          class: ISM-control
          title: "Control: ism-0407"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[08].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0407_smt
            name: statement
            prose: |-
              A secure record is maintained for the life of each system covering:

              * all personnel authorised to access the system, and their user identification
              * who provided authorisation for access
              * when access was granted
              * the level of access that was granted
              * when access, and the level of access, was last reviewed
              * when the level of access was changed, and to what extent (if applicable)
              * when access was withdrawn (if applicable).
      - title: Temporary access to systems
        props:
        - name: sort-id
          value: "catalog[1].group[08].group[2].group[09]"
        parts:
        - name: overview
          prose: "Under strict circumstances, temporary access to systems, applications or data repositories may be granted to personnel who lack an appropriate security clearance or briefing. In such circumstances, personnel should have their access controlled in such a way that they only have access to data required for them to undertake their duties."
        controls:
        - id: ism-0441
          class: ISM-control
          title: "Control: ism-0441"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[09].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "8"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0441_smt
            name: statement
            prose: "When personnel are granted temporary access to a system, effective controls are put in place to restrict their access to only data required for them to undertake their duties."
        - id: ism-0443
          class: ISM-control
          title: "Control: ism-0443"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[09].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0443_smt
            name: statement
            prose: "Temporary access is not granted to systems that process, store or communicate caveated or sensitive compartmented information."
      - title: Emergency access to systems
        props:
        - name: sort-id
          value: "catalog[1].group[08].group[2].group[10]"
        parts:
        - name: overview
          prose: |-
            It is important that an organisation does not lose access to their systems. As such, an organisation should always have a method for gaining access during emergencies. Typically, emergencies would occur when access to systems cannot be gained via normal authentication processes, such as due to misconfigurations of authentication services, misconfigurations of security settings or due to a cyber security incident. In these situations, a break glass account (also known as an emergency access account) can be used to gain access. As break glass accounts generally have the highest level of privileges available for systems, extreme care should be taken to both protect them and to monitor for any signs of compromise or abuse.

            When break glass accounts are used, any administrative activities performed will not be directly attributable to an individual, and systems may not generate event logs. As such, additional controls need to be implemented in order to maintain the system’s integrity. In doing so, an organisation should ensure that any administrative activities performed using a break glass account are identified and documented in support of change management processes and procedures. This includes documenting the individual using the break glass account, the reason for using the break glass account and any administrative activities performed using the break glass account.

            As the custodian of each break glass account should be the only party who knows the account’s credentials, credentials will need to be changed and tested by custodians after any authorised access by another party. Modern password managers that support automated credential changes and testing can assist in reducing the administrative overhead of such activities.

            Finally, break glass event logs can assist in monitoring the security posture of systems, detecting malicious behaviour and contributing to investigations following cyber security incidents. To facilitate such activities, break glass event logs should be captured and stored centrally.
        controls:
        - id: ism-1610
          class: ISM-control
          title: "Control: ism-1610"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[10].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Aug-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1610_smt
            name: statement
            prose: A method of emergency access to systems is documented and tested at least once when initially implemented and each time fundamental information technology infrastructure changes occur.
        - id: ism-1611
          class: ISM-control
          title: "Control: ism-1611"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[10].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Aug-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1611_smt
            name: statement
            prose: Break glass accounts are only used when normal authentication processes cannot be used.
        - id: ism-1612
          class: ISM-control
          title: "Control: ism-1612"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[10].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Aug-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1612_smt
            name: statement
            prose: Break glass accounts are only used for specific authorised activities.
        - id: ism-1614
          class: ISM-control
          title: "Control: ism-1614"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[10].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Aug-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1614_smt
            name: statement
            prose: Break glass account credentials are changed by the account custodian after they are accessed by any other party.
        - id: ism-1615
          class: ISM-control
          title: "Control: ism-1615"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[10].control[5]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Aug-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1615_smt
            name: statement
            prose: Break glass accounts are tested after credentials are changed.
        - id: ism-1613
          class: ISM-control
          title: "Control: ism-1613"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[10].control[6]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1613_smt
            name: statement
            prose: Use of break glass accounts is logged.
        - id: ism-1715
          class: ISM-control
          title: "Control: ism-1715"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[10].control[7]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1715_smt
            name: statement
            prose: Break glass event logs are stored centrally.
      - title: Control of Australian systems
        props:
        - name: sort-id
          value: "catalog[1].group[08].group[2].group[11]"
        parts:
        - name: overview
          prose: "Due to extra sensitivities associated with AUSTEO and AGAO data, it is essential that control of systems that process, store or communicate such data are maintained by Australian nationals working for or on behalf of the Australian Government. Furthermore, AUSTEO and AGAO data should only be accessible from systems under the sole control of the Australian Government that are located within facilities authorised by the Australian Government."
        controls:
        - id: ism-0078
          class: ISM-control
          title: "Control: ism-0078"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[11].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0078_smt
            name: statement
            prose: "Systems processing, storing or communicating AUSTEO or AGAO data remain at all times under the control of an Australian national working for or on behalf of the Australian Government."
        - id: ism-0854
          class: ISM-control
          title: "Control: ism-0854"
          props:
          - name: sort-id
            value: "catalog[1].group[08].group[2].group[11].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0854_smt
            name: statement
            prose: AUSTEO and AGAO data can only be accessed from systems under the sole control of the Australian Government that are located within facilities authorised by the Australian Government.
  - title: Guidelines for Communications Infrastructure
    props:
    - name: sort-id
      value: "catalog[1].group[09]"
    groups:
    - title: Cabling infrastructure
      props:
      - name: sort-id
        value: "catalog[1].group[09].group[1]"
      parts:
      - name: overview
        prose: |-
          # Applicability

          This section is only applicable to facilities located within Australia. In addition, this section only applies to new cabling infrastructure installations or upgrades.

          # Shared facilities

          In addition to common controls, this section provides additional controls for shared facilities, such as a single floor, or part of a floor, within a multi-tenanted building.

          # Cables and structured cabling systems

          For the purposes of this section, a cable is defined as any fibre optic or copper material housed within a protective sheath for the purposes of transmitting data or control signals from one point in a facility to another. Each cable will form part of a structured cabling system and will need to comply with the Australian Standards associated with that system. In addition to network communications and data systems, some common building management structured cabling systems found within facilities are:

          * fire control and sensor systems
          * security control and surveillance systems
          * lighting control systems
          * access control systems
          * voice and emergency telephony systems
          * emergency control alert systems.

          # Cable sheaths and conduits

          A cable’s protective sheath is not considered to be a conduit.

          # Cable connector types

          The same cable connector types can be used for all systems within a facility regardless of their sensitivity or classification.

          # Further information

          [Australian cabling standards and regulations](#7000d51a-6cca-40a0-95d9-f1f15048ea68) can be obtained from the Australian Communications and Media Authority.

          Further information on SCEC-approved tamper-evident seals can be found on the SCEC’s
          [Security Equipment Evaluated Products List](#f7e13f7b-eb48-4294-bd01-9c22c756d96b).

          Further information on audio secure rooms can be found in the Attorney-General’s Department’s
          [Protective Security Policy Framework](#92679127-f61d-486a-a93e-df2a26dfb07a),
          [Physical security for entity resources](#6e456a92-f405-4151-88ca-5621aa23519b) policy.
      groups:
      - title: Cabling infrastructure standards
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[1].group[01]"
        parts:
        - name: overview
          prose: Cabling infrastructure should be installed by an endorsed cable installer to the relevant Australian Standards to ensure personnel safety and system availability.
        controls:
        - id: ism-0181
          class: ISM-control
          title: "Control: ism-0181"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[01].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0181_smt
            name: statement
            prose: "Cabling infrastructure is installed in accordance with relevant Australian Standards, as directed by the Australian Communications and Media Authority."
      - title: Use of fibre-optic cables
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[1].group[02]"
        parts:
        - name: overview
          prose: "Fibre-optic cables do not produce, nor are influenced by, electromagnetic emanations; thereby offering the highest degree of protection from electromagnetic emanation effects."
        controls:
        - id: ism-1111
          class: ISM-control
          title: "Control: ism-1111"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[02].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1111_smt
            name: statement
            prose: Fibre-optic cables are used for cabling infrastructure instead of copper cables.
      - title: Cable register
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[1].group[03]"
        parts:
        - name: overview
          prose: "Developing, implementing, maintaining and regularly verifying cable registers assists installers and inspectors, with the help of floor plan diagrams, to trace cables for malicious or accidental changes or damage. In doing so, cable registers should track all cabling changes throughout the life of a system."
        controls:
        - id: ism-0211
          class: ISM-control
          title: "Control: ism-0211"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[03].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0211_smt
            name: statement
            prose: "A cable register is developed, implemented, maintained and verified on a regular basis."
        - id: ism-0208
          class: ISM-control
          title: "Control: ism-0208"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[03].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0208_smt
            name: statement
            prose: |-
              A cable register contains the following for each cable:

              * cable identifier
              * cable colour
              * sensitivity/classification
              * source
              * destination
              * location
              * seal numbers (if applicable).
      - title: Floor plan diagrams
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[1].group[04]"
        parts:
        - name: overview
          prose: "Floor plan diagrams, developed using computer-aided design and drafting software, and using alphanumeric grid referencing, provide an accurate scaled view for each floor and are critical to ensuring that cabling infrastructure components can be easily located by installers and inspectors. In doing so, floor plan diagrams should track all cabling infrastructure changes throughout the life of a system."
        controls:
        - id: ism-1645
          class: ISM-control
          title: "Control: ism-1645"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[04].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1645_smt
            name: statement
            prose: "Floor plan diagrams are developed, implemented, maintained and verified on a regular basis."
        - id: ism-1646
          class: ISM-control
          title: "Control: ism-1646"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[04].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1646_smt
            name: statement
            prose: |-
              Floor plan diagrams contain the following:

              * cable paths (including ingress and egress points between floors)
              * cable reticulation system and conduit paths
              * floor concentration boxes
              * wall outlet boxes
              * network cabinets.
      - title: Cable labelling processes and procedures
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[1].group[05]"
        parts:
        - name: overview
          prose: Well documented cable labelling processes and procedures can make cable verification and fault finding easier.
        controls:
        - id: ism-0206
          class: ISM-control
          title: "Control: ism-0206"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[05].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0206_smt
            name: statement
            prose: "Cable labelling processes, and supporting cable labelling procedures, are developed, implemented and maintained."
      - title: Labelling cables
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[1].group[06]"
        parts:
        - name: overview
          prose: Labelling cables with the correct source and destination details minimises the likelihood of cross-patching and aids in fault finding and configuration management.
        controls:
        - id: ism-1096
          class: ISM-control
          title: "Control: ism-1096"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[06].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Oct-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1096_smt
            name: statement
            prose: Cables are labelled at each end with sufficient source and destination details to enable the physical identification and inspection of the cable.
      - title: Labelling building management cables
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[1].group[07]"
        parts:
        - name: overview
          prose: "All facilities will contain structured cabling systems to support building management and control functions. As Australian Standards require some structured cabling systems to use specified colours, such as red for fire control systems, it is important that all building management cables are appropriately labelled."
        controls:
        - id: ism-1639
          class: ISM-control
          title: "Control: ism-1639"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[07].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1639_smt
            name: statement
            prose: "Building management cables are labelled with their purpose in black writing on a yellow background, with a minimum size of 2.5 cm x 1 cm, and attached at five-metre intervals."
      - title: Labelling cables for foreign systems in Australian facilities
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[1].group[08]"
        parts:
        - name: overview
          prose: Labelling cables for foreign systems in Australian facilities helps prevent unintended cross-patching of Australian and foreign systems.
        controls:
        - id: ism-1640
          class: ISM-control
          title: "Control: ism-1640"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[08].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1640_smt
            name: statement
            prose: Cables for foreign systems installed in Australian facilities are labelled at inspection points.
      - title: Cable colours
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[1].group[09]"
        parts:
        - name: overview
          prose: "To avoid confusion, it is important that, regardless of the type of cabling involved, a consistent cable colour is used. Furthermore, the use of designated cable colours can provide an easy way to distinguish cables for SECRET and TOP SECRET systems from cables for other systems. For example, while SECRET and TOP SECRET cables have designated cable colours, cables for other systems may be any colour except for those reserved for SECRET and TOP SECRET systems. In addition, cable colours for other systems, such as OFFICIAL and PROTECTED systems, may use the same colour, such as blue."
        controls:
        - id: ism-1820
          class: ISM-control
          title: "Control: ism-1820"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[09].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1820_smt
            name: statement
            prose: Cables for individual systems use a consistent colour.
        - id: ism-1719
          class: ISM-control
          title: "Control: ism-1719"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[09].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1719_smt
            name: statement
            prose: TOP SECRET cables are coloured red.
      - title: Cable colour non-conformance
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[1].group[10]"
        parts:
        - name: overview
          prose: "In certain circumstances it may not be possible to use the correct colour for SECRET or TOP SECRET cables. In such cases, an organisation should band such cables with the appropriate colour and ensure that the cable bands are easily visible at inspection points. In doing so, it is important that cable bands are robust enough to stand the test of time. Examples of appropriate cable bands include stick-on coloured labels, colour heat shrink, coloured ferrules or short lengths of banded conduit."
        controls:
        - id: ism-1216
          class: ISM-control
          title: "Control: ism-1216"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[10].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1216_smt
            name: statement
            prose: SECRET and TOP SECRET cables with non-conformant cable colouring are both banded with the appropriate colour and labelled at inspection points.
      - title: Cable inspectability
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[1].group[11]"
        parts:
        - name: overview
          prose: "The ability to inspect cabling infrastructure is necessary to detect illicit tampering or degradation. Note, this does not necessarily mean that cables need to be fully visible all the time. Rather, cable inspectability can still be achieved as long as cables can be viewed and inspected through the easy removal of ceiling, floor or wall panels or manholes."
        controls:
        - id: ism-1112
          class: ISM-control
          title: "Control: ism-1112"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[11].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1112_smt
            name: statement
            prose: Cables are inspectable at a minimum of five-metre intervals.
        - id: ism-1119
          class: ISM-control
          title: "Control: ism-1119"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[11].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1119_smt
            name: statement
            prose: Cables in TOP SECRET areas are fully inspectable for their entire length.
      - title: Common cable bundles and conduits
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[1].group[12]"
        parts:
        - name: overview
          prose: "In some circumstances, cables for different systems can be bundled together or run in a common conduit in order to reduce costs, such as cables for OFFICIAL and PROTECTED systems."
        controls:
        - id: ism-1821
          class: ISM-control
          title: "Control: ism-1821"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[12].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1821_smt
            name: statement
            prose: "TOP SECRET cables, when bundled together or run in conduit, are run exclusively in their own individual cable bundle or conduit."
      - title: Common cable reticulation systems
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[1].group[13]"
        parts:
        - name: overview
          prose: "When cable reticulation systems are used for more than one cable bundle or conduit, it is important that there is a dividing partition or visible gap between cable bundles and conduits to facilitate easier cable inspection."
        controls:
        - id: ism-1114
          class: ISM-control
          title: "Control: ism-1114"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[13].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1114_smt
            name: statement
            prose: Cable bundles or conduits sharing a common cable reticulation system have a dividing partition or visible gap between each cable bundle and conduit.
      - title: Enclosed cable reticulation systems
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[1].group[14]"
        parts:
        - name: overview
          prose: "In shared facilities, cables should be enclosed in a sealed cable reticulation system to prevent access and enhance cable management."
        controls:
        - id: ism-1130
          class: ISM-control
          title: "Control: ism-1130"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[14].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1130_smt
            name: statement
            prose: "In shared facilities, cables are run in an enclosed cable reticulation system."
      - title: Covers for enclosed cable reticulation systems
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[1].group[15]"
        parts:
        - name: overview
          prose: "In shared facilities, clear covers on enclosed cable reticulation systems are a convenient method of maintaining inspection requirements. Having clear covers face inwards increases their inspectability."
        controls:
        - id: ism-1164
          class: ISM-control
          title: "Control: ism-1164"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[15].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1164_smt
            name: statement
            prose: "In shared facilities, conduits or the front covers of ducts, cable trays in floors and ceilings, and associated fittings are clear plastic."
      - title: Sealing cable reticulation systems and conduits
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[1].group[16]"
        parts:
        - name: overview
          prose: "In shared facilities, uniquely identifiable Security Construction and Equipment Committee (SCEC)-approved tamper-evident seals should be used to provide evidence of any tampering or illicit access to TOP SECRET cable reticulation systems. In addition, TOP SECRET conduits should be sealed with a visible smear of conduit glue to prevent access."
        controls:
        - id: ism-0195
          class: ISM-control
          title: "Control: ism-0195"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[16].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0195_smt
            name: statement
            prose: "In shared facilities, uniquely identifiable SCEC-approved tamper-evident seals are used to seal all removable covers on TOP SECRET cable reticulation systems."
        - id: ism-0194
          class: ISM-control
          title: "Control: ism-0194"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[16].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0194_smt
            name: statement
            prose: "In shared facilities, a visible smear of conduit glue is used to seal all plastic conduit joints and TOP SECRET conduits connected by threaded lock nuts."
      - title: Labelling conduits
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[1].group[17]"
        parts:
        - name: overview
          prose: Labels for TOP SECRET conduits should be of sufficient size and colour to allow for easy identification.
        controls:
        - id: ism-0201
          class: ISM-control
          title: "Control: ism-0201"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[17].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0201_smt
            name: statement
            prose: "Labels for TOP SECRET conduits are a minimum size of 2.5 cm x 1 cm, attached at five-metre intervals and marked as ‘TS RUN’."
      - title: Cables in walls
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[1].group[18]"
        parts:
        - name: overview
          prose: Cables run correctly in walls allow for neater installations while maintaining separation and inspection requirements.
        controls:
        - id: ism-1115
          class: ISM-control
          title: "Control: ism-1115"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[18].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1115_smt
            name: statement
            prose: Cables from cable trays to wall outlet boxes are run in flexible or plastic conduit.
      - title: Cables in party walls
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[1].group[19]"
        parts:
        - name: overview
          prose: "In shared facilities, TOP SECRET cables are not run in party walls. However, an inner wall can be used to run TOP SECRET cables where sufficient space exists for their inspection."
        controls:
        - id: ism-1133
          class: ISM-control
          title: "Control: ism-1133"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[19].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1133_smt
            name: statement
            prose: "In shared facilities, TOP SECRET cables are not run in party walls."
      - title: Wall penetrations
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[1].group[20]"
        parts:
        - name: overview
          prose: "Penetrating a wall between a TOP SECRET area and a lower classified area requires the integrity of the TOP SECRET area to be maintained. In such scenarios, TOP SECRET cables should be encased in conduit with all gaps between the TOP SECRET conduit and the wall filled with an appropriate sealing compound."
        controls:
        - id: ism-1122
          class: ISM-control
          title: "Control: ism-1122"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[20].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1122_smt
            name: statement
            prose: "Where wall penetrations exit a TOP SECRET area into a lower classified area, TOP SECRET cables are encased in conduit with all gaps between the TOP SECRET conduit and the wall filled with an appropriate sealing compound."
      - title: Wall outlet boxes
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[1].group[21]"
        parts:
        - name: overview
          prose: Wall outlet boxes are the main method of connecting cabling infrastructure to workstations. They allow the management of cables and the types of connectors allocated to various systems.
        controls:
        - id: ism-1105
          class: ISM-control
          title: "Control: ism-1105"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[21].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1105_smt
            name: statement
            prose: SECRET and TOP SECRET wall outlet boxes contain exclusively SECRET or TOP SECRET cables.
      - title: Labelling wall outlet boxes
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[1].group[22]"
        parts:
        - name: overview
          prose: "Clear labelling of wall outlet boxes diminishes the possibility of incorrectly attaching ICT equipment to the wrong wall outlet box. In cases where a wall outbox contains cables for different systems, each connector should be individually labelled."
        controls:
        - id: ism-1095
          class: ISM-control
          title: "Control: ism-1095"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[22].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1095_smt
            name: statement
            prose: "Wall outlet boxes denote the systems, cable identifiers and wall outlet box identifier."
      - title: Wall outlet box colours
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[1].group[23]"
        parts:
        - name: overview
          prose: "The use of designated wall outlet box colours can provide an easy way to distinguish wall outlet boxes for SECRET and TOP SECRET systems from wall outlet boxes for other systems. For example, while SECRET and TOP SECRET wall outlet boxes have designated wall outlet box colours, wall outlet boxes for other systems may be any colour except for those reserved for SECRET and TOP SECRET systems. In addition, wall outlet box colours for other systems, such as OFFICIAL and PROTECTED systems, may use the same colour, such as blue. Ideally, wall outlet boxes should be the same colour that is used for associated cabling."
        controls:
        - id: ism-1822
          class: ISM-control
          title: "Control: ism-1822"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[23].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1822_smt
            name: statement
            prose: Wall outlet boxes for individual systems use a consistent colour.
        - id: ism-1721
          class: ISM-control
          title: "Control: ism-1721"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[23].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1721_smt
            name: statement
            prose: TOP SECRET wall outlet boxes are coloured red.
      - title: Wall outlet box covers
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[1].group[24]"
        parts:
        - name: overview
          prose: Transparent wall outlet box covers allow for inspection of cable cross-patching and tampering.
        controls:
        - id: ism-1109
          class: ISM-control
          title: "Control: ism-1109"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[24].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1109_smt
            name: statement
            prose: Wall outlet box covers are clear plastic.
      - title: Fly lead installation
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[1].group[25]"
        parts:
        - name: overview
          prose: "Keeping the lengths of TOP SECRET fibre-optic fly leads to a minimum prevents clutter around desks, prevents damage, and reduces the chance of cross-patching and tampering. If lengths become excessive, TOP SECRET fibre-optic fly leads should be treated as cabling infrastructure and run in TOP SECRET conduit or fixed infrastructure, such as desk partitioning."
        controls:
        - id: ism-0218
          class: ISM-control
          title: "Control: ism-0218"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[25].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0218_smt
            name: statement
            prose: "If TOP SECRET fibre-optic fly leads exceeding five metres in length are used to connect wall outlet boxes to ICT equipment, they are run in a protective and easily inspected pathway that is clearly labelled at the ICT equipment end with the wall outlet box’s identifier."
      - title: Connecting cable reticulation systems to cabinets
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[1].group[26]"
        parts:
        - name: overview
          prose: Controlling the routing from cable reticulation systems to cabinets can assist in preventing unauthorised modifications and tampering while also providing easy inspection of cables.
        controls:
        - id: ism-1102
          class: ISM-control
          title: "Control: ism-1102"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[26].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1102_smt
            name: statement
            prose: Cable reticulation systems leading into cabinets are terminated as close as possible to the cabinet.
        - id: ism-1101
          class: ISM-control
          title: "Control: ism-1101"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[26].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1101_smt
            name: statement
            prose: "In TOP SECRET areas, cable reticulation systems leading into cabinets in server rooms or communications rooms are terminated as close as possible to the cabinet."
        - id: ism-1103
          class: ISM-control
          title: "Control: ism-1103"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[26].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1103_smt
            name: statement
            prose: "In TOP SECRET areas, cable reticulation systems leading into cabinets not in server rooms or communications rooms are terminated at the boundary of the cabinet."
      - title: Terminating cables in cabinets
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[1].group[27]"
        parts:
        - name: overview
          prose: Having individual or divided cabinets can assist in preventing accidental or deliberate cross-patching and makes inspection of cables easier.
        controls:
        - id: ism-1100
          class: ISM-control
          title: "Control: ism-1100"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[27].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1100_smt
            name: statement
            prose: TOP SECRET cables are terminated in an individual TOP SECRET cabinet.
      - title: Terminating cables on patch panels
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[1].group[28]"
        parts:
        - name: overview
          prose: Terminating SECRET and TOP SECRET cables on different patch panels in cabinets can assist in preventing accidental or deliberate cross-patching and makes inspection of cables easier.
        controls:
        - id: ism-0213
          class: ISM-control
          title: "Control: ism-0213"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[28].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0213_smt
            name: statement
            prose: SECRET and TOP SECRET cables are terminated on their own individual patch panels.
      - title: Physical separation of cabinets and patch panels
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[1].group[29]"
        parts:
        - name: overview
          prose: "Physical separation between TOP SECRET systems and non-TOP SECRET systems reduces the chance of cross-patching, thereby the possibility of unauthorised personnel gaining access to TOP SECRET systems."
        controls:
        - id: ism-0216
          class: ISM-control
          title: "Control: ism-0216"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[29].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0216_smt
            name: statement
            prose: TOP SECRET patch panels are installed in individual TOP SECRET cabinets.
        - id: ism-0217
          class: ISM-control
          title: "Control: ism-0217"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[29].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0217_smt
            name: statement
            prose: |-
              Where spatial constraints demand non-TOP SECRET patch panels be installed in the same cabinet as a TOP SECRET patch panel:

              * a physical barrier in the cabinet is provided to separate patch panels
              * only personnel holding a Positive Vetting security clearance have access to the cabinet
              * approval from the TOP SECRET system’s authorising officer is obtained prior to installation.
        - id: ism-1116
          class: ISM-control
          title: "Control: ism-1116"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[29].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1116_smt
            name: statement
            prose: A visible gap exists between TOP SECRET cabinets and non-TOP SECRET cabinets.
      - title: Audio secure rooms
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[1].group[30]"
        parts:
        - name: overview
          prose: Audio secure rooms are designed to prevent audio conversations from being overheard. The Australian Security Intelligence Organisation should be consulted before any modifications are made to TOP SECRET audio secure rooms.
        controls:
        - id: ism-0198
          class: ISM-control
          title: "Control: ism-0198"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[30].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0198_smt
            name: statement
            prose: "When penetrating a TOP SECRET audio secure room, the Australian Security Intelligence Organisation is consulted and all directions provided are complied with."
      - title: Power reticulation
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[1].group[31]"
        parts:
        - name: overview
          prose: It is important that TOP SECRET systems have control over the power system to prevent denial of service by deliberate or accidental means.
        controls:
        - id: ism-1123
          class: ISM-control
          title: "Control: ism-1123"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[1].group[31].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1123_smt
            name: statement
            prose: A power distribution board with a feed from an Uninterruptible Power Supply is used to power all TOP SECRET ICT equipment.
    - title: Emanation security
      props:
      - name: sort-id
        value: "catalog[1].group[09].group[2]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on the ACSC’s
          [Emanation Security Program](#df17ad0f-58d3-4bb8-814a-b60f34c5f841), including a list of certified emanation security providers, is available from the ACSC.
      groups:
      - title: Emanation security threat assessments in Australia
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[2].group[1]"
        parts:
        - name: overview
          prose: Obtaining advice from the Australian Cyber Security Centre (ACSC) on emanation security threats is vital to protecting SECRET and TOP SECRET systems.
        controls:
        - id: ism-0247
          class: ISM-control
          title: "Control: ism-0247"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[2].group[1].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0247_smt
            name: statement
            prose: System owners deploying SECRET or TOP SECRET systems with Radio Frequency transmitters inside or co-located with their facility contact the ACSC for an emanation security threat assessment and implement any additional installation criteria derived from the threat assessment.
        - id: ism-1137
          class: ISM-control
          title: "Control: ism-1137"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[2].group[1].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1137_smt
            name: statement
            prose: System owners deploying SECRET or TOP SECRET systems in shared facilities contact the ACSC for an emanation security threat assessment and implement any additional installation criteria derived from the threat assessment.
      - title: Emanation security threat assessments outside Australia
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[2].group[2]"
        parts:
        - name: overview
          prose: "Fixed sites outside Australia, and deployed military platforms, are more vulnerable to emanation security threats. Failing to address emanation security threats could result in systems or military platforms emanating compromising signals, which if intercepted and analysed, could lead to serious consequences."
        controls:
        - id: ism-0249
          class: ISM-control
          title: "Control: ism-0249"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[2].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: O
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: P
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0249_smt
            name: statement
            prose: System owners deploying systems or military platforms overseas contact the ACSC for an emanation security threat assessment and implement any additional installation criteria derived from the threat assessment.
      - title: Early consideration of emanation security threats
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[2].group[3]"
        parts:
        - name: overview
          prose: It is important to consider emanation security threats as early as possible in a system’s life cycle as costs will be much greater if changes have to be made once a system has been designed and deployed.
        controls:
        - id: ism-0246
          class: ISM-control
          title: "Control: ism-0246"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[2].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: O
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: P
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0246_smt
            name: statement
            prose: An emanation security threat assessment is sought as early as possible in a system’s life cycle as implementing emanation security can have significant cost implications.
      - title: Electromagnetic interference/electromagnetic compatibility standards
        props:
        - name: sort-id
          value: "catalog[1].group[09].group[2].group[4]"
        parts:
        - name: overview
          prose: "While all ICT equipment may not need certification to emanation security standards, it still needs to meet applicable industry and government standards relating to electromagnetic interference/electromagnetic compatibility."
        controls:
        - id: ism-0250
          class: ISM-control
          title: "Control: ism-0250"
          props:
          - name: sort-id
            value: "catalog[1].group[09].group[2].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0250_smt
            name: statement
            prose: ICT equipment meets industry and government standards relating to electromagnetic interference/electromagnetic compatibility.
  - title: Guidelines for Communications Systems
    props:
    - name: sort-id
      value: "catalog[1].group[10]"
    groups:
    - title: Telephone systems
      props:
      - name: sort-id
        value: "catalog[1].group[10].group[1]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on encrypting communications can be found in the cryptographic fundamentals section of the
          [Guidelines for Cryptography](#195abe87-bb1e-4006-8b42-eaecca4d51f1).
      groups:
      - title: Telephone system usage policy
        props:
        - name: sort-id
          value: "catalog[1].group[10].group[1].group[1]"
        parts:
        - name: overview
          prose: All non-secure telephone systems are subject to interception. Personnel accidentally or maliciously communicating sensitive or classified information over a public telephone network can lead to its compromise.
        controls:
        - id: ism-1078
          class: ISM-control
          title: "Control: ism-1078"
          props:
          - name: sort-id
            value: "catalog[1].group[10].group[1].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1078_smt
            name: statement
            prose: "A telephone system usage policy is developed, implemented and maintained."
      - title: Personnel awareness
        props:
        - name: sort-id
          value: "catalog[1].group[10].group[1].group[2]"
        parts:
        - name: overview
          prose: |-
            As there is a potential for unintended disclosure of information when using telephone systems, it is important that personnel are made aware of the sensitivity or classification of conversations that they can be used for. In addition, personnel should also be made aware of the security risks associated with the use of non-secure telephone systems in sensitive or classified areas.

            When using cryptographic equipment to enable different levels of conversation for different kinds of connections, providing a visual indication to personnel as to the sensitivity or classification of information that can be discussed over the telephone system can assist in reducing the likelihood of unintended disclosure of information.
        controls:
        - id: ism-0229
          class: ISM-control
          title: "Control: ism-0229"
          props:
          - name: sort-id
            value: "catalog[1].group[10].group[1].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0229_smt
            name: statement
            prose: Personnel are advised of the permitted sensitivity or classification of information that can be discussed over both internal and external telephone systems.
        - id: ism-0230
          class: ISM-control
          title: "Control: ism-0230"
          props:
          - name: sort-id
            value: "catalog[1].group[10].group[1].group[2].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0230_smt
            name: statement
            prose: Personnel are advised of security risks posed by non-secure telephone systems in areas where sensitive or classified conversations can occur.
        - id: ism-0231
          class: ISM-control
          title: "Control: ism-0231"
          props:
          - name: sort-id
            value: "catalog[1].group[10].group[1].group[2].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0231_smt
            name: statement
            prose: "When using cryptographic equipment to permit different levels of conversation for different kinds of connections, telephone systems give a visual indication of what kind of connection has been made."
      - title: Protecting conversations
        props:
        - name: sort-id
          value: "catalog[1].group[10].group[1].group[3]"
        parts:
        - name: overview
          prose: "When sensitive or classified conversations are held using telephone systems, the conversation needs to be appropriately protected through the use of encryption."
        controls:
        - id: ism-0232
          class: ISM-control
          title: "Control: ism-0232"
          props:
          - name: sort-id
            value: "catalog[1].group[10].group[1].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0232_smt
            name: statement
            prose: Telephone systems used for sensitive or classified conversations encrypt all traffic that passes over external systems.
      - title: Cordless telephone systems
        props:
        - name: sort-id
          value: "catalog[1].group[10].group[1].group[4]"
        parts:
        - name: overview
          prose: "Cordless telephone handsets and headsets typically have minimal transmission security and are susceptible to interception. As such, using cordless telephone handsets and headsets may result in the disclosure of communications to an adversary unless appropriate encryption is used."
        controls:
        - id: ism-0233
          class: ISM-control
          title: "Control: ism-0233"
          props:
          - name: sort-id
            value: "catalog[1].group[10].group[1].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0233_smt
            name: statement
            prose: Cordless telephone handsets and headsets are not used for sensitive or classified conversations unless all communications are encrypted.
      - title: Speakerphones
        props:
        - name: sort-id
          value: "catalog[1].group[10].group[1].group[5]"
        parts:
        - name: overview
          prose: "As speakerphones are designed to pick up and transmit conversations in the vicinity of the device, using speakerphones in TOP SECRET areas presents a number of security risks and they should not be used. However, if personnel are able to reduce security risks through the use of an audio secure room that is secure during any conversations then they may be used."
        controls:
        - id: ism-0235
          class: ISM-control
          title: "Control: ism-0235"
          props:
          - name: sort-id
            value: "catalog[1].group[10].group[1].group[5].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: O
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: P
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0235_smt
            name: statement
            prose: "Speakerphones are not used on telephone systems in TOP SECRET areas unless the telephone system is located in an audio secure room, the room is audio secure during conversations and only personnel involved in conversations are present in the room."
      - title: Off-hook audio protection
        props:
        - name: sort-id
          value: "catalog[1].group[10].group[1].group[6]"
        parts:
        - name: overview
          prose: "Using off-hook protection features minimises the chance of background conversations being accidentally coupled into handsets, headsets and speakerphones. Limiting the time an active microphone is open minimises this security risk."
        controls:
        - id: ism-0236
          class: ISM-control
          title: "Control: ism-0236"
          props:
          - name: sort-id
            value: "catalog[1].group[10].group[1].group[6].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0236_smt
            name: statement
            prose: Off-hook audio protection features are used on telephone systems in areas where background conversations may exceed the sensitivity or classification that the telephone system is authorised for communicating.
        - id: ism-0931
          class: ISM-control
          title: "Control: ism-0931"
          props:
          - name: sort-id
            value: "catalog[1].group[10].group[1].group[6].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: O
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: P
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0931_smt
            name: statement
            prose: "In SECRET and TOP SECRET areas, push-to-talk handsets or push-to-talk headsets are used to meet any off-hook audio protection requirements."
    - title: Video conferencing and Internet Protocol telephony
      props:
      - name: sort-id
        value: "catalog[1].group[10].group[2]"
      parts:
      - name: overview
        prose: |-
          # Internet Protocol telephony

          This section describes the controls applicable to Internet Protocol (IP) telephony and extends upon the prior telephone systems section.

          # Video conferencing and Internet Protocol telephony gateways

          Where a video conferencing or IP telephony network is connected to another video conferencing or IP telephony network from a different security domain, the gateways section of the
          [Guidelines for Gateways](#e8bde527-526c-4a6a-b66f-05228f09dd7b) applies.

          Where an analog telephone network, such as the Public Switched Telephone Network (PSTN), is connected to a data network, the gateways section of the
          [Guidelines for Gateways](#e8bde527-526c-4a6a-b66f-05228f09dd7b) does not apply.

          # Further information

          Further information on gateways can be found in the gateways section of the
          [Guidelines for Gateways](#e8bde527-526c-4a6a-b66f-05228f09dd7b).

          Further information on firewalls can be found in the firewalls section of the
          [Guidelines for Gateways](#e8bde527-526c-4a6a-b66f-05228f09dd7b).

          Further information on the use of web conferencing solutions can be found in the Australian Cyber Security Centre’s
          [Web Conferencing Security](#e19a0c40-0a68-4fba-aea1-142fdd57dc75) publication.
      groups:
      - title: Video conferencing and Internet Protocol telephony infrastructure hardening
        props:
        - name: sort-id
          value: "catalog[1].group[10].group[2].group[1]"
        parts:
        - name: overview
          prose: "Video conferencing and IP telephony infrastructure can be hardened in order to reduce its attack surface. For example, by ensuring that a Session Initiation Protocol server has a fully patched operating system, uses fully patched software and runs only required services."
        controls:
        - id: ism-1562
          class: ISM-control
          title: "Control: ism-1562"
          props:
          - name: sort-id
            value: "catalog[1].group[10].group[2].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1562_smt
            name: statement
            prose: Video conferencing and IP telephony infrastructure is hardened.
      - title: Video-aware and voice-aware firewalls and proxies
        props:
        - name: sort-id
          value: "catalog[1].group[10].group[2].group[2]"
        parts:
        - name: overview
          prose: "The use of video-aware and voice-aware firewalls and proxies provides network security while supporting video and voice traffic. As such, when implementing a firewall or proxy in a gateway, and video conferencing or IP telephony traffic passes through the gateway, a video-aware or voice-aware firewall or proxy will need to be used. However, this does not require separate firewalls or proxies to be deployed for video conferencing, IP telephony and data traffic. In such cases, an organisation is encouraged to implement one firewall or proxy that is video-aware and data-aware; voice-aware and data-aware; or video-aware, voice-aware and data-aware depending on their needs."
        controls:
        - id: ism-0546
          class: ISM-control
          title: "Control: ism-0546"
          props:
          - name: sort-id
            value: "catalog[1].group[10].group[2].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "9"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0546_smt
            name: statement
            prose: "When video conferencing or IP telephony traffic passes through a gateway containing a firewall or proxy, a video-aware or voice-aware firewall or proxy is used."
      - title: Protecting video conferencing and Internet Protocol telephony traffic
        props:
        - name: sort-id
          value: "catalog[1].group[10].group[2].group[3]"
        parts:
        - name: overview
          prose: "Video conferencing and IP telephony traffic can be vulnerable to eavesdropping, denial-of-service, person-in-the-middle and call spoofing attacks. To mitigate this security risk, video conferencing and IP telephony signalling and audio/video data can be protected with the use of Transport Layer Security. This is achieved through the use of the Session Initiation Protocol Secure protocol and the Secure Real-time Transport Protocol."
        controls:
        - id: ism-0548
          class: ISM-control
          title: "Control: ism-0548"
          props:
          - name: sort-id
            value: "catalog[1].group[10].group[2].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0548_smt
            name: statement
            prose: Video conferencing and IP telephony calls are established using a secure session initiation protocol.
        - id: ism-0547
          class: ISM-control
          title: "Control: ism-0547"
          props:
          - name: sort-id
            value: "catalog[1].group[10].group[2].group[3].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0547_smt
            name: statement
            prose: Video conferencing and IP telephony calls are conducted using a secure real-time transport protocol.
      - title: Video conferencing unit and Internet Protocol phone authentication
        props:
        - name: sort-id
          value: "catalog[1].group[10].group[2].group[4]"
        parts:
        - name: overview
          prose: Blocking unauthorised or unauthenticated devices by default will reduce the likelihood of unauthorised access to a video conferencing or IP telephony network.
        controls:
        - id: ism-0554
          class: ISM-control
          title: "Control: ism-0554"
          props:
          - name: sort-id
            value: "catalog[1].group[10].group[2].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0554_smt
            name: statement
            prose: An encrypted and non-replayable two-way authentication scheme is used for call authentication and authorisation.
        - id: ism-0553
          class: ISM-control
          title: "Control: ism-0553"
          props:
          - name: sort-id
            value: "catalog[1].group[10].group[2].group[4].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0553_smt
            name: statement
            prose: "Authentication and authorisation is used for all actions on a video conferencing network, including call setup and changing settings."
        - id: ism-0555
          class: ISM-control
          title: "Control: ism-0555"
          props:
          - name: sort-id
            value: "catalog[1].group[10].group[2].group[4].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0555_smt
            name: statement
            prose: "Authentication and authorisation is used for all actions on an IP telephony network, including registering a new IP phone, changing phone users, changing settings and accessing voicemail."
        - id: ism-0551
          class: ISM-control
          title: "Control: ism-0551"
          props:
          - name: sort-id
            value: "catalog[1].group[10].group[2].group[4].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jan-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0551_smt
            name: statement
            prose: |-
              IP telephony is configured such that:

              * IP phones authenticate themselves to the call controller upon registration
              * auto-registration is disabled and only authorised devices are allowed to access the network
              * unauthorised devices are blocked by default
              * all unused and prohibited functionality is disabled.
        - id: ism-1014
          class: ISM-control
          title: "Control: ism-1014"
          props:
          - name: sort-id
            value: "catalog[1].group[10].group[2].group[4].control[5]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1014_smt
            name: statement
            prose: Individual logins are implemented for IP phones used for SECRET or TOP SECRET conversations.
      - title: Traffic separation
        props:
        - name: sort-id
          value: "catalog[1].group[10].group[2].group[5]"
        parts:
        - name: overview
          prose: Video conferencing and IP telephony traffic should be physically or logically separated from other data traffic to ensure its availability and quality of service.
        controls:
        - id: ism-0549
          class: ISM-control
          title: "Control: ism-0549"
          props:
          - name: sort-id
            value: "catalog[1].group[10].group[2].group[5].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Oct-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0549_smt
            name: statement
            prose: Video conferencing and IP telephony traffic is separated physically or logically from other data traffic.
        - id: ism-0556
          class: ISM-control
          title: "Control: ism-0556"
          props:
          - name: sort-id
            value: "catalog[1].group[10].group[2].group[5].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Oct-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0556_smt
            name: statement
            prose: "Workstations are not connected to video conferencing units or IP phones unless the workstation or the device uses Virtual Local Area Networks or similar mechanisms to maintain separation between video conferencing, IP telephony and other data traffic."
      - title: Internet Protocol phones in public areas
        props:
        - name: sort-id
          value: "catalog[1].group[10].group[2].group[6]"
        parts:
        - name: overview
          prose: "IP phones in public areas may give an adversary the opportunity to access data networks or poorly protected voicemail and directory services. As such, any services accessible to IP phones in public areas should be restricted."
        controls:
        - id: ism-0558
          class: ISM-control
          title: "Control: ism-0558"
          props:
          - name: sort-id
            value: "catalog[1].group[10].group[2].group[6].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0558_smt
            name: statement
            prose: "IP phones used in public areas do not have the ability to access data networks, voicemail and directory services."
      - title: Denial of service response plan
        props:
        - name: sort-id
          value: "catalog[1].group[10].group[2].group[8]"
        parts:
        - name: overview
          prose: "Video conferencing and IP telephony services may be a critical service for an organisation. In such cases, a denial of service response plan will assist in responding to denial-of-service attacks against these services."
        controls:
        - id: ism-1019
          class: ISM-control
          title: "Control: ism-1019"
          props:
          - name: sort-id
            value: "catalog[1].group[10].group[2].group[8].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "9"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1019_smt
            name: statement
            prose: "A denial of service response plan for video conferencing and IP telephony services is developed, implemented and maintained."
        - id: ism-1805
          class: ISM-control
          title: "Control: ism-1805"
          props:
          - name: sort-id
            value: "catalog[1].group[10].group[2].group[8].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1805_smt
            name: statement
            prose: |-
              A denial of service response plan for video conferencing and IP telephony services contains the following:

              * how to identify signs of a denial-of-service attack
              * how to identify the source of a denial-of-service attack
              * how capabilities can be maintained during a denial-of-service attack
              * what actions can be taken to respond to a denial-of-service attack.
    - title: Fax machines and multifunction devices
      props:
      - name: sort-id
        value: "catalog[1].group[10].group[3]"
      parts:
      - name: overview
        prose: |-
          # Using cryptographic equipment with fax machines and multifunction devices

          Further information on processes and procedures for sending classified fax messages using Australian Signals Directorate-approved High Assurance Cryptographic Equipment can be requested from the Australian Cyber Security Centre.

          # Further information

          Further information on encrypting communications can be found in the cryptographic fundamentals section of the
          [Guidelines for Cryptography](#195abe87-bb1e-4006-8b42-eaecca4d51f1).
      groups:
      - title: Fax machine and multifunction device usage policy
        props:
        - name: sort-id
          value: "catalog[1].group[10].group[3].group[1]"
        parts:
        - name: overview
          prose: "As fax machines and multifunction devices (MFDs) are a potential source of cyber security incidents, it is important that an organisation develops, implements and maintains a policy governing their use."
        controls:
        - id: ism-0588
          class: ISM-control
          title: "Control: ism-0588"
          props:
          - name: sort-id
            value: "catalog[1].group[10].group[3].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0588_smt
            name: statement
            prose: "A fax machine and MFD usage policy is developed, implemented and maintained."
      - title: Sending fax messages
        props:
        - name: sort-id
          value: "catalog[1].group[10].group[3].group[2]"
        parts:
        - name: overview
          prose: "Once a fax machine or MFD has been connected to cryptographic equipment, and used to send a sensitive or classified fax message, it can no longer be trusted when connected directly to unsecured telecommunications infrastructure, such as the PSTN. For example, if a fax machine fails to send a sensitive or classified fax message the device will continue attempting to send the fax message even if it has been disconnected from cryptographic equipment and re-connected directly to the PSTN. In such cases, the fax machine could send the sensitive or classified fax message in the clear causing a data spill."
        controls:
        - id: ism-1092
          class: ISM-control
          title: "Control: ism-1092"
          props:
          - name: sort-id
            value: "catalog[1].group[10].group[3].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1092_smt
            name: statement
            prose: Separate fax machines or MFDs are used for sending sensitive or classified fax messages and all other fax messages.
        - id: ism-0241
          class: ISM-control
          title: "Control: ism-0241"
          props:
          - name: sort-id
            value: "catalog[1].group[10].group[3].group[2].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0241_smt
            name: statement
            prose: "When sending fax messages, the fax message is encrypted to an appropriate level to be communicated over unsecured telecommunications infrastructure."
      - title: Receiving fax messages
        props:
        - name: sort-id
          value: "catalog[1].group[10].group[3].group[3]"
        parts:
        - name: overview
          prose: "While the communications path between fax machines and MFDs may be appropriately protected, personnel should still be aware of who has a need to know of the information being communicated. It is therefore important that fax messages are collected from the receiving fax machine or MFD as soon as possible. Furthermore, if an expected fax message is not received it may indicate that there was a problem with the original transmission or the fax message has been taken by an unauthorised person."
        controls:
        - id: ism-1075
          class: ISM-control
          title: "Control: ism-1075"
          props:
          - name: sort-id
            value: "catalog[1].group[10].group[3].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1075_smt
            name: statement
            prose: The sender of a fax message makes arrangements for the receiver to collect the fax message as soon as possible after it is sent and for the receiver to notify the sender if the fax message does not arrive in an agreed amount of time.
      - title: Connecting multifunction devices to networks
        props:
        - name: sort-id
          value: "catalog[1].group[10].group[3].group[4]"
        parts:
        - name: overview
          prose: "As networked MFDs are considered to be devices that reside on networks, they should have controls of a similar strength to other devices on networks."
        controls:
        - id: ism-0590
          class: ISM-control
          title: "Control: ism-0590"
          props:
          - name: sort-id
            value: "catalog[1].group[10].group[3].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0590_smt
            name: statement
            prose: Controls for MFDs connected to networks are of a similar strength to those for other devices on networks.
      - title: Connecting multifunction devices to both networks and digital telephone systems
        props:
        - name: sort-id
          value: "catalog[1].group[10].group[3].group[5]"
        parts:
        - name: overview
          prose: "When an MFD is connected to both a network and a digital telephone system, the MFD can act as a bridge between the two. The digital telephone system therefore needs to operate at the same sensitivity or classification as the network."
        controls:
        - id: ism-0245
          class: ISM-control
          title: "Control: ism-0245"
          props:
          - name: sort-id
            value: "catalog[1].group[10].group[3].group[5].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0245_smt
            name: statement
            prose: A direct connection from an MFD to a digital telephone system is not enabled unless the digital telephone system is authorised to operate at the same sensitivity or classification as the network to which the MFD is connected.
      - title: Copying documents on multifunction devices
        props:
        - name: sort-id
          value: "catalog[1].group[10].group[3].group[6]"
        parts:
        - name: overview
          prose: "As networked MFDs are capable of sending scanned or copied documents across connected networks, personnel should be aware that if they scan or copy documents at a level higher than that of networks that devices are connected to it will cause a data spill."
        controls:
        - id: ism-0589
          class: ISM-control
          title: "Control: ism-0589"
          props:
          - name: sort-id
            value: "catalog[1].group[10].group[3].group[6].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0589_smt
            name: statement
            prose: MFDs connected to networks are not used to copy documents above the sensitivity or classification of connected networks.
      - title: Observing fax machine and multifunction device use
        props:
        - name: sort-id
          value: "catalog[1].group[10].group[3].group[7]"
        parts:
        - name: overview
          prose: Placing fax machines and MFDs in public areas can help reduce the likelihood of any suspicious use going unnoticed.
        controls:
        - id: ism-1036
          class: ISM-control
          title: "Control: ism-1036"
          props:
          - name: sort-id
            value: "catalog[1].group[10].group[3].group[7].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1036_smt
            name: statement
            prose: Fax machines and MFDs are located in areas where their use can be observed.
  - title: Guidelines for Enterprise Mobility
    props:
    - name: sort-id
      value: "catalog[1].group[11]"
    groups:
    - title: Mobile device management
      props:
      - name: sort-id
        value: "catalog[1].group[11].group[1]"
      parts:
      - name: overview
        prose: |-
          # Types of mobile devices

          These guidelines describe the use and protection of mobile devices, such as smartphones, tablets and laptops. Further guidance for laptops is available in the
          [Guidelines for System Hardening](#de7525f3-a466-40a5-abdd-3ae24a6d1b44) and the
          [Guidelines for System Management](#c6ca6620-ccd5-4c5d-b97c-9d92f1162948).

          # Further information

          Further information on hardening operating systems for laptops can be found in the operating system hardening section of the
          [Guidelines for System Hardening](#de7525f3-a466-40a5-abdd-3ae24a6d1b44).

          Further information on hardening applications for laptops can be found in the user application hardening section of the
          [Guidelines for System Hardening](#de7525f3-a466-40a5-abdd-3ae24a6d1b44).

          Further information on patching or updating operating systems and applications for laptops can be found in the system patching section of the
          [Guidelines for System Management](#c6ca6620-ccd5-4c5d-b97c-9d92f1162948).

          Further information on allowing the use of privately-owned mobile devices by personnel to access their organisation’s systems and data can be found in the ACSC’s
          [Bring Your Own Device for Executives](#0e982561-93dc-4cf7-9a98-e91411e99ca6) publication.

          Further information and specific guidance on enterprise mobility can be found in the ACSC’s
          [Risk Management of Enterprise Mobility Including Bring Your Own Device (BYOD)](#e8ec7a1f-775d-4b79-a164-0752278177fa) publication.

          Further information on cyber supply chain risk management can be found in the cyber supply chain risk management section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).

          Further information on evaluated products can be found in the evaluated product procurement section of the
          [Guidelines for Evaluated Products](#a699a3aa-828d-479b-b50b-98127bb19437).

          Further information on ASD-approved platforms can be found in the following ACSC publications:

          * Security Configuration Guide – Apple iOS 14 Devices
          * Security Configuration Guide – Samsung Galaxy S10, S20 and Note 20 Devices
          * Security Configuration Guide – Viasat Mobile Dynamic Defense.

          Further information on encrypting mobile devices and their communications can be found in the cryptographic fundamentals section of the
          [Guidelines for Cryptography](#195abe87-bb1e-4006-8b42-eaecca4d51f1).

          Further information on Bluetooth security can be found in National Institute of Standards and Technology Special Publication 800-121 Rev. 2,
          [Guide to Bluetooth Security](#315744ea-3523-4c93-838d-fe2848ac4181).
      groups:
      - title: Mobile device management policy
        props:
        - name: sort-id
          value: "catalog[1].group[11].group[1].group[1]"
        parts:
        - name: overview
          prose: "Since mobile devices routinely leave the office environment, and the protection it affords, it is important that a mobile device management policy is developed, implemented and maintained to ensure that they are sufficiently hardened."
        controls:
        - id: ism-1533
          class: ISM-control
          title: "Control: ism-1533"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[1].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1533_smt
            name: statement
            prose: "A mobile device management policy is developed, implemented and maintained."
        - id: ism-1195
          class: ISM-control
          title: "Control: ism-1195"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[1].group[1].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1195_smt
            name: statement
            prose: A Mobile Device Management solution is used to ensure mobile device management policy is applied to all mobile devices.
      - title: ASD-approved platforms
        props:
        - name: sort-id
          value: "catalog[1].group[11].group[1].group[2]"
        parts:
        - name: overview
          prose: "In order to ensure interoperability and maintain trust, all mobile devices that process, store or communicate SECRET or TOP SECRET data must be approved for use by the Australian Signals Directorate (ASD)."
        controls:
        - id: ism-0687
          class: ISM-control
          title: "Control: ism-0687"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[1].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "9"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0687_smt
            name: statement
            prose: "Mobile devices do not process, store or communicate SECRET or TOP SECRET data until approved for use by ASD."
      - title: Privately-owned mobile devices
        props:
        - name: sort-id
          value: "catalog[1].group[11].group[1].group[3]"
        parts:
        - name: overview
          prose: |-
            Allowing privately-owned mobile devices to access an organisation’s systems or data can increase liability risk. As such, an organisation should seek legal advice to ascertain whether this scenario affects compliance with relevant legislation, such as the
            [Privacy Act 1988](#6fac5a84-b86e-405f-b2b3-8c13ecee4a02) and the
            [Archives Act 1983](#e0d3b5ea-6a5a-400c-8daa-8a8059816a06), and also consider whether the increased liability risks are acceptable to the organisation.

            If an organisation chooses to allow personnel to use a privately-owned mobile device to access their organisation’s systems or data, they should ensure that it does not present an unacceptable security risk. This can be achieved by encouraging the use of an ASD-approved platform, with a security configuration in accordance with Australian Cyber Security Centre (ACSC) guidance, along with enforced separation of work and personal data.
        controls:
        - id: ism-1297
          class: ISM-control
          title: "Control: ism-1297"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[1].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1297_smt
            name: statement
            prose: Legal advice is sought prior to allowing privately-owned mobile devices to access systems or data.
        - id: ism-0694
          class: ISM-control
          title: "Control: ism-0694"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[1].group[3].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0694_smt
            name: statement
            prose: Privately-owned mobile devices do not access SECRET and TOP SECRET systems or data.
      - title: Organisation-owned mobile devices
        props:
        - name: sort-id
          value: "catalog[1].group[11].group[1].group[4]"
        parts:
        - name: overview
          prose: "If an organisation chooses to issue personnel with an organisation-owned mobile device to access their organisation’s systems or data, they should ensure that it does not present an unacceptable security risk. This can be achieved by using an ASD-approved platform, with a security configuration in accordance with ACSC guidance, along with enforced separation of work and personal data."
        controls:
        - id: ism-1482
          class: ISM-control
          title: "Control: ism-1482"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[1].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: O
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: P
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1482_smt
            name: statement
            prose: "Personnel accessing systems or data using an organisation-owned mobile device use an ASD-approved platform, a security configuration in accordance with ACSC guidance, and have enforced separation of work and personal data."
      - title: Storage encryption
        props:
        - name: sort-id
          value: "catalog[1].group[11].group[1].group[5]"
        parts:
        - name: overview
          prose: "Encrypting the internal storage, and any removable media, for mobile devices will prevent an adversary from gaining easy access to any sensitive or classified data stored on them if they are lost or stolen."
        controls:
        - id: ism-0869
          class: ISM-control
          title: "Control: ism-0869"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[1].group[5].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0869_smt
            name: statement
            prose: Mobile devices encrypt their internal storage and any removable media.
      - title: Communications encryption
        props:
        - name: sort-id
          value: "catalog[1].group[11].group[1].group[6]"
        parts:
        - name: overview
          prose: "If appropriate encryption is not available to protect data in transit, mobile devices communicating sensitive or classified data will present a security risk."
        controls:
        - id: ism-1085
          class: ISM-control
          title: "Control: ism-1085"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[1].group[6].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1085_smt
            name: statement
            prose: Mobile devices encrypt all sensitive or classified data communicated over public network infrastructure.
      - title: Bluetooth functionality
        props:
        - name: sort-id
          value: "catalog[1].group[11].group[1].group[7]"
        parts:
        - name: overview
          prose: |-
            To mitigate security risks associated with pairing mobile devices with other Bluetooth devices, Bluetooth version 4.1 introduced the Secure Connections functionality for Bluetooth Classic, while Bluetooth version 4.2 introduced the Secure Connections functionality for Bluetooth Low Energy. This functionality uses keys generated using Elliptic Curve Diffie-Hellman cryptography, thereby offering greater security compared to previous key exchange protocols. However, personnel should still consider the location and manner in which they pair OFFICIAL and PROTECTED mobile devices with other Bluetooth devices, such as by avoiding pairing devices in public locations, and remove all Bluetooth pairings when there is no longer a requirement for their use.

            Note, however, the Bluetooth protocol provides inadequate protection for the communication of SECRET and TOP SECRET data. As such, Bluetooth functionality is not suitable for use with SECRET and TOP SECRET mobile devices.
        controls:
        - id: ism-0682
          class: ISM-control
          title: "Control: ism-0682"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[1].group[7].control[5]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0682_smt
            name: statement
            prose: Bluetooth functionality is not enabled on SECRET and TOP SECRET mobile devices.
      - title: Maintaining mobile device security
        props:
        - name: sort-id
          value: "catalog[1].group[11].group[1].group[8]"
        parts:
        - name: overview
          prose: "Poorly secured mobile devices are more vulnerable to compromise, and provide an adversary with a potential access point into any connected systems. Although an organisation may initially provide secure mobile devices, their security posture may degrade over time if personnel are capable of installing or uninstalling non-approved applications, or disabling or modifying security functionality. Furthermore, it is important that security updates are applied to mobile devices as soon as they become available in order to maintain their security posture."
        controls:
        - id: ism-0863
          class: ISM-control
          title: "Control: ism-0863"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[1].group[8].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0863_smt
            name: statement
            prose: Mobile devices prevent personnel from installing or uninstalling non-approved applications once provisioned.
        - id: ism-0864
          class: ISM-control
          title: "Control: ism-0864"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[1].group[8].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0864_smt
            name: statement
            prose: Mobile devices prevent personnel from disabling or modifying security functionality once provisioned.
        - id: ism-1366
          class: ISM-control
          title: "Control: ism-1366"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[1].group[8].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1366_smt
            name: statement
            prose: Security updates are applied to mobile devices as soon as they become available.
      - title: Connecting mobile devices to the internet
        props:
        - name: sort-id
          value: "catalog[1].group[11].group[1].group[9]"
        parts:
        - name: overview
          prose: |-
            When connecting mobile devices to the internet, best practice involves establishing a Virtual Private Network (VPN) connection to an organisation’s internet gateway rather than a direct connection to the internet. In doing so, mobile devices will be protected by additional security functionality, such as web content filtering, provided by an organisation’s internet gateway.

            A split tunnel VPN can allow access into an organisation’s network from other networks, such as the internet. If split tunnelling is not disabled there is an increased security risk that the VPN connection will be susceptible to intrusions from other networks. An organisation can refer to the relevant ACSC security configuration guidance for mobile devices on how to mitigate this security risk.
        controls:
        - id: ism-0874
          class: ISM-control
          title: "Control: ism-0874"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[1].group[9].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0874_smt
            name: statement
            prose: Mobile devices access the internet via a VPN connection to an organisation’s internet gateway rather than via a direct connection to the internet.
        - id: ism-0705
          class: ISM-control
          title: "Control: ism-0705"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[1].group[9].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0705_smt
            name: statement
            prose: "When accessing an organisation’s network via a VPN connection, split tunnelling is disabled."
    - title: Mobile device usage
      props:
      - name: sort-id
        value: "catalog[1].group[11].group[2]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on usage of mobile devices in SECRET and TOP SECRET areas can be found in the facilities and systems section of the
          [Guidelines for Physical Security](#4deea7ea-18a2-4fd7-8b25-0b3603215df2).

          Further information on security briefcases can be found in the Australian Security Intelligence Organisation’s Security Equipment Guide-005, Briefcases for the Carriage of Security Classified Information. This publication is available from the Protective Security Policy GovTEAMS community or the Australian Security Intelligence Organisation by email.

          Further information on approved multi-use satchels, pouches and transit bags can be found on the Security Construction and Equipment Committee’s
          [Security Equipment Evaluated Products List](#f7e13f7b-eb48-4294-bd01-9c22c756d96b).

          Further information on travelling overseas with mobile devices can be found in the ACSC’s
          [Travelling Overseas With Electronic Devices](#5796c2ee-4dbc-4084-ae80-2febc26d5807) publication.
      groups:
      - title: Mobile device usage policy
        props:
        - name: sort-id
          value: "catalog[1].group[11].group[2].group[1]"
        parts:
        - name: overview
          prose: "Since mobile devices routinely leave the office environment, and the protection it affords, it is important that an organisation develops, implements and maintains a mobile device usage policy governing their use."
        controls:
        - id: ism-1082
          class: ISM-control
          title: "Control: ism-1082"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[2].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1082_smt
            name: statement
            prose: "A mobile device usage policy is developed, implemented and maintained."
      - title: Personnel awareness
        props:
        - name: sort-id
          value: "catalog[1].group[11].group[2].group[2]"
        parts:
        - name: overview
          prose: "Mobile devices can have both a voice and data communications component. In such cases, personnel should know the sensitivity or classification of voice and data that mobile devices have been approved to process, store and communicate."
        controls:
        - id: ism-1083
          class: ISM-control
          title: "Control: ism-1083"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[2].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1083_smt
            name: statement
            prose: Personnel are advised of the sensitivity or classification permitted for voice and data communications when using mobile devices.
      - title: "Paging, message services and messaging apps"
        props:
        - name: sort-id
          value: "catalog[1].group[11].group[2].group[3]"
        parts:
        - name: overview
          prose: "As paging, messaging services and many messaging apps do not sufficiently encrypt data in transit, they cannot be relied upon for the communication of sensitive or classified data."
        controls:
        - id: ism-0240
          class: ISM-control
          title: "Control: ism-0240"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[2].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0240_smt
            name: statement
            prose: "Paging, Multimedia Message Service, Short Message Service and messaging apps are not used to communicate sensitive or classified data."
      - title: Using mobile devices in public spaces
        props:
        - name: sort-id
          value: "catalog[1].group[11].group[2].group[4]"
        parts:
        - name: overview
          prose: |-
            Personnel should be aware of the environment in which they use mobile devices to view or communicate sensitive or classified data. In particular, personnel should take care to ensure that sensitive or classified data is not observed by other parties in public areas, such as on public transport, in transit lounges and at coffee shops. In some cases, privacy filters can be applied to the screen of a mobile device to prevent onlookers from reading content off its screen.

            In addition, personnel should maintain awareness of the environments from which they conduct sensitive or classified phone calls and the potential for their conversations to be overheard.
        controls:
        - id: ism-0866
          class: ISM-control
          title: "Control: ism-0866"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[2].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0866_smt
            name: statement
            prose: Sensitive or classified data is not viewed or communicated in public locations unless care is taken to reduce the chance of the screen of a mobile device being observed.
        - id: ism-1145
          class: ISM-control
          title: "Control: ism-1145"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[2].group[4].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1145_smt
            name: statement
            prose: Privacy filters are applied to the screens of SECRET and TOP SECRET mobile devices.
        - id: ism-1644
          class: ISM-control
          title: "Control: ism-1644"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[2].group[4].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1644_smt
            name: statement
            prose: Sensitive or classified phone calls are not conducted in public locations unless care is taken to reduce the chance of conversations being overheard.
      - title: Maintaining control of mobile devices
        props:
        - name: sort-id
          value: "catalog[1].group[11].group[2].group[5]"
        parts:
        - name: overview
          prose: "As mobile devices are portable in nature, and can be easily lost or stolen, it is strongly advised that personnel maintain continual direct supervision of them when they are being actively used and carry or store them in a secured state when they are not being activity used. Note, while mobile devices may be encrypted, the effectiveness of encryption might be reduced if they are lost or stolen while in sleep mode or powered on with a locked screen."
        controls:
        - id: ism-0871
          class: ISM-control
          title: "Control: ism-0871"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[2].group[5].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Apr-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0871_smt
            name: statement
            prose: Mobile devices are kept under continual direct supervision when being actively used.
        - id: ism-0870
          class: ISM-control
          title: "Control: ism-0870"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[2].group[5].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Apr-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0870_smt
            name: statement
            prose: Mobile devices are carried or stored in a secured state when not being actively used.
        - id: ism-1084
          class: ISM-control
          title: "Control: ism-1084"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[2].group[5].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1084_smt
            name: statement
            prose: "If unable to carry or store mobile devices in a secured state, they are physically transferred in a security briefcase or an approved multi-use satchel, pouch or transit bag."
      - title: Mobile device emergency sanitisation processes and procedures
        props:
        - name: sort-id
          value: "catalog[1].group[11].group[2].group[6]"
        parts:
        - name: overview
          prose: The sanitisation of mobile devices in emergency situations can assist in reducing the potential for compromise of data by an adversary. This may be achieved through the use of a remote wipe capability or a cryptographic key zeroise or sanitisation function if present.
        controls:
        - id: ism-0701
          class: ISM-control
          title: "Control: ism-0701"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[2].group[6].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0701_smt
            name: statement
            prose: "Mobile device emergency sanitisation processes, and supporting mobile device emergency sanitisation procedures, are developed, implemented and maintained."
        - id: ism-0702
          class: ISM-control
          title: "Control: ism-0702"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[2].group[6].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0702_smt
            name: statement
            prose: "If a cryptographic zeroise or sanitise function is provided for cryptographic keys on a SECRET or TOP SECRET mobile device, the function is used as part of mobile device emergency sanitisation processes and procedures."
      - title: Before travelling overseas with mobile devices
        props:
        - name: sort-id
          value: "catalog[1].group[11].group[2].group[7]"
        parts:
        - name: overview
          prose: "Personnel travelling overseas with mobile devices face additional security risks compared to travelling domestically, especially when travelling to high or extreme risk countries. As such, appropriate precautions should be taken. Personnel should also be aware that when they leave Australian borders they also leave behind any expectations of privacy."
        controls:
        - id: ism-1298
          class: ISM-control
          title: "Control: ism-1298"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[2].group[7].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Oct-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1298_smt
            name: statement
            prose: Personnel are advised of privacy and security risks when travelling overseas with mobile devices.
        - id: ism-1554
          class: ISM-control
          title: "Control: ism-1554"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[2].group[7].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1554_smt
            name: statement
            prose: |-
              If travelling overseas with mobile devices to high or extreme risk countries, personnel are:

              * issued with newly provisioned accounts, mobile devices and removable media from a pool of dedicated travel devices which are used solely for work-related activities
              * advised on how to apply and inspect tamper seals to key areas of mobile devices
              * advised to avoid taking any personal mobile devices, especially if rooted or jailbroken.
        - id: ism-1555
          class: ISM-control
          title: "Control: ism-1555"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[2].group[7].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1555_smt
            name: statement
            prose: |-
              Before travelling overseas with mobile devices, personnel take the following actions:

              * record all details of the mobile devices being taken, such as product types, serial numbers and International Mobile Equipment Identity numbers
              * update all operating systems and applications
              * remove all non-essential accounts, applications and data
              * apply security configuration settings, such as lock screens
              * configure remote locate and wipe functionality
              * enable encryption, including for any removable media
              * backup all important data and configuration settings.
      - title: While travelling overseas with mobile devices
        props:
        - name: sort-id
          value: "catalog[1].group[11].group[2].group[8]"
        parts:
        - name: overview
          prose: "Personnel lose control of mobile devices and removable media any time they are not on their person. This includes when placing mobile devices and removable media in checked-in luggage or leaving them in hotel rooms (including hotel room safes). In addition, allowing untrusted people to access mobile devices provides an opportunity for them to be tampered with."
        controls:
        - id: ism-1299
          class: ISM-control
          title: "Control: ism-1299"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[2].group[8].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1299_smt
            name: statement
            prose: |-
              Personnel take the following precautions when travelling overseas with mobile devices:

              * never leaving mobile devices or removable media unattended for any period of time, including by placing them in checked-in luggage or leaving them in hotel safes
              * never storing credentials with mobile devices that they grant access to, such as in laptop bags
              * never lending mobile devices or removable media to untrusted people, even if briefly
              * never allowing untrusted people to connect their mobile devices or removable media, including for charging
              * never using designated charging stations, wall outlet charging ports or chargers supplied by untrusted people
              * avoiding connecting mobile devices to open or untrusted Wi-Fi networks
              * using a VPN connection to encrypt all mobile device communications
              * using encrypted messaging apps for communications instead of using foreign telecommunication networks
              * disabling any communications capabilities of mobile devices when not in use, such as cellular data, wireless, Bluetooth and Near Field Communication
              * avoiding reuse of removable media once used with other parties’ systems or mobile devices
              * ensuring any removable media used for data transfers are thoroughly checked for malicious code beforehand
              * never using any gifted mobile devices, especially removable media, when travelling or upon returning from travelling.
        - id: ism-1088
          class: ISM-control
          title: "Control: ism-1088"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[2].group[8].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1088_smt
            name: statement
            prose: |-
              Personnel report the potential compromise of mobile devices, removable media or credentials to their organisation as soon as possible, especially if they:

              * provide credentials to foreign government officials
              * decrypt mobile devices for foreign government officials
              * have mobile devices taken out of sight by foreign government officials
              * have mobile devices or removable media stolen that are later returned
              * lose mobile devices or removable media that are later found
              * observe unusual behaviour of mobile devices.
      - title: After travelling overseas with mobile devices
        props:
        - name: sort-id
          value: "catalog[1].group[11].group[2].group[9]"
        parts:
        - name: overview
          prose: "Following overseas travel with mobile devices, personnel should take appropriate precautions to ensure that they do not pose an undue security risk to their organisation’s systems and data. In most cases, sanitising and resetting mobile devices, including all removable media, will be sufficient. However, upon returning from high or extreme risk countries, additional precautions will likely be needed."
        controls:
        - id: ism-1300
          class: ISM-control
          title: "Control: ism-1300"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[2].group[9].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1300_smt
            name: statement
            prose: |-
              Upon returning from travelling overseas with mobile devices, personnel take the following actions:

              * sanitise and reset mobile devices, including all removable media
              * decommission any credentials that left their possession during their travel
              * report if significant doubt exists as to the integrity of any mobile devices or removable media.
        - id: ism-1556
          class: ISM-control
          title: "Control: ism-1556"
          props:
          - name: sort-id
            value: "catalog[1].group[11].group[2].group[9].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1556_smt
            name: statement
            prose: |-
              If returning from travelling overseas with mobile devices to high or extreme risk countries, personnel take the following additional actions:

              * reset credentials used with mobile devices, including those used for remote access to their organisation’s systems
              * monitor accounts for any indicators of compromise, such as failed logon attempts.
  - title: Guidelines for Evaluated Products
    props:
    - name: sort-id
      value: "catalog[1].group[12]"
    groups:
    - title: Evaluated product procurement
      props:
      - name: sort-id
        value: "catalog[1].group[12].group[1]"
      parts:
      - name: overview
        prose: |-
          # Evaluated products

          An evaluated product provides a level of assurance in its security functionality that an unevaluated product does not. To assist in providing this assurance, the Australian Cyber Security Centre (ACSC) performs product evaluations through the following programs:

          * Enterprise Mobility Evaluation Program: For enterprise mobility products used to protect sensitive or classified data.
          * High Assurance Evaluation Program: For products used to protect SECRET and TOP SECRET data.

          The ACSC can be contacted for information on products that are in-evaluation via either program as well as those that have completed evaluation.

          # Common Criteria evaluations

          The Australian Certification Authority within the ACSC also certifies product evaluations conducted by licensed commercial facilities, in accordance with the Common Criteria (i.e. the International Organization for Standardization/International Electrotechnical Commission 15408 series), as part of the Australian Information Security Evaluation Program (AISEP).

          For an organisation seeking to procure evaluated products, the Common Criteria’s
          [Certified Products List](#29b04eaf-5f57-4ea1-a453-8047826dccf5) contains a list of products that have been evaluated, certified and mutually-recognised in accordance with the Common Criteria and the Common Criteria Recognition Arrangement (CCRA).

          # Cryptographic evaluations

          Some CCRA schemes leverage the
          [Cryptographic Algorithm Validation Program](#42e7d99d-9709-4355-a54d-98959c552aa1) for the evaluation of cryptographic algorithms used by cryptographic modules within evaluated products. In such cases, cryptographic evaluations are performed by Cryptographic and Security Testing laboratories that are accredited by the United States’ National Voluntary Laboratory Accreditation Program to International Organization for Standardization/International Electrotechnical Commission 17025:2017,
          [General requirements for the competence of testing and calibration laboratories](#edd67903-94ef-4edd-9789-73e0141cd77c).

          # Protection Profiles

          A Protection Profile (PP) is a technology-specific document that defines the security functionality that must be included in a Common Criteria evaluated product to mitigate specific cyber threats. PPs can be published by a recognised CCRA scheme or by the CCRA body itself. PPs published by the CCRA body are referred to as collaborative PPs.

          The ACSC recognises all collaborative PPs listed on the Common Criteria website, and will consider national PPs listed on the United States’ National Information Assurance Partnership website, in addition to those listed on the ACSC’s website. Where a PP does not exist, an evaluation based on an Evaluation Assurance Level (EAL) may be accepted. Such evaluations are capped at EAL2+ as this represents the best balance between completion time and meaningful security assurance gains.

          # Evaluation documentation

          An organisation choosing to use Common Criteria evaluated products can determine their suitability by reviewing their evaluation documentation. This includes the security target and certification report.

          Products that are undergoing a Common Criteria evaluation will not have published evaluation documentation. However, documentation can be obtained from the ACSC if a product is being evaluated through the AISEP. For a product that is in evaluation through a foreign scheme, the product’s vendor can be contacted directly for further information.

          # Further information

          Further information on the
          [High Assurance Evaluation Program](#e4ef23da-2683-4356-93c4-a2412c9d52ee) is available from the ACSC.

          Further information on the
          [AISEP](#57c58870-2ebb-4fce-b995-0c86cb64002f) is available from the ACSC.

          Further information on Common Criteria evaluated products can be found on the Common Criteria’s
          [Certified Products List](#29b04eaf-5f57-4ea1-a453-8047826dccf5).

          Further information on cyber supply chain risk management can be found in the cyber supply chain risk management section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).
      groups:
      - title: Evaluated product selection
        props:
        - name: sort-id
          value: "catalog[1].group[12].group[1].group[1]"
        parts:
        - name: overview
          prose: "A Common Criteria evaluation is traditionally conducted at a specified EAL. However, evaluations against a PP exist outside of this scale. Notably, while products evaluated against a PP will fulfil the Common Criteria EAL requirements, the EAL number will not be published. In addition, PP modules contain additional requirements that are complementary to or extend upon collaborative PPs. For example, a stateful traffic filtering PP module for a firewall evaluated against a network device collaborative PP. Note, when procuring an evaluated product that has completed a PP-based evaluation, it is important to ensure that all applicable PP modules were included as part of the product’s evaluation."
        controls:
        - id: ism-0280
          class: ISM-control
          title: "Control: ism-0280"
          props:
          - name: sort-id
            value: "catalog[1].group[12].group[1].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "8"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0280_smt
            name: statement
            prose: "If procuring an evaluated product, a product that has completed a PP-based evaluation, including against all applicable PP modules, is selected in preference to one that has completed an EAL-based evaluation."
      - title: Delivery of evaluated products
        props:
        - name: sort-id
          value: "catalog[1].group[12].group[1].group[2]"
        parts:
        - name: overview
          prose: |-
            It is important that an organisation ensures that products they source are the actual products that are delivered. In the case of evaluated products, if the product delivered differs from an evaluated version then the assurance gained from the evaluation may not necessarily apply.

            Packaging and delivery practices can vary greatly from product to product. For most evaluated products, standard commercial packaging and delivery practices are likely to be sufficient. However, in some cases more secure packaging and delivery practices, including tamper-evident seals and secure transportation, may be required. In the case of the digital delivery of evaluated products, digital signatures or cryptographic checksums can often be used to ensure the integrity of software that was delivered.
        controls:
        - id: ism-0285
          class: ISM-control
          title: "Control: ism-0285"
          props:
          - name: sort-id
            value: "catalog[1].group[12].group[1].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0285_smt
            name: statement
            prose: Evaluated products are delivered in a manner consistent with any delivery procedures defined in associated evaluation documentation.
        - id: ism-0286
          class: ISM-control
          title: "Control: ism-0286"
          props:
          - name: sort-id
            value: "catalog[1].group[12].group[1].group[2].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0286_smt
            name: statement
            prose: "When procuring high assurance ICT equipment, the ACSC is contacted for any equipment-specific delivery procedures."
    - title: Evaluated product usage
      props:
      - name: sort-id
        value: "catalog[1].group[12].group[2]"
      parts:
      - name: overview
        prose: |-
          # Evaluated configuration

          An evaluated product is considered to be operating in an evaluated configuration if:

          * functionality that it uses was in the scope of the evaluation and it is implemented in the specified manner
          * only product updates that have been assessed through maintenance and re-evaluation activities (known as assurance continuity) have been applied
          * the environment complies with assumptions or organisational security policies stated in the evaluation documentation.

          # Unevaluated configuration

          An evaluated product is considered to be operating in an unevaluated configuration when it does not meet the requirements of the evaluated configuration and guidance provided in its certification report.

          # Patching evaluated products

          In the majority of cases, the latest patched version of an evaluated product will be more secure than an older unpatched version. While the application of patches will not normally place an evaluated product into an unevaluated configuration, some vendors may include new functionality which has not been evaluated with their patches. In such cases, an organisation should use their judgement to determine whether this deviation from the evaluated configuration constitutes additional security risk or not.

          # Further information

          Further information on patching or updating ICT equipment can be found in the system patching section of the
          [Guidelines for System Management](#c6ca6620-ccd5-4c5d-b97c-9d92f1162948).

          Further information on the installation, configuration, administration and operation of Common Criteria products is available from vendors and can be found in evaluation documentation on the Common Criteria’s
          [Certified Products List](#29b04eaf-5f57-4ea1-a453-8047826dccf5).

          For information on the installation, configuration, administration and operation of high assurance ICT equipment is available from the ACSC.
      groups:
      - title: Installation and configuration of evaluated products
        props:
        - name: sort-id
          value: "catalog[1].group[12].group[2].group[1]"
        parts:
        - name: overview
          prose: Product evaluation provides assurance that a product’s security functionality will work as expected when operating in a clearly defined configuration. The scope of the evaluation specifies the security functionality that can be used and how a product is to be configured and operated. Using an evaluated product in an unevaluated configuration could result in the introduction of security risks that were not considered as part of the product’s evaluation.
        controls:
        - id: ism-0289
          class: ISM-control
          title: "Control: ism-0289"
          props:
          - name: sort-id
            value: "catalog[1].group[12].group[2].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0289_smt
            name: statement
            prose: "Evaluated products are installed, configured, administered and operated in accordance with vendor guidance and evaluation documentation."
        - id: ism-0290
          class: ISM-control
          title: "Control: ism-0290"
          props:
          - name: sort-id
            value: "catalog[1].group[12].group[2].group[1].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0290_smt
            name: statement
            prose: "High assurance ICT equipment is installed, configured, administered and operated in accordance with guidance produced by the ACSC."
      - title: Use of high assurance ICT equipment in unevaluated configurations
        props:
        - name: sort-id
          value: "catalog[1].group[12].group[2].group[2]"
        parts:
        - name: overview
          prose: "Given the value of data being protected by high assurance ICT equipment, it should always be operated in an evaluated configuration."
        controls:
        - id: ism-0292
          class: ISM-control
          title: "Control: ism-0292"
          props:
          - name: sort-id
            value: "catalog[1].group[12].group[2].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0292_smt
            name: statement
            prose: High assurance ICT equipment is always operated in an evaluated configuration.
  - title: Guidelines for ICT Equipment
    props:
    - name: sort-id
      value: "catalog[1].group[13]"
    groups:
    - title: ICT equipment usage
      props:
      - name: sort-id
        value: "catalog[1].group[13].group[1]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on cyber supply chain risk management can be found in the cyber supply chain risk management section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).

          Further information on securing ICT equipment when not in use can be found in the ICT equipment and media section of the
          [Guidelines for Physical Security](#4deea7ea-18a2-4fd7-8b25-0b3603215df2).

          Further information on encrypting media within ICT equipment can be found in the cryptographic fundamentals section of the
          [Guidelines for Cryptography](#195abe87-bb1e-4006-8b42-eaecca4d51f1).

          Further information on the protection of ICT equipment can be found in the Attorney-General’s Department’s
          [Protective Security Policy Framework](#92679127-f61d-486a-a93e-df2a26dfb07a),
          [Physical security for entity resources](#6e456a92-f405-4151-88ca-5621aa23519b) policy.
      groups:
      - title: ICT equipment management policy
        props:
        - name: sort-id
          value: "catalog[1].group[13].group[1].group[1]"
        parts:
        - name: overview
          prose: "Since ICT equipment is capable of processing, storing or communicating sensitive or classified data, it is important that an ICT equipment management policy is developed, implemented and maintained to ensure that ICT equipment, and the data it processes, stores or communicates, is protected in an appropriate manner."
        controls:
        - id: ism-1551
          class: ISM-control
          title: "Control: ism-1551"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[1].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1551_smt
            name: statement
            prose: "An ICT equipment management policy is developed, implemented and maintained."
      - title: ICT equipment register
        props:
        - name: sort-id
          value: "catalog[1].group[13].group[1].group[2]"
        parts:
        - name: overview
          prose: "Developing, implementing, maintaining and regularly verifying a register of authorised ICT equipment can assist an organisation in tracking legitimate ICT equipment as well as determining whether unauthorised ICT equipment, such as workstations, servers and network devices, have been introduced into their organisation."
        controls:
        - id: ism-0336
          class: ISM-control
          title: "Control: ism-0336"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[1].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0336_smt
            name: statement
            prose: "An ICT equipment register is developed, implemented, maintained and verified on a regular basis."
      - title: Labelling ICT equipment
        props:
        - name: sort-id
          value: "catalog[1].group[13].group[1].group[3]"
        parts:
        - name: overview
          prose: |-
            Applying protective markings to ICT equipment assists to reduce the likelihood that a user will accidentally input data into it that it is not approved for processing, storing or communicating.

            While text-based protective markings are typically used for labelling ICT equipment, there may be circumstances where colour-based protective markings or other marking schemes need to be used instead. In such cases, the marking scheme will need to be documented and personnel will need to be trained in its use.
        controls:
        - id: ism-0294
          class: ISM-control
          title: "Control: ism-0294"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[1].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0294_smt
            name: statement
            prose: "ICT equipment, with the exception of high assurance ICT equipment, is labelled with protective markings reflecting its sensitivity or classification."
      - title: Labelling high assurance ICT equipment
        props:
        - name: sort-id
          value: "catalog[1].group[13].group[1].group[4]"
        parts:
        - name: overview
          prose: "High assurance ICT equipment often has tamper-evident seals placed on its external surfaces. To assist users in noticing changes to these seals, and to prevent functionality being degraded, an organisation should limit the use of labels on high assurance ICT equipment."
        controls:
        - id: ism-0296
          class: ISM-control
          title: "Control: ism-0296"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[1].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0296_smt
            name: statement
            prose: The Australian Cyber Security Centre (ACSC)’s approval is sought before applying labels to external surfaces of high assurance ICT equipment.
      - title: Classifying ICT equipment
        props:
        - name: sort-id
          value: "catalog[1].group[13].group[1].group[5]"
        parts:
        - name: overview
          prose: |-
            The purpose of classifying ICT equipment is to acknowledge the sensitivity or classification of data that it is approved for processing, storing or communicating.

            Classifying ICT equipment also assists in ensuring that the appropriate sanitisation, destruction and disposal processes are followed at the end of its life.
        controls:
        - id: ism-0293
          class: ISM-control
          title: "Control: ism-0293"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[1].group[5].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0293_smt
            name: statement
            prose: "ICT equipment is classified based on the highest sensitivity or classification of data that it is approved for processing, storing or communicating."
      - title: Handling ICT equipment
        props:
        - name: sort-id
          value: "catalog[1].group[13].group[1].group[6]"
        parts:
        - name: overview
          prose: "When ICT equipment displays, processes, stores or communicates sensitive or classified data, it will need to be handled as per the sensitivity or classification of that data. However, applying encryption to media within the ICT equipment may change the manner in which it needs to be handled. Any change in handling needs to be based on the original sensitivity or classification of data residing on media within the ICT equipment and the level of assurance in the cryptographic equipment or software being used to encrypt it."
        controls:
        - id: ism-1599
          class: ISM-control
          title: "Control: ism-1599"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[1].group[6].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Aug-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1599_smt
            name: statement
            prose: ICT equipment is handled in a manner suitable for its sensitivity or classification.
    - title: ICT equipment maintenance and repairs
      props:
      - name: sort-id
        value: "catalog[1].group[13].group[2]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on cyber supply chain risk management can be found in the cyber supply chain risk management section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).

          Further information on the sanitisation of media can be found in the media sanitisation section of the
          [Guidelines for Media](#b594c9c0-b42f-4f06-b643-38023275a5c7).
      groups:
      - title: Maintenance and repairs of high assurance ICT equipment
        props:
        - name: sort-id
          value: "catalog[1].group[13].group[2].group[1]"
        parts:
        - name: overview
          prose: "Due to the nature of high assurance ICT equipment, it is important that that ACSC’s approval is sought before any maintenance or repairs are undertaken."
        controls:
        - id: ism-1079
          class: ISM-control
          title: "Control: ism-1079"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[2].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1079_smt
            name: statement
            prose: The ACSC’s approval is sought before undertaking any maintenance or repairs to high assurance ICT equipment.
      - title: On-site maintenance and repairs
        props:
        - name: sort-id
          value: "catalog[1].group[13].group[2].group[2]"
        parts:
        - name: overview
          prose: |-
            Undertaking unauthorised maintenance or repairs to ICT equipment could impact its integrity. As such, using appropriately cleared technicians to maintain and repair ICT equipment on site is considered the most secure approach. This ensures that if data is disclosed during the course of maintenance or repairs, the technicians are aware of the requirements to protect such data.

            An organisation choosing to use uncleared technicians to maintain or repair ICT equipment should be aware of the requirement for cleared personnel to escort uncleared technicians during maintenance or repair activities.
        controls:
        - id: ism-0305
          class: ISM-control
          title: "Control: ism-0305"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[2].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0305_smt
            name: statement
            prose: Maintenance and repairs of ICT equipment is carried out on site by an appropriately cleared technician.
        - id: ism-0307
          class: ISM-control
          title: "Control: ism-0307"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[2].group[2].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0307_smt
            name: statement
            prose: "If an uncleared technician is used to undertake maintenance or repairs of ICT equipment, the ICT equipment and associated media is sanitised before maintenance or repair work is undertaken."
        - id: ism-0306
          class: ISM-control
          title: "Control: ism-0306"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[2].group[2].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0306_smt
            name: statement
            prose: |-
              If an uncleared technician is used to undertake maintenance or repairs of ICT equipment, the technician is escorted by someone who:

              * is appropriately cleared and briefed
              * takes due care to ensure that data is not disclosed
              * takes all responsible measures to ensure the integrity of the ICT equipment
              * has the authority to direct the technician
              * is sufficiently familiar with the ICT equipment to understand the work being performed.
      - title: Off-site maintenance and repairs
        props:
        - name: sort-id
          value: "catalog[1].group[13].group[2].group[3]"
        parts:
        - name: overview
          prose: "An organisation choosing to have ICT equipment maintained or repaired off site should do so at facilities approved for handling the sensitivity or classification of the ICT equipment. However, an organisation may be able to sanitise the ICT equipment prior to transport, and subsequent maintenance or repair activities, to change how it needs to be handled."
        controls:
        - id: ism-0310
          class: ISM-control
          title: "Control: ism-0310"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[2].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0310_smt
            name: statement
            prose: ICT equipment maintained or repaired off site is done so at facilities approved for handling the sensitivity or classification of the ICT equipment.
      - title: Inspection of ICT equipment following maintenance and repairs
        props:
        - name: sort-id
          value: "catalog[1].group[13].group[2].group[4]"
        parts:
        - name: overview
          prose: "Following the maintenance or repair of ICT equipment, it is important that the ICT equipment is inspected to ensure that it retains its approved software configuration and that no unauthorised modifications have been made by technicians."
        controls:
        - id: ism-1598
          class: ISM-control
          title: "Control: ism-1598"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[2].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Aug-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1598_smt
            name: statement
            prose: "Following maintenance or repair activities for ICT equipment, the ICT equipment is inspected to confirm it retains its approved software configuration and that no unauthorised modifications have taken place."
    - title: ICT equipment sanitisation and destruction
      props:
      - name: sort-id
        value: "catalog[1].group[13].group[3]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on the sanitisation of media can be found in the media sanitisation section of the
          [Guidelines for Media](#b594c9c0-b42f-4f06-b643-38023275a5c7).

          Further information on the destruction of media can be found in the media destruction section of the
          [Guidelines for Media](#b594c9c0-b42f-4f06-b643-38023275a5c7).

          Further information on the sanitisation of network devices is available from vendors and can be found in evaluation documentation on the Common Criteria’s
          [Certified Products List](#29b04eaf-5f57-4ea1-a453-8047826dccf5).
      groups:
      - title: ICT equipment sanitisation processes and procedures
        props:
        - name: sort-id
          value: "catalog[1].group[13].group[3].group[1]"
        parts:
        - name: overview
          prose: "Developing, implementing and maintaining processes and procedures for ICT equipment sanitisation will ensure that an organisation carries out ICT equipment sanitisation in an appropriate and consistent manner."
        controls:
        - id: ism-0313
          class: ISM-control
          title: "Control: ism-0313"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[3].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0313_smt
            name: statement
            prose: "ICT equipment sanitisation processes, and supporting ICT equipment sanitisation procedures, are developed, implemented and maintained."
      - title: ICT equipment destruction processes and procedures
        props:
        - name: sort-id
          value: "catalog[1].group[13].group[3].group[2]"
        parts:
        - name: overview
          prose: "Developing, implementing and maintaining processes and procedures for ICT equipment destruction will ensure that an organisation carries out ICT equipment destruction in an appropriate and consistent manner."
        controls:
        - id: ism-1741
          class: ISM-control
          title: "Control: ism-1741"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[3].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1741_smt
            name: statement
            prose: "ICT equipment destruction processes, and supporting ICT equipment destruction procedures, are developed, implemented and maintained."
      - title: Sanitising ICT equipment
        props:
        - name: sort-id
          value: "catalog[1].group[13].group[3].group[3]"
        parts:
        - name: overview
          prose: |-
            When sanitising ICT equipment, any media within the ICT equipment should be removed or sanitised. Once any media has been removed or sanitised, ICT equipment can be considered sanitised. However, if media cannot be removed or sanitised, the ICT equipment should be destroyed as per media destruction requirements.

            Media typically found in ICT equipment includes:

            * electrostatic memory devices, such as laser printer cartridges used in multifunction devices (MFDs)
            * non-volatile magnetic memory, such as hard disks
            * non-volatile semiconductor memory, such as flash cards and solid state drives
            * volatile memory, such as random-access memory sticks.
        controls:
        - id: ism-0311
          class: ISM-control
          title: "Control: ism-0311"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[3].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0311_smt
            name: statement
            prose: ICT equipment containing media is sanitised by removing the media from the ICT equipment or by sanitising the media in situ.
        - id: ism-1742
          class: ISM-control
          title: "Control: ism-1742"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[3].group[3].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1742_smt
            name: statement
            prose: ICT equipment that cannot be sanitised is destroyed.
      - title: Sanitising highly sensitive ICT equipment
        props:
        - name: sort-id
          value: "catalog[1].group[13].group[3].group[4]"
        parts:
        - name: overview
          prose: "ICT equipment located overseas that has processed, stored or communicated Australian Eyes Only (AUSTEO) or Australian Government Access Only (AGAO) data can have more severe consequences for Australian interests if not sanitised appropriately."
        controls:
        - id: ism-1218
          class: ISM-control
          title: "Control: ism-1218"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[3].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1218_smt
            name: statement
            prose: "ICT equipment, including associated media, that is located overseas and has processed, stored or communicated AUSTEO or AGAO data, is sanitised in situ."
        - id: ism-0312
          class: ISM-control
          title: "Control: ism-0312"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[3].group[4].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0312_smt
            name: statement
            prose: "ICT equipment, including associated media, that is located overseas and has processed, stored or communicated AUSTEO or AGAO data that cannot be sanitised in situ, is returned to Australia for destruction."
      - title: Destroying high assurance ICT equipment
        props:
        - name: sort-id
          value: "catalog[1].group[13].group[3].group[5]"
        parts:
        - name: overview
          prose: "Due to the nature of high assurance ICT equipment, and many of the protective mechanisms it employs, sanitisation alone is not sufficient prior to its disposal. As such, all high assurance ICT equipment should be destroyed prior to its disposal."
        controls:
        - id: ism-0315
          class: ISM-control
          title: "Control: ism-0315"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[3].group[5].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "8"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0315_smt
            name: statement
            prose: High assurance ICT equipment is destroyed prior to its disposal.
      - title: Sanitising printers and multifunction devices
        props:
        - name: sort-id
          value: "catalog[1].group[13].group[3].group[6]"
        parts:
        - name: overview
          prose: |-
            When sanitising printers and MFDs, the printer cartridge or MFD print drum should be sanitised in addition to the removal or sanitisation of any media. This can be achieved by printing random text with no blank areas on each colour printer cartridge or MFD print drum. In addition, image transfer rollers and platens can become imprinted with text and images over time and should be destroyed if any text or images have been retained. Finally, any paper jammed in the paper path should be removed.

            When printer cartridges and MFD print drums cannot be sanitised due to a hardware failure, or when they are empty, there is no other option available but to destroy them. Printer ribbons cannot be sanitised and should be destroyed.
        controls:
        - id: ism-0317
          class: ISM-control
          title: "Control: ism-0317"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[3].group[6].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0317_smt
            name: statement
            prose: At least three pages of random text with no blank areas are printed on each colour printer cartridge or MFD print drum.
        - id: ism-1219
          class: ISM-control
          title: "Control: ism-1219"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[3].group[6].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1219_smt
            name: statement
            prose: MFD print drums and image transfer rollers are inspected and destroyed if there is remnant toner which cannot be removed or a print is visible on the image transfer roller.
        - id: ism-1220
          class: ISM-control
          title: "Control: ism-1220"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[3].group[6].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1220_smt
            name: statement
            prose: Printer and MFD platens are inspected and destroyed if any text or images are retained on the platen.
        - id: ism-1221
          class: ISM-control
          title: "Control: ism-1221"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[3].group[6].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1221_smt
            name: statement
            prose: Printers and MFDs are checked to ensure no pages are trapped in the paper path due to a paper jam.
        - id: ism-0318
          class: ISM-control
          title: "Control: ism-0318"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[3].group[6].control[5]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0318_smt
            name: statement
            prose: "When unable to sanitise printer cartridges or MFD print drums, they are destroyed as per electrostatic memory devices."
        - id: ism-1534
          class: ISM-control
          title: "Control: ism-1534"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[3].group[6].control[6]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1534_smt
            name: statement
            prose: Printer ribbons in printers and MFDs are removed and destroyed.
      - title: Sanitising televisions and computer monitors
        props:
        - name: sort-id
          value: "catalog[1].group[13].group[3].group[7]"
        parts:
        - name: overview
          prose: |-
            All types of televisions and computer monitors are capable of retaining data if mitigating measures are not taken during their lifetime. Cathode Ray Tube monitors and plasma screens can be affected by burn-in while Liquid Crystal Display and Organic Light Emitting Diode screens can be affected by image persistence.

            Televisions and computer monitors can be visually inspected by turning up the brightness and contrast to their maximum level to determine if any data has been burnt into or persists on the screen. If burn-in or image persistence is removed by this activity, televisions and computer monitors can be considered sanitised. However, if burn-in or persistence is not removed through these measures, televisions and computer monitors cannot be sanitised and should be destroyed.

            If televisions or computer monitors cannot be powered on, such as due to a faulty power supply, they cannot be sanitised and should be destroyed.
        controls:
        - id: ism-1076
          class: ISM-control
          title: "Control: ism-1076"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[3].group[7].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1076_smt
            name: statement
            prose: Televisions and computer monitors with minor burn-in or image persistence are sanitised by displaying a solid white image on the screen for an extended period of time.
        - id: ism-1222
          class: ISM-control
          title: "Control: ism-1222"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[3].group[7].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1222_smt
            name: statement
            prose: Televisions and computer monitors that cannot be sanitised are destroyed.
      - title: Sanitising network devices
        props:
        - name: sort-id
          value: "catalog[1].group[13].group[3].group[8]"
        parts:
        - name: overview
          prose: "As network devices can store network configuration data or credentials in their memory, the memory should be sanitised prior to the disposal of the network devices. The correct method to sanitise network devices will depend on their configuration and the type of memory they use. As such, device-specific guidance provided in evaluation documentation, or vendor sanitisation guidance, should be consulted to determine the most appropriate method to sanitise memory in network devices."
        controls:
        - id: ism-1223
          class: ISM-control
          title: "Control: ism-1223"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[3].group[8].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1223_smt
            name: statement
            prose: |-
              Memory in network devices is sanitised using the following processes, in order of preference:

              * following device-specific guidance provided in evaluation documentation
              * following vendor sanitisation guidance
              * loading a dummy configuration file, performing a factory reset and then reinstalling firmware.
      - title: Sanitising fax machines
        props:
        - name: sort-id
          value: "catalog[1].group[13].group[3].group[9]"
        parts:
        - name: overview
          prose: "As fax machines can store pages that are ready for transmission in their memory, the memory should be sanitised prior to the disposal of the fax machines. This can be achieved by removing the paper tray, transmitting a fax message with a minimum length of four pages, then re-installing the paper tray and allowing a fax summary page to be printed. In addition, any paper that becomes trapped in the paper path should be removed prior to disposal."
        controls:
        - id: ism-1225
          class: ISM-control
          title: "Control: ism-1225"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[3].group[9].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1225_smt
            name: statement
            prose: "The paper tray of the fax machine is removed, and a fax message with a minimum length of four pages is transmitted, before the paper tray is re-installed to allow a fax summary page to be printed."
        - id: ism-1226
          class: ISM-control
          title: "Control: ism-1226"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[3].group[9].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1226_smt
            name: statement
            prose: Fax machines are checked to ensure no pages are trapped in the paper path due to a paper jam.
    - title: ICT equipment disposal
      props:
      - name: sort-id
        value: "catalog[1].group[13].group[4]"
      groups:
      - title: ICT equipment disposal processes and procedures
        props:
        - name: sort-id
          value: "catalog[1].group[13].group[4].group[1]"
        parts:
        - name: overview
          prose: "Developing, implementing and maintaining processes and procedures for ICT equipment disposal will ensure that an organisation carries out ICT equipment disposal in an appropriate and consistent manner."
        controls:
        - id: ism-1550
          class: ISM-control
          title: "Control: ism-1550"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[4].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1550_smt
            name: statement
            prose: "ICT equipment disposal processes, and supporting ICT equipment disposal procedures, are developed, implemented and maintained."
      - title: Disposal of ICT equipment
        props:
        - name: sort-id
          value: "catalog[1].group[13].group[4].group[2]"
        parts:
        - name: overview
          prose: "Before ICT equipment can be released into the public domain, it needs to be sanitised, destroyed or declassified. As sanitised, destroyed or declassified ICT equipment still presents a security risk, albeit very minor, an appropriate authority needs to formally authorise its release into the public domain. Furthermore, as part of disposal processes, removing labels and markings indicating the owner, sensitivity, classification or any other marking that can associate ICT equipment with its prior use will ensure it does not draw undue attention following its disposal."
        controls:
        - id: ism-1217
          class: ISM-control
          title: "Control: ism-1217"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[4].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1217_smt
            name: statement
            prose: "Labels and markings indicating the owner, sensitivity, classification or any other marking that can associate ICT equipment with its prior use are removed prior to its disposal."
        - id: ism-0321
          class: ISM-control
          title: "Control: ism-0321"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[4].group[2].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0321_smt
            name: statement
            prose: "When disposing of ICT equipment that has been designed or modified to meet emanation security standards, the ACSC is contacted for requirements relating to its disposal."
        - id: ism-0316
          class: ISM-control
          title: "Control: ism-0316"
          props:
          - name: sort-id
            value: "catalog[1].group[13].group[4].group[2].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0316_smt
            name: statement
            prose: "Following sanitisation, destruction or declassification, a formal administrative decision is made to release ICT equipment, or its waste, into the public domain."
  - title: Guidelines for Media
    props:
    - name: sort-id
      value: "catalog[1].group[14]"
    groups:
    - title: Media usage
      props:
      - name: sort-id
        value: "catalog[1].group[14].group[1]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on cyber supply chain risk management can be found in the cyber supply chain risk management section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).

          Further information on the protection of media can be found in the Attorney-General’s Department’s
          [Protective Security Policy Framework](#92679127-f61d-486a-a93e-df2a26dfb07a),
          [Physical security for entity resources](#6e456a92-f405-4151-88ca-5621aa23519b) policy.

          Further information on securing media when not in use can be found in the ICT equipment and media section of the
          [Guidelines for Physical Security](#4deea7ea-18a2-4fd7-8b25-0b3603215df2).

          Further information on encrypting media can be found in the cryptographic fundamentals section of the
          [Guidelines for Cryptography](#195abe87-bb1e-4006-8b42-eaecca4d51f1).

          Further information on using media to transfer data between systems can be found in the data transfers section of the
          [Guidelines for Data Transfers](#1eefdaf7-3991-4ba2-9439-79565f508c44).
      groups:
      - title: Media management policy
        props:
        - name: sort-id
          value: "catalog[1].group[14].group[1].group[1]"
        parts:
        - name: overview
          prose: "Since media is capable of storing sensitive or classified data, it is important that a media management policy is developed, implemented and maintained to ensure that all types of media, and the data it stores, is protected in an appropriate manner. In many cases, an organisation’s media management policy will be closely tied to their removable media usage policy."
        controls:
        - id: ism-1549
          class: ISM-control
          title: "Control: ism-1549"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[1].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1549_smt
            name: statement
            prose: "A media management policy is developed, implemented and maintained."
      - title: Removable media usage policy
        props:
        - name: sort-id
          value: "catalog[1].group[14].group[1].group[2]"
        parts:
        - name: overview
          prose: |-
            Establishing a removable media usage policy can decrease the likelihood and consequence of data spills, data loss and data theft. In doing so, a removable media usage policy will likely cover the following:

            * permitted types and uses of removable media
            * registration and labelling of removable media
            * handling and protection of removable media
            * reporting of lost or stolen removable media
            * sanitisation or destruction of removable media at the end of its life.
        controls:
        - id: ism-1359
          class: ISM-control
          title: "Control: ism-1359"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[1].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1359_smt
            name: statement
            prose: "A removable media usage policy is developed, implemented and maintained."
      - title: Removable media register
        props:
        - name: sort-id
          value: "catalog[1].group[14].group[1].group[3]"
        parts:
        - name: overview
          prose: "Developing, implementing, maintaining and regularly verifying a register of removable media can assist an organisation in tracking and accounting for authorised removable media as well as identifying any non-authorised removal media in use within their organisation."
        controls:
        - id: ism-1713
          class: ISM-control
          title: "Control: ism-1713"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[1].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1713_smt
            name: statement
            prose: "A removable media register is developed, implemented, maintained and verified on a regular basis."
      - title: Labelling media
        props:
        - name: sort-id
          value: "catalog[1].group[14].group[1].group[4]"
        parts:
        - name: overview
          prose: |-
            Labelling media helps personnel to identify its sensitivity or classification and ensure that appropriate measures are applied to its storage, handling and use.

            While text-based protective markings are typically used for labelling media, there may be circumstances where colour-based protective markings or other marking schemes need to be used instead. In such cases, the marking scheme will need to be documented and personnel will need to be trained in its use.
        controls:
        - id: ism-0332
          class: ISM-control
          title: "Control: ism-0332"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[1].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0332_smt
            name: statement
            prose: "Media, with the exception of internally mounted fixed media within ICT equipment, is labelled with protective markings reflecting its sensitivity or classification."
      - title: Classifying media
        props:
        - name: sort-id
          value: "catalog[1].group[14].group[1].group[5]"
        parts:
        - name: overview
          prose: "Media that is not correctly classified could be stored and handled inappropriately, accessed by personnel who do not have an appropriate security clearance or used with systems it is not authorised to be used with."
        controls:
        - id: ism-0323
          class: ISM-control
          title: "Control: ism-0323"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[1].group[5].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "8"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0323_smt
            name: statement
            prose: "Media is classified to the highest sensitivity or classification of data it stores, unless the media has been classified to a higher sensitivity or classification."
        - id: ism-0337
          class: ISM-control
          title: "Control: ism-0337"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[1].group[5].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0337_smt
            name: statement
            prose: "Media is only used with systems that are authorised to process, store or communicate its sensitivity or classification."
      - title: Reclassifying media
        props:
        - name: sort-id
          value: "catalog[1].group[14].group[1].group[6]"
        parts:
        - name: overview
          prose: "Some activities may necessitate or allow for a change to the sensitivity or classification of media. For example, when media is connected to a system that lacks a mechanism through which read-only access can be ensured, when media is sanitised or destroyed, or when data stored on media is subject to a sensitivity or classification change."
        controls:
        - id: ism-0325
          class: ISM-control
          title: "Control: ism-0325"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[1].group[6].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Apr-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0325_smt
            name: statement
            prose: "Any media connected to a system with a higher sensitivity or classification than the media is reclassified to the higher sensitivity or classification, unless the media is read-only or the system has a mechanism through which read-only access can be ensured."
        - id: ism-0330
          class: ISM-control
          title: "Control: ism-0330"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[1].group[6].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0330_smt
            name: statement
            prose: "Before reclassifying media to a lower sensitivity or classification, the media is sanitised or destroyed, and a formal administrative decision is made to reclassify it."
      - title: Handling media
        props:
        - name: sort-id
          value: "catalog[1].group[14].group[1].group[7]"
        parts:
        - name: overview
          prose: "As media can be easily misplaced or stolen, measures should be put in place to protect data stored on it. In some cases, applying encryption to media may change the manner in which it needs to be handled. Any change in handling needs to be based on the original sensitivity or classification of the media and the level of assurance in the cryptographic equipment or software being used to encrypt it."
        controls:
        - id: ism-0831
          class: ISM-control
          title: "Control: ism-0831"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[1].group[7].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0831_smt
            name: statement
            prose: Media is handled in a manner suitable for its sensitivity or classification.
        - id: ism-1059
          class: ISM-control
          title: "Control: ism-1059"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[1].group[7].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1059_smt
            name: statement
            prose: All data stored on media is encrypted.
      - title: Sanitising media before first use
        props:
        - name: sort-id
          value: "catalog[1].group[14].group[1].group[8]"
        parts:
        - name: overview
          prose: "Sanitising media before first use can assist in reducing cyber supply chain risks, such as new media containing malicious code. In addition, sanitising media before first use in a different security domain can prevent potential data spills from occurring."
        controls:
        - id: ism-1600
          class: ISM-control
          title: "Control: ism-1600"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[1].group[8].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Apr-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1600_smt
            name: statement
            prose: Media is sanitised before it is used for the first time.
        - id: ism-1642
          class: ISM-control
          title: "Control: ism-1642"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[1].group[8].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Apr-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1642_smt
            name: statement
            prose: Media is sanitised before it is reused in a different security domain.
      - title: Using media for data transfers
        props:
        - name: sort-id
          value: "catalog[1].group[14].group[1].group[9]"
        parts:
        - name: overview
          prose: |-
            An organisation transferring data between systems belonging to different security domains is strongly encouraged to use write-once media. When done properly, such as using non-rewritable compact discs that have been finalised, this will ensure that data from the destination system cannot be accidently transferred, or maliciously exfiltrated, onto the media used for the data transfer and then onto another system, such as the original source system. Alternatively, if suitable write-once media is not used, the destination system should have a mechanism through which read-only access can be ensured, such as via a read-only device or hardware write-blocker. However, the use of read-only mechanisms is not immune to failure or compromise, therefore, rewritable media should still be sanitised following each data transfer.

            It is important to note that for most non-volatile flash memory media, it will be possible to sanitise and reclassify it following a data transfer in order to allow it to be connected to other systems again. This is not possible for SECRET and TOP SECRET non-volatile flash memory media as it cannot be reclassified following sanitisation.
        controls:
        - id: ism-0347
          class: ISM-control
          title: "Control: ism-0347"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[1].group[9].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Apr-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0347_smt
            name: statement
            prose: "When transferring data manually between two systems belonging to different security domains, write-once media is used unless the destination system has a mechanism through which read-only access can be ensured."
        - id: ism-0947
          class: ISM-control
          title: "Control: ism-0947"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[1].group[9].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Apr-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0947_smt
            name: statement
            prose: "When transferring data manually between two systems belonging to different security domains, rewritable media is sanitised after each data transfer."
    - title: Media sanitisation
      props:
      - name: sort-id
        value: "catalog[1].group[14].group[2]"
      parts:
      - name: overview
        prose: |-
          # Hybrid hard drives

          When sanitising hybrid hard drives, separate the non-volatile magnetic media from the circuit board containing non-volatile flash memory media and sanitise each separately.

          # Solid state drives

          When sanitising solid state drives, the method for sanitising non-volatile flash memory media applies.

          # Further information

          Further information on recoverability of data from volatile media can be found in the
          [Data Remanence in Semiconductor Devices](#eb0009ec-5481-41cd-91e3-aee354042712) paper.

          Further information on the random-access memory testing tool
          [MemTest86](#629818d8-430c-4125-8fd2-5e3f988fce21) can be obtained from PassMark Software.

          Further information on the graphics card random-access memory testing tools
          [MemtestG80](#39e186f3-d175-4eed-afe6-2b9a7a936a91) and
          [MemtestCL](#9d38f42d-eeff-4124-93db-4b29abaafb67) can be obtained from their GitHub projects.

          Further information on HDDerase is available from the
          [Center for Memory and Recording Research](#401ed034-e2bd-43b4-9fde-05d07618039a) at the University of California San Diego. HDDerase is capable of calling the ATA secure erase command as well as resetting the host-protected area and device configuration overlay table on non-volatile magnetic media.

          Further information on reliably erasing data from solid state drives can be found in the
          [Reliably Erasing Data From Flash-Based Solid State Drives](#0c912487-72f0-4532-ba68-705590a63258) paper.
      groups:
      - title: Media sanitisation processes and procedures
        props:
        - name: sort-id
          value: "catalog[1].group[14].group[2].group[01]"
        parts:
        - name: overview
          prose: "Using approved methods to sanitise media provides a level of assurance that, to the extent possible, no data will be left following sanitisation. The methods described in these guidelines are designed not only to prevent common data recovery practices but also to protect from those that could emerge in the future."
        controls:
        - id: ism-0348
          class: ISM-control
          title: "Control: ism-0348"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[2].group[01].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0348_smt
            name: statement
            prose: "Media sanitisation processes, and supporting media sanitisation procedures, are developed, implemented and maintained."
      - title: Volatile media sanitisation
        props:
        - name: sort-id
          value: "catalog[1].group[14].group[2].group[02]"
        parts:
        - name: overview
          prose: "When sanitising volatile media, the specified time to wait following the removal of power is based on applying a safety factor to the time recommended by research into preventing the recovery of data. If read back cannot be achieved following the overwriting of volatile media, or data persists, it will need to be destroyed."
        controls:
        - id: ism-0351
          class: ISM-control
          title: "Control: ism-0351"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[2].group[02].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0351_smt
            name: statement
            prose: Volatile media is sanitised by removing its power for at least 10 minutes.
        - id: ism-0352
          class: ISM-control
          title: "Control: ism-0352"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[2].group[02].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0352_smt
            name: statement
            prose: SECRET and TOP SECRET volatile media is sanitised by overwriting it at least once in its entirety with a random pattern followed by a read back for verification.
      - title: Treatment of volatile media following sanitisation
        props:
        - name: sort-id
          value: "catalog[1].group[14].group[2].group[03]"
        parts:
        - name: overview
          prose: |-
            Research suggests that short-term remanence effects are likely in volatile media. For example, up to minutes at normal room temperatures and up to hours in extremely cold temperatures. Furthermore, some volatile media can suffer from long-term remanence effects resulting from physical changes due to the continuous storage of static data for extended periods of time. It is for these reasons that under certain circumstances TOP SECRET volatile media retains its classification following sanitisation.

            Typical circumstances preventing the reclassification of TOP SECRET volatile media include a static cryptographic key being stored in the same memory location during every boot of a device, or a static image being displayed on a device and stored in volatile media for a period of months.
        controls:
        - id: ism-0835
          class: ISM-control
          title: "Control: ism-0835"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[2].group[03].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0835_smt
            name: statement
            prose: "Following sanitisation, TOP SECRET volatile media retains its classification if it stored static data for an extended period of time, or had data repeatedly stored on or written to the same memory location for an extended period of time."
      - title: Non-volatile magnetic media sanitisation
        props:
        - name: sort-id
          value: "catalog[1].group[14].group[2].group[04]"
        parts:
        - name: overview
          prose: |-
            Non-volatile magnetic media encompasses non-volatile magnetic hard drives, tape drives and floppy disks. While non-volatile magnetic tape drives and floppy disks can be sanitised by overwriting them at least once (or three times if pre-2001 or under 15 GB) in their entirety with a random pattern followed by a read back for verification, additional considerations apply to non-volatile magnetic hard drives due to their use of a host-protected area, device configuration overlay table and growth defects table.

            Both the host-protected area and device configuration overlay table of non-volatile magnetic hard drives are normally not visible to a computer’s Unified Extensible Firmware Interface or operating system. Therefore, any sanitisation of the readable sectors of non-volatile magnetic hard drives will leave any data contained in sectors listed in the host-protected area and device configuration overlay table untouched. Some sanitisation programs include the ability to reset non-volatile magnetic hard drives to their default state, thereby removing any host-protected areas or device configuration overlays. This allows the sanitisation program to see the entire contents of non-volatile magnetic hard drives during subsequent sanitisation processes.

            Modern non-volatile magnetic hard drives automatically reallocate space for bad sectors at a hardware level. These bad sectors are maintained in what is known as the growth defects table or ‘g-list’. If data was stored in a sector that was subsequently added to the growth defects table, sanitising the non-volatile magnetic hard drive will not overwrite such data. While these sectors may be considered bad by non-volatile magnetic hard drives, quite often this is due to the sectors no longer meeting expected performance norms and not due to an inability to read or write to them. The Advanced Technology Attachment (ATA) secure erase command was built into the firmware of post-2001 non-volatile magnetic hard drives and is able to access sectors that have been added to the growth defects table.

            Modern non-volatile magnetic hard drives also contain a primary defects table or ‘p-list’. The primary defects table contains a list of bad sectors found during post-production processes. No data is ever stored in sectors listed in the primary defects table as they are marked as inaccessible before non-volatile magnetic hard drives are used for the first time.
        controls:
        - id: ism-0354
          class: ISM-control
          title: "Control: ism-0354"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[2].group[04].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0354_smt
            name: statement
            prose: Non-volatile magnetic media is sanitised by overwriting it at least once (or three times if pre-2001 or under 15 GB) in its entirety with a random pattern followed by a read back for verification.
        - id: ism-1065
          class: ISM-control
          title: "Control: ism-1065"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[2].group[04].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1065_smt
            name: statement
            prose: The host-protected area and device configuration overlay table are reset prior to the sanitisation of non-volatile magnetic hard drives.
        - id: ism-1067
          class: ISM-control
          title: "Control: ism-1067"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[2].group[04].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1067_smt
            name: statement
            prose: "The ATA secure erase command is used, in addition to block overwriting software, to ensure the growth defects table of non-volatile magnetic hard drives is overwritten."
      - title: Treatment of non-volatile magnetic media following sanitisation
        props:
        - name: sort-id
          value: "catalog[1].group[14].group[2].group[05]"
        parts:
        - name: overview
          prose: "Due to concerns with the sanitisation processes for non-volatile magnetic media, SECRET and TOP SECRET non-volatile magnetic media retains its classification following sanitisation."
        controls:
        - id: ism-0356
          class: ISM-control
          title: "Control: ism-0356"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[2].group[05].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0356_smt
            name: statement
            prose: "Following sanitisation, SECRET and TOP SECRET non-volatile magnetic media retains its classification."
      - title: Non-volatile erasable programmable read-only memory media sanitisation
        props:
        - name: sort-id
          value: "catalog[1].group[14].group[2].group[06]"
        parts:
        - name: overview
          prose: "When sanitising non-volatile erasable programmable read-only memory (EPROM), three times the manufacturer’s specification for ultraviolet erasure time should be applied to provide additional certainty in sanitisation processes."
        controls:
        - id: ism-0357
          class: ISM-control
          title: "Control: ism-0357"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[2].group[06].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0357_smt
            name: statement
            prose: Non-volatile EPROM media is sanitised by applying three times the manufacturer’s specified ultraviolet erasure time and then overwriting it at least once in its entirety with a random pattern followed by a read back for verification.
      - title: Non-volatile electrically erasable programmable read-only memory media sanitisation
        props:
        - name: sort-id
          value: "catalog[1].group[14].group[2].group[07]"
        parts:
        - name: overview
          prose: A single overwrite with a random pattern is considered suitable for sanitising non-volatile electrically erasable programmable read-only memory (EEPROM) media.
        controls:
        - id: ism-0836
          class: ISM-control
          title: "Control: ism-0836"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[2].group[07].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0836_smt
            name: statement
            prose: Non-volatile EEPROM media is sanitised by overwriting it at least once in its entirety with a random pattern followed by a read back for verification.
      - title: Treatment of non-volatile erasable and electrically erasable programmable read-only memory media following sanitisation
        props:
        - name: sort-id
          value: "catalog[1].group[14].group[2].group[08]"
        parts:
        - name: overview
          prose: "As little research has been conducted into the recovery of data from non-volatile EPROM and EEPROM media, SECRET and TOP SECRET EPROM and EEPROM media retains its classification following sanitisation."
        controls:
        - id: ism-0358
          class: ISM-control
          title: "Control: ism-0358"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[2].group[08].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0358_smt
            name: statement
            prose: "Following sanitisation, SECRET and TOP SECRET non-volatile EPROM and EEPROM media retains its classification."
      - title: Non-volatile flash memory media sanitisation
        props:
        - name: sort-id
          value: "catalog[1].group[14].group[2].group[09]"
        parts:
        - name: overview
          prose: "For non-volatile flash memory media, a technique known as wear levelling ensures that writes are distributed evenly across each memory block. This feature necessitates non-volatile flash memory media being overwritten with a random pattern twice as this helps to ensure that all memory blocks are overwritten."
        controls:
        - id: ism-0359
          class: ISM-control
          title: "Control: ism-0359"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[2].group[09].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0359_smt
            name: statement
            prose: Non-volatile flash memory media is sanitised by overwriting it at least twice in its entirety with a random pattern followed by a read back for verification.
      - title: Treatment of non-volatile flash memory media following sanitisation
        props:
        - name: sort-id
          value: "catalog[1].group[14].group[2].group[10]"
        parts:
        - name: overview
          prose: "Due to the use of wear levelling in non-volatile flash memory media, and the potentially for bad memory blocks, it is possible that not all memory blocks will be overwritten during sanitisation processes. For this reason, SECRET and TOP SECRET non-volatile flash memory media retains its classification following sanitisation."
        controls:
        - id: ism-0360
          class: ISM-control
          title: "Control: ism-0360"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[2].group[10].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0360_smt
            name: statement
            prose: "Following sanitisation, SECRET and TOP SECRET non-volatile flash memory media retains its classification."
      - title: Media that cannot be successfully sanitised
        props:
        - name: sort-id
          value: "catalog[1].group[14].group[2].group[11]"
        parts:
        - name: overview
          prose: "In some cases, sanitisation processes will be unsuccessful due to faulty or damaged media. In such cases, the faulty or damage media will need to be destroyed prior to its disposal."
        controls:
        - id: ism-1735
          class: ISM-control
          title: "Control: ism-1735"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[2].group[11].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1735_smt
            name: statement
            prose: Faulty or damaged media that cannot be successfully sanitised is destroyed prior to its disposal.
    - title: Media destruction
      props:
      - name: sort-id
        value: "catalog[1].group[14].group[3]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on cyber supply chain risk management can be found in the cyber supply chain risk management section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).
      groups:
      - title: Media destruction processes and procedures
        props:
        - name: sort-id
          value: "catalog[1].group[14].group[3].group[1]"
        parts:
        - name: overview
          prose: "Developing, implementing and maintaining processes and procedures for media destruction will ensure that an organisation carries out media destruction in an appropriate and consistent manner."
        controls:
        - id: ism-0363
          class: ISM-control
          title: "Control: ism-0363"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[3].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0363_smt
            name: statement
            prose: "Media destruction processes, and supporting media destruction procedures, are developed, implemented and maintained."
      - title: Media that cannot be sanitised
        props:
        - name: sort-id
          value: "catalog[1].group[14].group[3].group[2]"
        parts:
        - name: overview
          prose: "Some media types are incapable of being sanitised. As such, they will need to be destroyed prior to their disposal."
        controls:
        - id: ism-0350
          class: ISM-control
          title: "Control: ism-0350"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[3].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0350_smt
            name: statement
            prose: |-
              The following media types are destroyed prior to their disposal:

              * microfiche and microfilm
              * optical discs
              * programmable read-only memory
              * read-only memory
              * other types of media that cannot be sanitised.
      - title: Media destruction equipment
        props:
        - name: sort-id
          value: "catalog[1].group[14].group[3].group[3]"
        parts:
        - name: overview
          prose: |-
            When physically destroying media, using approved equipment can provide a level of assurance that the data it stores is actually destroyed.

            Approved equipment includes destruction equipment listed on the Security Construction and Equipment Committee’s
            [Security Equipment Evaluated Products List](#f7e13f7b-eb48-4294-bd01-9c22c756d96b), and in the Australian Security Intelligence Organisation (ASIO)’s Security Equipment Guide-009, Optical Media Shredders and Security Equipment Guide-018, Destructors. ASIO’s Security Equipment Guides are available from the Protective Security Policy GovTEAMS community or ASIO by email.

            If using degaussers to destroy media, the United States’ National Security Agency maintains the
            [NSA/CSS Evaluated Products List for Magnetic Degaussers](#b0a56885-8484-42d6-af79-4c87237ede30) and information on common types of magnetic media and their associated magnetic field strengths and orientations.
        controls:
        - id: ism-1361
          class: ISM-control
          title: "Control: ism-1361"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[3].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1361_smt
            name: statement
            prose: Security Construction and Equipment Committee-approved equipment or ASIO-approved equipment is used when destroying media.
        - id: ism-1160
          class: ISM-control
          title: "Control: ism-1160"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[3].group[3].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Aug-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1160_smt
            name: statement
            prose: "If using degaussers to destroy media, degaussers evaluated by the United States’ National Security Agency are used."
      - title: Media destruction methods
        props:
        - name: sort-id
          value: "catalog[1].group[14].group[3].group[4]"
        parts:
        - name: overview
          prose: The destruction methods identified below are designed to ensure that recovery of data is impossible or impractical.
        controls:
        - id: ism-1517
          class: ISM-control
          title: "Control: ism-1517"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[3].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1517_smt
            name: statement
            prose: "Equipment that is capable of reducing microform to a fine powder, with resultant particles not showing more than five consecutive characters per particle upon microscopic inspection, is used to destroy microfiche and microfilm."
        - id: ism-1722
          class: ISM-control
          title: "Control: ism-1722"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[3].group[4].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1722_smt
            name: statement
            prose: "Electrostatic memory devices are destroyed using a furnace/incinerator, hammer mill, disintegrator or grinder/sander."
        - id: ism-1723
          class: ISM-control
          title: "Control: ism-1723"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[3].group[4].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1723_smt
            name: statement
            prose: "Magnetic floppy disks are destroyed using a furnace/incinerator, hammer mill, disintegrator, degausser or by cutting."
        - id: ism-1724
          class: ISM-control
          title: "Control: ism-1724"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[3].group[4].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1724_smt
            name: statement
            prose: "Magnetic hard disks are destroyed using a furnace/incinerator, hammer mill, disintegrator, grinder/sander or degausser."
        - id: ism-1725
          class: ISM-control
          title: "Control: ism-1725"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[3].group[4].control[5]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1725_smt
            name: statement
            prose: "Magnetic tapes are destroyed using a furnace/incinerator, hammer mill, disintegrator, degausser or by cutting."
        - id: ism-1726
          class: ISM-control
          title: "Control: ism-1726"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[3].group[4].control[6]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1726_smt
            name: statement
            prose: "Optical disks are destroyed using a furnace/incinerator, hammer mill, disintegrator, grinder/sander or by cutting."
        - id: ism-1727
          class: ISM-control
          title: "Control: ism-1727"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[3].group[4].control[7]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1727_smt
            name: statement
            prose: "Semiconductor memory is destroyed using a furnace/incinerator, hammer mill or disintegrator."
        - id: ism-0368
          class: ISM-control
          title: "Control: ism-0368"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[3].group[4].control[8]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "8"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0368_smt
            name: statement
            prose: "Media destroyed using a hammer mill, disintegrator, grinder/sander or by cutting results in media waste particles no larger than 9 mm."
      - title: Treatment of media waste particles
        props:
        - name: sort-id
          value: "catalog[1].group[14].group[3].group[5]"
        parts:
        - name: overview
          prose: "Following the destruction of SECRET and TOP SECRET media, normal accounting and verification processes and procedures do not apply. However, depending on the destruction method used, and the resulting media waste particle size, it may still need to be stored and handled as classified waste."
        controls:
        - id: ism-1729
          class: ISM-control
          title: "Control: ism-1729"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[3].group[5].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1729_smt
            name: statement
            prose: "The resulting media waste particles from the destruction of TOP SECRET media is stored and handled as OFFICIAL if less than or equal to 3 mm, or SECRET if greater than 3 mm and less than or equal to 9 mm."
      - title: Degaussing magnetic media
        props:
        - name: sort-id
          value: "catalog[1].group[14].group[3].group[6]"
        parts:
        - name: overview
          prose: "Degaussing magnetic media changes its magnetic properties, thereby, permanently corrupting data. When degaussing magnetic media, care needs to be taken as a degausser of insufficient magnetic field strength will not be effective. In addition, since 2006 perpendicular magnetic media has progressively replaced longitudinal magnetic media. As some older degaussers are only capable of destroying longitudinal magnetic media, care needs to be taken to ensure that a degausser with a suitable magnetic orientation is also used. Furthermore, to ensure that degaussers are being used in the correct manner to effectively destroy magnetic media, product-specific directions provided by degausser manufacturers should be followed. Finally, to provide an additional level of assurance following the use of a degausser, magnetic media should be physically damaged by deforming any internal platters."
        controls:
        - id: ism-0361
          class: ISM-control
          title: "Control: ism-0361"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[3].group[6].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0361_smt
            name: statement
            prose: Magnetic media is destroyed using a degausser with a suitable magnetic field strength and magnetic orientation.
        - id: ism-0362
          class: ISM-control
          title: "Control: ism-0362"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[3].group[6].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0362_smt
            name: statement
            prose: Product-specific directions provided by degausser manufacturers are followed.
        - id: ism-1641
          class: ISM-control
          title: "Control: ism-1641"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[3].group[6].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1641_smt
            name: statement
            prose: "Following the use of a degausser, magnetic media is physically damaged by deforming any internal platters."
      - title: Supervision of destruction
        props:
        - name: sort-id
          value: "catalog[1].group[14].group[3].group[7]"
        parts:
        - name: overview
          prose: "To verify that media is appropriately destroyed, destruction processes need to be supervised by at least one person cleared to the sensitivity or classification of the media being destroyed."
        controls:
        - id: ism-0370
          class: ISM-control
          title: "Control: ism-0370"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[3].group[7].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0370_smt
            name: statement
            prose: The destruction of media is performed under the supervision of at least one person cleared to its sensitivity or classification.
        - id: ism-0371
          class: ISM-control
          title: "Control: ism-0371"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[3].group[7].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0371_smt
            name: statement
            prose: Personnel supervising the destruction of media supervise its handling to the point of destruction and ensure that the destruction is completed successfully.
      - title: Supervision of accountable material destruction
        props:
        - name: sort-id
          value: "catalog[1].group[14].group[3].group[8]"
        parts:
        - name: overview
          prose: "The successful destruction of media storing accountable material is more important than for other media. As such, its destruction should be supervised by at least two personnel who sign a destruction certificate afterwards."
        controls:
        - id: ism-0372
          class: ISM-control
          title: "Control: ism-0372"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[3].group[8].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: O
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: P
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0372_smt
            name: statement
            prose: The destruction of media storing accountable material is performed under the supervision of at least two personnel cleared to its sensitivity or classification.
        - id: ism-0373
          class: ISM-control
          title: "Control: ism-0373"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[3].group[8].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: O
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: P
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0373_smt
            name: statement
            prose: "Personnel supervising the destruction of media storing accountable material supervise its handling to the point of destruction, ensure that the destruction is completed successfully and sign a destruction certificate afterwards."
      - title: Outsourcing media destruction
        props:
        - name: sort-id
          value: "catalog[1].group[14].group[3].group[9]"
        parts:
        - name: overview
          prose: "While media storing accountable material cannot be outsourced, media storing non-accountable material can be outsourced when using a National Association for Information Destruction AAA certified destruction service with endorsements, as specified in ASIO’s Protective Security Circular-167, External destruction of security classified information. This publication is available from the Protective Security Policy GovTEAMS community or ASIO by email."
        controls:
        - id: ism-0839
          class: ISM-control
          title: "Control: ism-0839"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[3].group[9].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: O
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: P
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0839_smt
            name: statement
            prose: The destruction of media storing accountable material is not outsourced.
    - title: Media disposal
      props:
      - name: sort-id
        value: "catalog[1].group[14].group[4]"
      groups:
      - title: Media disposal processes and procedures
        props:
        - name: sort-id
          value: "catalog[1].group[14].group[4].group[1]"
        parts:
        - name: overview
          prose: "Developing, implementing and maintaining processes and procedures for media disposal will ensure that an organisation carries out media disposal in an appropriate and consistent manner."
        controls:
        - id: ism-0374
          class: ISM-control
          title: "Control: ism-0374"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[4].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0374_smt
            name: statement
            prose: "Media disposal processes, and supporting media disposal procedures, are developed, implemented and maintained."
      - title: Disposal of media
        props:
        - name: sort-id
          value: "catalog[1].group[14].group[4].group[2]"
        parts:
        - name: overview
          prose: "Before media can be released into the public domain, it needs to be sanitised, destroyed or declassified. As sanitised, destroyed or declassified media still presents a security risk, albeit very minor, an appropriate authority needs to formally authorise its release into the public domain. Furthermore, as part of disposal processes, removing labels and markings indicating the owner, sensitivity, classification or any other marking that can associate media with its prior use will ensure it does not draw undue attention following its disposal."
        controls:
        - id: ism-0378
          class: ISM-control
          title: "Control: ism-0378"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[4].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0378_smt
            name: statement
            prose: "Labels and markings indicating the owner, sensitivity, classification or any other marking that can associate media with its prior use are removed prior to its disposal."
        - id: ism-0375
          class: ISM-control
          title: "Control: ism-0375"
          props:
          - name: sort-id
            value: "catalog[1].group[14].group[4].group[2].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0375_smt
            name: statement
            prose: "Following sanitisation, destruction or declassification, a formal administrative decision is made to release media, or its waste, into the public domain."
  - title: Guidelines for System Hardening
    props:
    - name: sort-id
      value: "catalog[1].group[15]"
    groups:
    - title: Operating system hardening
      props:
      - name: sort-id
        value: "catalog[1].group[15].group[1]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on cyber supply chain risk management can be found in the cyber supply chain risk management section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).

          Further information on patching or updating operating systems can be found in the system patching section of the
          [Guidelines for System Management](#c6ca6620-ccd5-4c5d-b97c-9d92f1162948).

          Further information on securely configuring Microsoft Windows operating systems can be found in the ACSC’s
          [Hardening Microsoft Windows 10 version 21H1 Workstations](#6e801c68-61f6-4c28-bf72-df91f7e232cc) publication.

          Further information on securely configuring Linux workstations and servers can be found in the ACSC’s
          [Hardening Linux Workstations and Servers](#8132c47e-a2dc-4dd9-81d6-38db96e5cec6) publication.

          Further information on
          [exploit protection functionality](#d0df96bb-7236-4784-8f54-2cb6335ad228) within Microsoft Windows is available from Microsoft.

          Further information on implementing application control can be found in the ACSC’s
          [Implementing Application Control](#4eeff329-cea0-4baf-a80b-8b0b76436075) publication.

          Further information on Microsoft’s ‘
          [recommended block rules](#5a2ed3ef-afcc-485e-8014-5107e9ed97e3)’ and ‘
          [recommended driver block rules](#4a3a265f-7772-433b-9906-7f784052f28b)’ are available from Microsoft.

          Further information on the use of PowerShell can be found in the ACSC’s
          [Securing PowerShell in the Enterprise](#8ffea524-0974-4b53-a8f5-41166073ede5) publication.

          Further information on
          [the use of PowerShell by blue teams](#7d22400c-ddef-4cbb-90f1-7502dc569e5b) is available from Microsoft while further information on obtaining
          [greater visibility through PowerShell logging](#af0810aa-3486-4ca6-a48a-fad8ce9ac193) is available from Mandiant.

          Further information on independent testing of security products’ ability to
          [detect or prevent various stages of network intrusions](#3a1a00f6-2f56-4d04-b99d-6f1682b95a98) is available from The MITRE Corporation.

          Further information on independent testing of antivirus software is available from
          [AV-Comparatives](#c852e735-4920-4616-8e34-2fddfb49eea8) and
          [AV-TEST](#18203e18-2aca-492e-be44-770b2f47242f).

          Further information on the use of removable media can be found in the media usage section of the
          [Guidelines for Media](#b594c9c0-b42f-4f06-b643-38023275a5c7).

          Further information on event logging can be found in the event logging and monitoring section of the
          [Guidelines for System Monitoring](#edc24216-f52b-4513-bcda-5fa564661999).
      groups:
      - title: Operating system selection
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[1].group[01]"
        parts:
        - name: overview
          prose: "When selecting operating systems, it is important that an organisation preferences vendors that have demonstrated a commitment to secure-by-design and secure-by-default principles, use of memory-safe programming languages where possible (such as C#, Go, Java, Ruby, Rust and Swift), secure programming practices, and maintaining the security of their products. This will assist not only with reducing the potential number of security vulnerabilities in operating systems, but also increasing the likelihood that timely patches, updates or vendor mitigations will be released to remediate any security vulnerabilities that are found."
        controls:
        - id: ism-1743
          class: ISM-control
          title: "Control: ism-1743"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[01].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1743_smt
            name: statement
            prose: "Operating systems are chosen from vendors that have demonstrated a commitment to secure-by-design and secure-by-default principles, use of memory-safe programming languages where possible, secure programming practices, and maintaining the security of their products."
      - title: Operating system releases and versions
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[1].group[02]"
        parts:
        - name: overview
          prose: "Newer releases of operating systems often introduce improvements in security functionality. This can make it more difficult for an adversary to craft reliable exploits for security vulnerabilities they discover. Using older releases of operating systems, especially those no longer supported by vendors, may expose an organisation to security vulnerabilities or exploitation techniques that have since been mitigated. In addition, 64-bit versions of operating systems support additional security functionality that 32-bit versions do not."
        controls:
        - id: ism-1407
          class: ISM-control
          title: "Control: ism-1407"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[02].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1407_smt
            name: statement
            prose: "The latest release, or the previous release, of operating systems are used."
        - id: ism-1408
          class: ISM-control
          title: "Control: ism-1408"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[02].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1408_smt
            name: statement
            prose: "Where supported, 64-bit versions of operating systems are used."
      - title: Standard Operating Environments
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[1].group[03]"
        parts:
        - name: overview
          prose: |-
            Allowing users to setup, configure and maintain their own workstations and servers can result in an inconsistent operating environment. Such operating environments may assist an adversary in gaining an initial foothold on networks due to the higher likelihood of poorly configured or maintained workstations and servers. Conversely, a Standard Operating Environment (SOE), provided via an automated build process or a golden image, is designed to facilitate a standardised and consistent operating environment within an organisation.

            When SOEs are obtained from third parties, such as service providers, there are additional cyber supply chain risks that should be considered, such as the accidental or deliberate inclusion of malicious code or configurations. To reduce the likelihood of such occurrences, an organisation should endeavour to obtain their SOEs from trusted third parties while also scanning them for malicious code and configurations.

            As operating environments naturally change over time, such as patches or updates are applied, configurations are changed, and applications are added or removed, it is essential that SOEs are reviewed and updated at least annually to ensure that an up-to-date baseline is maintained.
        controls:
        - id: ism-1406
          class: ISM-control
          title: "Control: ism-1406"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[03].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Aug-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1406_smt
            name: statement
            prose: SOEs are used for workstations and servers.
        - id: ism-1608
          class: ISM-control
          title: "Control: ism-1608"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[03].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1608_smt
            name: statement
            prose: SOEs provided by third parties are scanned for malicious code and configurations.
        - id: ism-1588
          class: ISM-control
          title: "Control: ism-1588"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[03].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Aug-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1588_smt
            name: statement
            prose: SOEs are reviewed and updated at least annually.
      - title: Hardening operating system configurations
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[1].group[04]"
        parts:
        - name: overview
          prose: "When operating systems are deployed in their default state it can lead to an insecure operating environment that may allow an adversary to gain an initial foothold on networks. Many configuration settings exist within operating systems to allow them to be configured in a secure state in order to minimise this security risk. As such, the Australian Cyber Security Centre (ACSC) and vendors often produce guidance to assist in hardening the configuration of operating systems. Note, however, in situations where ACSC and vendor guidance conflicts, preference should be given to implementing ACSC hardening guidance."
        controls:
        - id: ism-1409
          class: ISM-control
          title: "Control: ism-1409"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[04].control[01]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1409_smt
            name: statement
            prose: ACSC and vendor guidance is implemented to assist in hardening the configuration of operating systems.
        - id: ism-0380
          class: ISM-control
          title: "Control: ism-0380"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[04].control[02]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "9"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0380_smt
            name: statement
            prose: "Unneeded accounts, components, services and functionality of operating systems are disabled or removed."
        - id: ism-0383
          class: ISM-control
          title: "Control: ism-0383"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[04].control[03]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "8"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0383_smt
            name: statement
            prose: "Default accounts or credentials for operating systems, including for any pre-configured accounts, are changed."
        - id: ism-0341
          class: ISM-control
          title: "Control: ism-0341"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[04].control[04]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0341_smt
            name: statement
            prose: Automatic execution features for removable media are disabled.
        - id: ism-1654
          class: ISM-control
          title: "Control: ism-1654"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[04].control[05]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1654_smt
            name: statement
            prose: Internet Explorer 11 is disabled or removed.
        - id: ism-1655
          class: ISM-control
          title: "Control: ism-1655"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[04].control[06]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1655_smt
            name: statement
            prose: .NET Framework 3.5 (includes .NET 2.0 and 3.0) is disabled or removed.
        - id: ism-1492
          class: ISM-control
          title: "Control: ism-1492"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[04].control[07]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1492_smt
            name: statement
            prose: Operating system exploit protection functionality is enabled.
        - id: ism-1745
          class: ISM-control
          title: "Control: ism-1745"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[04].control[08]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1745_smt
            name: statement
            prose: "Early Launch Antimalware, Secure Boot, Trusted Boot and Measured Boot functionality is enabled."
        - id: ism-1584
          class: ISM-control
          title: "Control: ism-1584"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[04].control[09]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1584_smt
            name: statement
            prose: "Unprivileged users are prevented from bypassing, disabling or modifying security functionality of operating systems."
        - id: ism-1491
          class: ISM-control
          title: "Control: ism-1491"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[04].control[10]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1491_smt
            name: statement
            prose: |-
              Unprivileged users are prevented from running script execution engines, including:

              * Windows Script Host (cscript.exe and wscript.exe)
              * PowerShell (powershell.exe, powershell_ise.exe and pwsh.exe)
              * Command Prompt (cmd.exe)
              * Windows Management Instrumentation (wmic.exe)
              * Microsoft Hypertext Markup Language (HTML) Application Host (mshta.exe).
      - title: Application management
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[1].group[05]"
        parts:
        - name: overview
          prose: "Unprivileged users’ ability to install any application can be exploited by an adversary using social engineering in order to convince them to install a malicious application. One way to mitigate this security risk, while also removing burden from system administrators, is to allow unprivileged users the ability to install approved applications from organisation-managed software repositories or from trusted application marketplaces. Furthermore, to prevent unprivileged users from removing security functionality, or breaking system functionality, unprivileged users should not have the ability to uninstall or disable approved software."
        controls:
        - id: ism-1592
          class: ISM-control
          title: "Control: ism-1592"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[05].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1592_smt
            name: statement
            prose: Unprivileged users do not have the ability to install unapproved software.
        - id: ism-0382
          class: ISM-control
          title: "Control: ism-0382"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[05].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0382_smt
            name: statement
            prose: Unprivileged users do not have the ability to uninstall or disable approved software.
      - title: Application control
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[1].group[06]"
        parts:
        - name: overview
          prose: |-
            Application control can be an effective way to not only prevent malicious code from executing on workstations and servers, but also to ensure only approved applications can execute. When developing application control rulesets, determining approved executables (e.g. .exe and .com files), software libraries (e.g. .dll and.ocx files), scripts (e.g. .ps1, .bat, .cmd, .vbs and .js files), installers (e.g. .msi, .msp and .mst files), compiled HTML (e.g. .chm), HTML applications (e.g. .hta), control panel applets (e.g. .cpl) and drivers based on business requirements is a more secure method than simply approving those already residing on a workstation or server. Furthermore, it is preferable that an organisation defines their own application control rulesets, rather than relying on those from application control vendors, and validate them on an annual or more frequent basis.

            In implementing application control, an organisation should use a reliable method, or combination of methods, such as cryptographic hash rules, publisher certificate rules or path rules. Depending on the method chosen, further hardening may be required to ensure that application control mechanisms and application control rulesets cannot be bypassed by an adversary.

            Finally, application control event logs can assist in monitoring the security posture of systems, detecting malicious behaviour and contributing to investigations following cyber security incidents. To facilitate such activities, application control event logs should be captured and stored centrally.
        controls:
        - id: ism-0843
          class: ISM-control
          title: "Control: ism-0843"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[06].control[01]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "9"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-0843_smt
            name: statement
            prose: Application control is implemented on workstations.
        - id: ism-1490
          class: ISM-control
          title: "Control: ism-1490"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[06].control[02]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1490_smt
            name: statement
            prose: Application control is implemented on internet-facing servers.
        - id: ism-1656
          class: ISM-control
          title: "Control: ism-1656"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[06].control[03]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1656_smt
            name: statement
            prose: Application control is implemented on non-internet-facing servers.
        - id: ism-1657
          class: ISM-control
          title: "Control: ism-1657"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[06].control[04]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1657_smt
            name: statement
            prose: "Application control restricts the execution of executables, software libraries, scripts, installers, compiled HTML, HTML applications and control panel applets to an organisation-approved set."
        - id: ism-1658
          class: ISM-control
          title: "Control: ism-1658"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[06].control[05]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1658_smt
            name: statement
            prose: Application control restricts the execution of drivers to an organisation-approved set.
        - id: ism-0955
          class: ISM-control
          title: "Control: ism-0955"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[06].control[06]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Apr-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0955_smt
            name: statement
            prose: "Application control is implemented using cryptographic hash rules, publisher certificate rules or path rules."
        - id: ism-1582
          class: ISM-control
          title: "Control: ism-1582"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[06].control[07]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1582_smt
            name: statement
            prose: Application control rulesets are validated on an annual or more frequent basis.
        - id: ism-1471
          class: ISM-control
          title: "Control: ism-1471"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[06].control[08]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Apr-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1471_smt
            name: statement
            prose: "When implementing application control using publisher certificate rules, both publisher names and product names are used."
        - id: ism-1392
          class: ISM-control
          title: "Control: ism-1392"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[06].control[09]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1392_smt
            name: statement
            prose: "When implementing application control using path rules, only approved users can modify approved files and write to approved folders."
        - id: ism-1746
          class: ISM-control
          title: "Control: ism-1746"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[06].control[10]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1746_smt
            name: statement
            prose: "When implementing application control using path rules, only approved users can change file system permissions for approved files and folders."
        - id: ism-1544
          class: ISM-control
          title: "Control: ism-1544"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[06].control[11]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1544_smt
            name: statement
            prose: Microsoft’s ‘recommended block rules’ are implemented.
        - id: ism-1659
          class: ISM-control
          title: "Control: ism-1659"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[06].control[12]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1659_smt
            name: statement
            prose: Microsoft’s ‘recommended driver block rules’ are implemented.
        - id: ism-0846
          class: ISM-control
          title: "Control: ism-0846"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[06].control[13]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "8"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0846_smt
            name: statement
            prose: "All users (with the exception of local administrator accounts and break glass accounts) cannot disable, bypass or be exempted from application control."
        - id: ism-1660
          class: ISM-control
          title: "Control: ism-1660"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[06].control[14]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1660_smt
            name: statement
            prose: Allowed and blocked execution events on workstations are logged.
        - id: ism-1661
          class: ISM-control
          title: "Control: ism-1661"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[06].control[15]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1661_smt
            name: statement
            prose: Allowed and blocked execution events on internet-facing servers are logged.
        - id: ism-1662
          class: ISM-control
          title: "Control: ism-1662"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[06].control[16]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1662_smt
            name: statement
            prose: Allowed and blocked execution events on non-internet-facing servers are logged.
        - id: ism-1663
          class: ISM-control
          title: "Control: ism-1663"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[06].control[17]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1663_smt
            name: statement
            prose: Application control event logs are stored centrally.
      - title: PowerShell
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[1].group[07]"
        parts:
        - name: overview
          prose: |-
            PowerShell is a powerful scripting language developed by Microsoft and, due to its ubiquity and ease with which it can be used to fully control operating systems, is an important part of system administrator toolkits. However, PowerShell can also be a dangerous exploitation tool in the hands of an adversary.

            In order to prevent attacks leveraging security vulnerabilities in earlier PowerShell versions, Windows PowerShell 2.0 should be disabled or removed from operating systems. Additionally, PowerShell’s language mode should be set to Constrained Language Mode to achieve a balance between security and functionality.

            Finally, PowerShell event logs can assist in monitoring the security posture of systems, detecting malicious behaviour and contributing to investigations following cyber security incidents. To facilitate such activities, PowerShell event logs should be captured and stored centrally.
        controls:
        - id: ism-1621
          class: ISM-control
          title: "Control: ism-1621"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[07].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1621_smt
            name: statement
            prose: Windows PowerShell 2.0 is disabled or removed.
        - id: ism-1622
          class: ISM-control
          title: "Control: ism-1622"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[07].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Oct-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1622_smt
            name: statement
            prose: PowerShell is configured to use Constrained Language Mode.
        - id: ism-1623
          class: ISM-control
          title: "Control: ism-1623"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[07].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Oct-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1623_smt
            name: statement
            prose: "PowerShell is configured to use module logging, script block logging and transcription functionality."
        - id: ism-1624
          class: ISM-control
          title: "Control: ism-1624"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[07].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Oct-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1624_smt
            name: statement
            prose: PowerShell script block logs are protected by Protected Event Logging functionality.
        - id: ism-1664
          class: ISM-control
          title: "Control: ism-1664"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[07].control[5]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1664_smt
            name: statement
            prose: Blocked PowerShell script execution events are logged.
        - id: ism-1665
          class: ISM-control
          title: "Control: ism-1665"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[07].control[6]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1665_smt
            name: statement
            prose: PowerShell event logs are stored centrally.
      - title: Host-based Intrusion Prevention System
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[1].group[08]"
        parts:
        - name: overview
          prose: "Many security products rely on signatures to detect malicious code. This approach is only effective when malicious code has already been profiled and signatures are available from security vendors. Unfortunately, an adversary can easily create variants of known malicious code in order to bypass traditional signature-based detection. A Host-based Intrusion Prevention System (HIPS) can use behaviour-based detection to assist in identifying and blocking anomalous behaviour as well as detecting malicious code that has yet to be identified by security vendors. As such, it is important that a HIPS is implemented on workstations, critical servers and high-value servers."
        controls:
        - id: ism-1341
          class: ISM-control
          title: "Control: ism-1341"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[08].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1341_smt
            name: statement
            prose: A HIPS is implemented on workstations.
        - id: ism-1034
          class: ISM-control
          title: "Control: ism-1034"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[08].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1034_smt
            name: statement
            prose: A HIPS is implemented on critical servers and high-value servers.
      - title: Software firewall
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[1].group[09]"
        parts:
        - name: overview
          prose: "Traditional network firewalls often fail to prevent the propagation of malicious code on networks, or an adversary from exfiltrating data from networks, as they only control which ports or protocols can be used between different network segments. Many forms of malicious code are designed specifically to take advantage of this by using common protocols, such as Hypertext Transfer Protocol, Hypertext Transfer Protocol Secure, Simple Mail Transfer Protocol or Domain Name System. Software firewalls are more effective than traditional network firewalls as they can control which applications and services can communicate to and from workstations and servers. As such, a software firewall should be implemented on workstations and servers to restrict inbound and outbound network connections to an organisation-approved set of applications and services."
        controls:
        - id: ism-1416
          class: ISM-control
          title: "Control: ism-1416"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[09].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1416_smt
            name: statement
            prose: A software firewall is implemented on workstations and servers to restrict inbound and outbound network connections to an organisation-approved set of applications and services.
      - title: Antivirus software
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[1].group[10]"
        parts:
        - name: overview
          prose: "When vendors develop software they may make coding mistakes that lead to security vulnerabilities. An adversary can take advantage of this by developing malicious code to exploit any security vulnerabilities that have not been detected and remedied by vendors. As significant time and effort is often involved in developing functioning and reliable exploits, an adversary will often attempt to reuse their exploits as much as possible. While exploits may have been previously identified by security vendors, they often remain viable against an organisation that does not have antivirus software in place."
        controls:
        - id: ism-1417
          class: ISM-control
          title: "Control: ism-1417"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[10].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1417_smt
            name: statement
            prose: |-
              Antivirus software is implemented on workstations and servers with:

              * signature-based detection functionality enabled and set to a high level
              * heuristic-based detection functionality enabled and set to a high level
              * reputation rating functionality enabled
              * ransomware protection functionality enabled
              * detection signatures configured to update on at least a daily basis
              * regular scanning configured for all fixed disks and removable media.
      - title: Device access control software
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[1].group[11]"
        parts:
        - name: overview
          prose: |-
            Device access control software can be used to prevent removable media and mobile devices from being connected to workstations and servers via external communication interfaces. This can assist in preventing the introduction of malicious code or the exfiltration of data by an adversary.

            In addition, an adversary can connect to locked workstations and servers via external communication interfaces that allow Direct Memory Access (DMA). In doing so, the adversary can gain access to encryption keys in memory or write malicious code to memory. The best defence against this security risk is to disable access to external communication interfaces that allow DMA, such as FireWire, ExpressCard and Thunderbolt.
        controls:
        - id: ism-1418
          class: ISM-control
          title: "Control: ism-1418"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[11].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1418_smt
            name: statement
            prose: "If there is no business requirement for reading from removable media and devices, such functionality is disabled via the use of device access control software or by disabling external communication interfaces."
        - id: ism-0343
          class: ISM-control
          title: "Control: ism-0343"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[11].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0343_smt
            name: statement
            prose: "If there is no business requirement for writing to removable media and devices, such functionality is disabled via the use of device access control software or by disabling external communication interfaces."
        - id: ism-0345
          class: ISM-control
          title: "Control: ism-0345"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[11].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0345_smt
            name: statement
            prose: External communication interfaces that allow DMA are disabled.
      - title: Operating system event logging
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[1].group[12]"
        parts:
        - name: overview
          prose: "Operating system events can assist in monitoring the security posture of systems, detecting malicious behaviour and contributing to investigations following cyber security incidents. To facilitate such activities, operating system event logs should be captured and stored centrally."
        controls:
        - id: ism-0582
          class: ISM-control
          title: "Control: ism-0582"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[12].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0582_smt
            name: statement
            prose: |-
              The following events are logged for operating systems:

              * application and operating system crashes and error messages
              * changes to security policies and system configurations
              * successful user logons and logoffs, failed user logons and account lockouts
              * failures, restarts and changes to important processes and services
              * requests to access internet resources
              * security product-related events
              * system startups and shutdowns.
        - id: ism-1747
          class: ISM-control
          title: "Control: ism-1747"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[1].group[12].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1747_smt
            name: statement
            prose: Operating system event logs are stored centrally.
    - title: User application hardening
      props:
      - name: sort-id
        value: "catalog[1].group[15].group[2]"
      parts:
      - name: overview
        prose: |-
          # User applications

          This section is applicable to applications typically installed on user workstations, such as office productivity suites, web browsers and their extensions, email clients, Portable Document Format (PDF) software, and security products (e.g. antivirus software, device access control software, HIPS and software firewalls). Information on server applications can be found in the server application hardening section of these guidelines.

          # Further information

          Further information on cyber supply chain risk management can be found in the cyber supply chain risk management section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).

          Further information on patching or updating user applications can be found in the system patching section of the
          [Guidelines for System Management](#c6ca6620-ccd5-4c5d-b97c-9d92f1162948).

          Further information on the implementation and configuration of security products can be found in the operating system hardening section of these guidelines.

          Further information on securely configuring Microsoft Office can be found in the ACSC’s
          [Hardening Microsoft 365, Office 2021, Office 2019 and Office 2016](#58c9abfb-58fe-416e-a279-dfbfe123c99f) publication.

          Further information on configuring Microsoft Office macro settings can be found in the ACSC’s
          [Microsoft Office Macro Security](#dfb52998-0e7e-420d-97e1-d1313c8f919a) publication.

          Further information on event logging can be found in the event logging and monitoring section of the
          [Guidelines for System Monitoring](#edc24216-f52b-4513-bcda-5fa564661999).
      groups:
      - title: User application selection
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[2].group[1]"
        parts:
        - name: overview
          prose: "When selecting user applications, it is important that an organisation preferences vendors that have demonstrated a commitment to secure-by-design and secure-by-default principles, use of memory-safe programming languages where possible (such as C#, Go, Java, Ruby, Rust and Swift), secure programming practices, and maintaining the security of their products. This will assist not only with reducing the potential number of security vulnerabilities in user applications, but also increasing the likelihood that timely patches, updates or vendor mitigations will be released to remediate any security vulnerabilities that are found."
        controls:
        - id: ism-0938
          class: ISM-control
          title: "Control: ism-0938"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[2].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0938_smt
            name: statement
            prose: "User applications are chosen from vendors that have demonstrated a commitment to secure-by-design and secure-by-default principles, use of memory-safe programming languages where possible, secure programming practices, and maintaining the security of their products."
      - title: User application releases
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[2].group[2]"
        parts:
        - name: overview
          prose: "Newer releases of user applications often introduce improvements in security functionality. This can make it more difficult for an adversary to craft reliable exploits for security vulnerabilities they discover. Using older releases of user applications, especially those no longer supported by vendors, may expose an organisation to security vulnerabilities or exploitation techniques that have since been mitigated. This is particularly important for office productivity suites, web browsers and their extensions, email clients, PDF software, and security products."
        controls:
        - id: ism-1467
          class: ISM-control
          title: "Control: ism-1467"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[2].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1467_smt
            name: statement
            prose: "The latest release of office productivity suites, web browsers and their extensions, email clients, PDF software, and security products are used."
      - title: Hardening user application configurations
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[2].group[3]"
        parts:
        - name: overview
          prose: "When user applications are deployed in their default state it can lead to an insecure operating environment that may allow an adversary to gain an initial foothold on networks. This can be especially risky for office productivity suites, web browsers and their extensions, email clients, PDF software, and security products as such applications are routinely targeted for exploitation. Many configuration settings exist within such applications to allow them to be configured in a secure state in order to minimise this security risk. As such, the ACSC and vendors often produce guidance to assist in hardening the configuration of these applications. Note, however, in situations where ACSC and vendor guidance conflicts, preference should be given to implementing ACSC hardening guidance."
        controls:
        - id: ism-1806
          class: ISM-control
          title: "Control: ism-1806"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[2].group[3].control[01]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1806_smt
            name: statement
            prose: "Default accounts or credentials for user applications, including for any pre-configured accounts, are changed."
        - id: ism-1412
          class: ISM-control
          title: "Control: ism-1412"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[2].group[3].control[02]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1412_smt
            name: statement
            prose: "ACSC or vendor hardening guidance for web browsers, Microsoft Office and PDF software is implemented."
        - id: ism-1470
          class: ISM-control
          title: "Control: ism-1470"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[2].group[3].control[03]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1470_smt
            name: statement
            prose: "Unneeded components, services and functionality of office productivity suites, web browsers, email clients, PDF software and security products are disabled or removed."
        - id: ism-1235
          class: ISM-control
          title: "Control: ism-1235"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[2].group[3].control[04]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1235_smt
            name: statement
            prose: "Add-ons, extensions and plug-ins for office productivity suites, web browsers, email clients, PDF software and security products are restricted to an organisation-approved set."
        - id: ism-1667
          class: ISM-control
          title: "Control: ism-1667"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[2].group[3].control[05]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1667_smt
            name: statement
            prose: Microsoft Office is blocked from creating child processes.
        - id: ism-1668
          class: ISM-control
          title: "Control: ism-1668"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[2].group[3].control[06]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1668_smt
            name: statement
            prose: Microsoft Office is blocked from creating executable content.
        - id: ism-1669
          class: ISM-control
          title: "Control: ism-1669"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[2].group[3].control[07]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1669_smt
            name: statement
            prose: Microsoft Office is blocked from injecting code into other processes.
        - id: ism-1542
          class: ISM-control
          title: "Control: ism-1542"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[2].group[3].control[08]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jan-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1542_smt
            name: statement
            prose: Microsoft Office is configured to prevent activation of Object Linking and Embedding packages.
        - id: ism-1823
          class: ISM-control
          title: "Control: ism-1823"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[2].group[3].control[09]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1823_smt
            name: statement
            prose: Office productivity suite security settings cannot be changed by users.
        - id: ism-1486
          class: ISM-control
          title: "Control: ism-1486"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[2].group[3].control[10]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1486_smt
            name: statement
            prose: Web browsers do not process Java from the internet.
        - id: ism-1485
          class: ISM-control
          title: "Control: ism-1485"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[2].group[3].control[11]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1485_smt
            name: statement
            prose: Web browsers do not process web advertisements from the internet.
        - id: ism-1666
          class: ISM-control
          title: "Control: ism-1666"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[2].group[3].control[12]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          parts:
          - id: ism-1666_smt
            name: statement
            prose: Internet Explorer 11 does not process content from the internet.
        - id: ism-1585
          class: ISM-control
          title: "Control: ism-1585"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[2].group[3].control[13]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1585_smt
            name: statement
            prose: Web browser security settings cannot be changed by users.
        - id: ism-1670
          class: ISM-control
          title: "Control: ism-1670"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[2].group[3].control[14]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1670_smt
            name: statement
            prose: PDF software is blocked from creating child processes.
        - id: ism-1824
          class: ISM-control
          title: "Control: ism-1824"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[2].group[3].control[15]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1824_smt
            name: statement
            prose: PDF software security settings cannot be changed by users.
        - id: ism-1601
          class: ISM-control
          title: "Control: ism-1601"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[2].group[3].control[16]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1601_smt
            name: statement
            prose: Microsoft’s Attack Surface Reduction rules are implemented.
        - id: ism-1748
          class: ISM-control
          title: "Control: ism-1748"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[2].group[3].control[17]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1748_smt
            name: statement
            prose: Email client security settings cannot be changed by users.
        - id: ism-1825
          class: ISM-control
          title: "Control: ism-1825"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[2].group[3].control[18]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1825_smt
            name: statement
            prose: Security product security settings cannot be changed by users.
      - title: Microsoft Office macros
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[2].group[4]"
        parts:
        - name: overview
          prose: |-
            Microsoft Office files can contain embedded code, known as a macro, written in the Visual Basic for Applications programming language. A macro can contain a series of commands that can be coded or recorded and replayed at a later time to automate repetitive tasks. Macros are powerful tools that can be easily created by users to greatly improve their productivity. However, an adversary can also create macros to perform a variety of malicious activities, such as assisting to compromise workstations in order to exfiltrate or deny access to data. To reduce this security risk, an organisation should disable Microsoft Office macros for users that do not have a demonstrated business requirement and secure their use for the remaining users that do.

            Finally, Microsoft Office macro event logs can assist in monitoring the security posture of systems, detecting malicious behaviour and contributing to investigations following cyber security incidents. To facilitate such activities, Microsoft Office macro event logs should be captured and stored centrally.
        controls:
        - id: ism-1671
          class: ISM-control
          title: "Control: ism-1671"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[2].group[4].control[01]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1671_smt
            name: statement
            prose: Microsoft Office macros are disabled for users that do not have a demonstrated business requirement.
        - id: ism-1488
          class: ISM-control
          title: "Control: ism-1488"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[2].group[4].control[02]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1488_smt
            name: statement
            prose: Microsoft Office macros in files originating from the internet are blocked.
        - id: ism-1672
          class: ISM-control
          title: "Control: ism-1672"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[2].group[4].control[03]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1672_smt
            name: statement
            prose: Microsoft Office macro antivirus scanning is enabled.
        - id: ism-1673
          class: ISM-control
          title: "Control: ism-1673"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[2].group[4].control[04]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1673_smt
            name: statement
            prose: Microsoft Office macros are blocked from making Win32 API calls.
        - id: ism-1674
          class: ISM-control
          title: "Control: ism-1674"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[2].group[4].control[05]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1674_smt
            name: statement
            prose: "Only Microsoft Office macros running from within a sandboxed environment, a Trusted Location or that are digitally signed by a trusted publisher are allowed to execute."
        - id: ism-1487
          class: ISM-control
          title: "Control: ism-1487"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[2].group[4].control[06]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1487_smt
            name: statement
            prose: Only privileged users responsible for validating that Microsoft Office macros are free of malicious code can write to and modify content within Trusted Locations.
        - id: ism-1675
          class: ISM-control
          title: "Control: ism-1675"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[2].group[4].control[07]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1675_smt
            name: statement
            prose: Microsoft Office macros digitally signed by an untrusted publisher cannot be enabled via the Message Bar or Backstage View.
        - id: ism-1676
          class: ISM-control
          title: "Control: ism-1676"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[2].group[4].control[08]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1676_smt
            name: statement
            prose: Microsoft Office’s list of trusted publishers is validated on an annual or more frequent basis.
        - id: ism-1489
          class: ISM-control
          title: "Control: ism-1489"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[2].group[4].control[09]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1489_smt
            name: statement
            prose: Microsoft Office macro security settings cannot be changed by users.
        - id: ism-1677
          class: ISM-control
          title: "Control: ism-1677"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[2].group[4].control[10]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1677_smt
            name: statement
            prose: Allowed and blocked Microsoft Office macro execution events are logged.
        - id: ism-1678
          class: ISM-control
          title: "Control: ism-1678"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[2].group[4].control[11]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1678_smt
            name: statement
            prose: Microsoft Office macro event logs are stored centrally.
    - title: Server application hardening
      props:
      - name: sort-id
        value: "catalog[1].group[15].group[3]"
      parts:
      - name: overview
        prose: |-
          # Server applications

          This section is applicable to applications associated with specific server functionality, such as Microsoft Active Directory Domain Services (AD DS), database management system software, email server software and web hosting software. Information on user applications can be found in the user application hardening section of these guidelines.

          # Further information

          Further information on cyber supply chain risk management can be found in the cyber supply chain risk management section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).

          Further information on patching or updating server applications can be found in the system patching section of the
          [Guidelines for System Management](#c6ca6620-ccd5-4c5d-b97c-9d92f1162948).

          Further information on the use of privileged accounts can be found in the access to systems and their resources section of the
          [Guidelines for Personnel Security](#7d16ae67-87a7-4861-b939-e13ec279b5a2).

          Further information on securely configuring Microsoft AD DS can be found in Microsoft’s
          [Best Practices for Securing Active Directory](#b151e338-c42f-41ef-9f99-2cb98f368637) publication.

          Further information on recommended security-related events to monitor for Microsoft AD DS can be found in Microsoft’s
          [Events to monitor](#022fcd70-df8b-45ee-ae19-fb9cfe7b6cb6) publication.

          Further information on event logging can be found in the event logging and monitoring section of the
          [Guidelines for System Monitoring](#edc24216-f52b-4513-bcda-5fa564661999).

          Further information on database servers can be found in the database servers section of the
          [Guidelines for Database Systems](#3f349d16-11a1-459a-a299-c9446aea7597).

          Further information on email servers can be found in the email gateways and servers section of the
          [Guidelines for Email](#ab73fa95-f213-4041-915e-a8ccbdf74331).
      groups:
      - title: Server application selection
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[3].group[1]"
        parts:
        - name: overview
          prose: "When selecting server applications, it is important that an organisation preferences vendors that have demonstrated a commitment to secure-by-design and secure-by-default principles, use of memory-safe programming languages where possible (such as C#, Go, Java, Ruby, Rust and Swift), secure programming practices, and maintaining the security of their products. This will assist not only with reducing the potential number of security vulnerabilities in server applications, but also increasing the likelihood that timely patches, updates or vendor mitigations will be released to remediate any security vulnerabilities that are found."
        controls:
        - id: ism-1826
          class: ISM-control
          title: "Control: ism-1826"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[3].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1826_smt
            name: statement
            prose: "Server applications are chosen from vendors that have demonstrated a commitment to secure-by-design and secure-by-default principles, use of memory-safe programming languages where possible, secure programming practices, and maintaining the security of their products."
      - title: Server application releases
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[3].group[2]"
        parts:
        - name: overview
          prose: "Newer releases of server applications often introduce improvements in security functionality. This can make it more difficult for an adversary to craft reliable exploits for security vulnerabilities they discover. Using older releases of server applications, especially those no longer supported by vendors, may expose an organisation to security vulnerabilities or exploitation techniques that have since been mitigated. This is particularly important for internet-facing server applications, such as web hosting software."
        controls:
        - id: ism-1483
          class: ISM-control
          title: "Control: ism-1483"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[3].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1483_smt
            name: statement
            prose: The latest release of internet-facing server applications are used.
      - title: Hardening server application configurations
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[3].group[3]"
        parts:
        - name: overview
          prose: "Poorly configured server applications could provide an opportunity for an adversary to gain unauthorised access to the underlying server. To assist an organisation in deploying server applications, vendors often provide guidance on how to securely configure their products. In addition, server applications will often leave behind temporary installation files and logs during their installation process in case an administrator needs to troubleshoot a failed installation. These files, which can include credentials, could be valuable to an adversary and should be removed following the installation of server applications."
        controls:
        - id: ism-1246
          class: ISM-control
          title: "Control: ism-1246"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[3].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1246_smt
            name: statement
            prose: ACSC or vendor hardening guidance for server applications is implemented.
        - id: ism-1260
          class: ISM-control
          title: "Control: ism-1260"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[3].group[3].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1260_smt
            name: statement
            prose: "Default accounts or credentials for server applications, including for any pre-configured accounts, are changed."
        - id: ism-1247
          class: ISM-control
          title: "Control: ism-1247"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[3].group[3].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1247_smt
            name: statement
            prose: "Unneeded accounts, components, services and functionality of server applications are disabled or removed."
        - id: ism-1245
          class: ISM-control
          title: "Control: ism-1245"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[3].group[3].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1245_smt
            name: statement
            prose: All temporary installation files and logs created during server application installation processes are removed after server applications have been installed.
      - title: Restricting privileges for server applications
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[3].group[4]"
        parts:
        - name: overview
          prose: "If a server application operating as a local administrator or root account is compromised by an adversary, it can present a significant security risk to the underlying server. In addition, server applications by default are often capable of widely accessing their underlying server’s file system. Therefore, restricting the ability of server applications to access their underlying server’s file system can limit damage should an adversary compromise the server application."
        controls:
        - id: ism-1249
          class: ISM-control
          title: "Control: ism-1249"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[3].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1249_smt
            name: statement
            prose: Server applications are configured to run as a separate account with the minimum privileges needed to perform their functions.
        - id: ism-1250
          class: ISM-control
          title: "Control: ism-1250"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[3].group[4].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1250_smt
            name: statement
            prose: The accounts under which server applications run have limited access to their underlying server’s file system.
      - title: Microsoft Active Directory Domain Services domain controllers
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[3].group[5]"
        parts:
        - name: overview
          prose: |-
            Microsoft AD DS domain controllers hold sensitive data for systems, such as hashed credentials for all user accounts. As such, particular care should be taken to secure these servers. This can be achieved by hardening their configuration while using dedicated domain administrator user accounts exclusively for their administration. In doing so, technical controls should ensure these dedicated domain administrator user accounts cannot be used to connect to or administer other systems.

            Finally, security-related events for Microsoft AD DS can assist in monitoring the security posture of systems, detecting malicious behaviour and contributing to investigations following cyber security incidents. To facilitate such activities, Microsoft AD DS event logs should be captured and stored centrally.
        controls:
        - id: ism-1827
          class: ISM-control
          title: "Control: ism-1827"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[3].group[5].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1827_smt
            name: statement
            prose: Microsoft AD DS domain controllers are administered using dedicated domain administrator user accounts that are not used to administer other systems.
        - id: ism-1828
          class: ISM-control
          title: "Control: ism-1828"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[3].group[5].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1828_smt
            name: statement
            prose: The Print Spooler service is disabled on Microsoft AD DS domain controllers.
        - id: ism-1829
          class: ISM-control
          title: "Control: ism-1829"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[3].group[5].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1829_smt
            name: statement
            prose: Passwords and cpasswords are not used in Group Policy Preferences.
        - id: ism-1830
          class: ISM-control
          title: "Control: ism-1830"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[3].group[5].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1830_smt
            name: statement
            prose: Security-related events for Microsoft AD DS are logged.
        - id: ism-1831
          class: ISM-control
          title: "Control: ism-1831"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[3].group[5].control[5]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1831_smt
            name: statement
            prose: Microsoft AD DS event logs are stored centrally.
      - title: Microsoft Active Directory Domain Services account hardening
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[3].group[6]"
        parts:
        - name: overview
          prose: "Misconfigured user accounts within Microsoft AD DS can pose a significant threat to the security of a system. For example, when an adversary is able to obtain credentials for a user account, along with associated system access, they may further compromise the system by querying Microsoft AD DS in order to assist with gaining an understanding of the environment, moving laterally through the network and escalating privileges by compromising privileged accounts. Furthermore, an adversary with this level of access can become difficult to detect and remove, as they may not need to use exploits for security vulnerabilities to achieve their goals. Malicious activities performed by compromised user accounts may also appear very similar to legitimate system activities."
        controls:
        - id: ism-1832
          class: ISM-control
          title: "Control: ism-1832"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[3].group[6].control[01]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1832_smt
            name: statement
            prose: Only service accounts and computer accounts are configured with Service Principal Names (SPNs).
        - id: ism-1833
          class: ISM-control
          title: "Control: ism-1833"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[3].group[6].control[02]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1833_smt
            name: statement
            prose: Service accounts are provisioned with the minimum privileges required and are not members of the domain administrators group or similar highly privileged groups.
        - id: ism-1834
          class: ISM-control
          title: "Control: ism-1834"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[3].group[6].control[03]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1834_smt
            name: statement
            prose: Duplicate SPNs do not exist within the domain.
        - id: ism-1835
          class: ISM-control
          title: "Control: ism-1835"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[3].group[6].control[04]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1835_smt
            name: statement
            prose: Privileged user accounts are configured as sensitive and cannot be delegated.
        - id: ism-1836
          class: ISM-control
          title: "Control: ism-1836"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[3].group[6].control[05]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1836_smt
            name: statement
            prose: User accounts require Kerberos pre-authentication.
        - id: ism-1837
          class: ISM-control
          title: "Control: ism-1837"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[3].group[6].control[06]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1837_smt
            name: statement
            prose: User accounts are not configured with password never expires or password not required.
        - id: ism-1838
          class: ISM-control
          title: "Control: ism-1838"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[3].group[6].control[07]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1838_smt
            name: statement
            prose: The UserPassword attribute for user accounts is not used.
        - id: ism-1839
          class: ISM-control
          title: "Control: ism-1839"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[3].group[6].control[08]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1839_smt
            name: statement
            prose: Account properties accessible by unprivileged users are not used to store passwords.
        - id: ism-1840
          class: ISM-control
          title: "Control: ism-1840"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[3].group[6].control[09]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1840_smt
            name: statement
            prose: User account passwords do not use reversible encryption.
        - id: ism-1841
          class: ISM-control
          title: "Control: ism-1841"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[3].group[6].control[10]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1841_smt
            name: statement
            prose: Unprivileged user accounts cannot add machines to the domain.
        - id: ism-1842
          class: ISM-control
          title: "Control: ism-1842"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[3].group[6].control[11]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1842_smt
            name: statement
            prose: Dedicated service accounts are used to add machines to the domain.
        - id: ism-1843
          class: ISM-control
          title: "Control: ism-1843"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[3].group[6].control[12]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1843_smt
            name: statement
            prose: "User accounts with unconstrained delegation are reviewed at least annually, and those without an associated Kerberos SPN or demonstrated business requirement are removed."
        - id: ism-1844
          class: ISM-control
          title: "Control: ism-1844"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[3].group[6].control[13]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1844_smt
            name: statement
            prose: Computer accounts that are not Microsoft AD DS domain controllers are not trusted for delegation to services.
      - title: Microsoft Active Directory Domain Services security group memberships
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[3].group[7]"
        parts:
        - name: overview
          prose: "Microsoft AD DS contains a number of built-in security groups that have elevated permissions or deliberately relaxed security policies. These security groups are often required for a specific purpose, however, overuse or inappropriate use may allow an adversary to more easily move laterally throughout a network, or escalate their privileges. Privileged security groups in particular should be limited to the smallest set of possible users to limit an adversary’s opportunities for privilege escalation."
        controls:
        - id: ism-1620
          class: ISM-control
          title: "Control: ism-1620"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[3].group[7].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1620_smt
            name: statement
            prose: Privileged user accounts are members of the Protected Users security group.
        - id: ism-1845
          class: ISM-control
          title: "Control: ism-1845"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[3].group[7].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1845_smt
            name: statement
            prose: "When a user account is disabled, it is removed from all security group memberships."
        - id: ism-1846
          class: ISM-control
          title: "Control: ism-1846"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[3].group[7].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1846_smt
            name: statement
            prose: The Pre-Windows 2000 Compatible Access security group does not contain user accounts.
    - title: Authentication hardening
      props:
      - name: sort-id
        value: "catalog[1].group[15].group[4]"
      parts:
      - name: overview
        prose: |-
          # Account and authentication types

          The guidance within this section is equally applicable to all account types. This includes unprivileged accounts, privileged accounts, break glass accounts and service accounts. In addition, the guidance is equally applicable to interactive authentication and non-interactive authentication.

          # Further information

          Further information on cyber supply chain risk management can be found in the cyber supply chain risk management section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).

          Further information on implementing multi-factor authentication can be found in the ACSC’s
          [Implementing Multi-Factor Authentication](#83e3a9b1-5057-4531-91dd-03c8d92634b0) publication.

          Further information on event logging can be found in the event logging and monitoring section of the
          [Guidelines for System Monitoring](#edc24216-f52b-4513-bcda-5fa564661999).

          Further information on
          [randomly generating passphrases](#58282062-5c17-476a-98b1-105a627cd28d) (preferably using five dice rolls and a long word list) is available from the Electronic Frontier Foundation while a
          [random dice roller](#0508be6f-cb97-44da-b212-42416a0048b0) is available from RANDOM.ORG.

          Further information on changing credentials for the Kerberos Key Distribution Center’s service account can be found in Microsoft’s
          [Active Directory accounts](#ae426d0a-adb6-43b8-a463-faa33e83b679) and
          [AD Forest Recovery - Resetting the krbtgt password](#3e5a98e5-9219-46c8-81c2-e3a4d13407ce) publications. A script for
          [changing credentials for this service account](#f74ba095-a7f7-4b8c-9e60-5fe84f2a2d0b) is also available from Microsoft.

          Further information on
          [group Managed Service Accounts](#91b92563-d991-40fa-9adc-548df9f6c496) in Microsoft Windows Server is available from Microsoft.

          Further information on mitigating the use of stolen credentials can be found in the ACSC’s
          [Mitigating the Use of Stolen Credentials](#824e4353-a9ae-4869-88fb-cb0675dc5d1c) publication.

          Further information on mitigating the use of stolen credentials can also be found in Microsoft’s
          [Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft Techniques, Version 1 and 2](#f9fb4c57-8c12-4edf-9e34-cb422664aae9) publication.
      groups:
      - title: Authenticating to systems
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[4].group[01]"
        parts:
        - name: overview
          prose: "Before access to a system and its resources is granted to a user, it is essential that they are authenticated. This can be achieved via multi-factor authentication, such as a username along with a passphrase and security key, or via single-factor authentication, such as a username and a passphrase."
        controls:
        - id: ism-1546
          class: ISM-control
          title: "Control: ism-1546"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[01].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Aug-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1546_smt
            name: statement
            prose: Users are authenticated before they are granted access to a system and its resources.
      - title: Insecure authentication methods
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[4].group[02]"
        parts:
        - name: overview
          prose: "Authentication methods need to resist theft, interception, duplication, forgery, unauthorised access and unauthorised modification. For example, Local Area Network (LAN) Manager and NT LAN Manager authentication methods use weak hashing algorithms. As such, credentials used as part of LAN Manager authentication and NT LAN Manager authentication (i.e. NTLMv1, NTLMv2 and NTLM2) can easily be compromised. Instead, an organisation should use Kerberos for authentication within Microsoft Windows environments."
        controls:
        - id: ism-1603
          class: ISM-control
          title: "Control: ism-1603"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[02].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Aug-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1603_smt
            name: statement
            prose: Authentication methods susceptible to replay attacks are disabled.
        - id: ism-1055
          class: ISM-control
          title: "Control: ism-1055"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[02].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Oct-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1055_smt
            name: statement
            prose: LAN Manager and NT LAN Manager authentication methods are disabled.
      - title: Multi-factor authentication
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[4].group[03]"
        parts:
        - name: overview
          prose: |-
            Multi-factor authentication uses two or more authentication factors. This may include:

            * something a user knows, such as a memorised secret (i.e. personal identification number, password or passphrase)
            * something a user has, such as a security key, smart card, smartphone or one-time password token
            * something a user is, such as a fingerprint pattern or their facial geometry.

            Note, however, that if a memorised secret is written down, or stored in a document on a system, this becomes something that a user has rather than something a user knows.

            Privileged users, users of remote access solutions and users with access to important data repositories are more likely to be targeted by an adversary due to their access. For this reason, it is especially important that multi-factor authentication is used for these accounts. In addition, multi-factor authentication is vital to any administrative activities as it can limit the consequences of a compromise by preventing or slowing an adversary’s ability to gain unrestricted access to assets. In this regard, multi-factor authentication can be implemented as part of jump server authentication where assets being administered do not support multi-factor authentication themselves.

            When implementing multi-factor authentication, several different authentication factors can be implemented. Unfortunately, some authentication factors, such as biometrics or codes sent via Short Message Service, Voice over Internet Protocol or email, are more susceptible to compromise than others. For this reason, authentication factors that involve something a user has should be used as part of multi-factor authentication. Furthermore, for increased security, the use of phishing-resistant (also known as verifier impersonation resistant) multi-factor authentication is recommended to protect against real-time phishing attacks.

            Finally, multi-factor authentication event logs can assist in monitoring the security posture of systems, detecting malicious behaviour and contributing to investigations following cyber security incidents. To facilitate such activities, multi-factor authentication event logs should be captured and stored centrally.
        controls:
        - id: ism-0974
          class: ISM-control
          title: "Control: ism-0974"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[03].control[01]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0974_smt
            name: statement
            prose: Multi-factor authentication is used to authenticate unprivileged users of systems.
        - id: ism-1173
          class: ISM-control
          title: "Control: ism-1173"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[03].control[02]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1173_smt
            name: statement
            prose: Multi-factor authentication is used to authenticate privileged users of systems.
        - id: ism-1504
          class: ISM-control
          title: "Control: ism-1504"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[03].control[03]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1504_smt
            name: statement
            prose: Multi-factor authentication is used by an organisation’s users if they authenticate to their organisation’s internet-facing services.
        - id: ism-1679
          class: ISM-control
          title: "Control: ism-1679"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[03].control[04]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1679_smt
            name: statement
            prose: "Multi-factor authentication is used by an organisation’s users if they authenticate to third-party internet-facing services that process, store or communicate their organisation’s sensitive data."
        - id: ism-1680
          class: ISM-control
          title: "Control: ism-1680"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[03].control[05]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1680_smt
            name: statement
            prose: "Multi-factor authentication (where available) is used by an organisation’s users if they authenticate to third-party internet-facing services that process, store or communicate their organisation’s non-sensitive data."
        - id: ism-1681
          class: ISM-control
          title: "Control: ism-1681"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[03].control[06]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1681_smt
            name: statement
            prose: Multi-factor authentication is enabled by default for non-organisational users (but users can choose to opt out) if they authenticate to an organisation’s internet-facing services.
        - id: ism-1505
          class: ISM-control
          title: "Control: ism-1505"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[03].control[07]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1505_smt
            name: statement
            prose: Multi-factor authentication is used to authenticate users accessing important data repositories.
        - id: ism-1401
          class: ISM-control
          title: "Control: ism-1401"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[03].control[08]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1401_smt
            name: statement
            prose: "Multi-factor authentication uses either: something users have and something users know, or something users have that is unlocked by something users know or are."
        - id: ism-1682
          class: ISM-control
          title: "Control: ism-1682"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[03].control[09]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1682_smt
            name: statement
            prose: Multi-factor authentication is phishing-resistant.
        - id: ism-1559
          class: ISM-control
          title: "Control: ism-1559"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[03].control[10]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1559_smt
            name: statement
            prose: "Memorised secrets used for multi-factor authentication are a minimum of 6 characters, unless more stringent requirements apply."
        - id: ism-1561
          class: ISM-control
          title: "Control: ism-1561"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[03].control[12]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1561_smt
            name: statement
            prose: Memorised secrets used for multi-factor authentication on TOP SECRET systems are a minimum of 10 characters.
        - id: ism-1683
          class: ISM-control
          title: "Control: ism-1683"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[03].control[13]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1683_smt
            name: statement
            prose: Successful and unsuccessful multi-factor authentication events are logged.
        - id: ism-1684
          class: ISM-control
          title: "Control: ism-1684"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[03].control[14]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1684_smt
            name: statement
            prose: Multi-factor authentication event logs are stored centrally.
      - title: Single-factor authentication
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[4].group[04]"
        parts:
        - name: overview
          prose: |-
            A significant threat to the compromise of accounts is credential cracking tools. When an adversary gains access to a list of usernames and hashed credentials from a system they can attempt to recover username and credential pairs by comparing the hashes of known credentials with the hashed credentials they have gained access to. By finding a match an adversary will know the credential associated with a given username.

            In order to reduce this security risk, an organisation should implement multi-factor authentication. Note, while single-factor authentication is no longer considered suitable for protecting sensitive or classified data, it may not be possible to implement multi-factor authentication on some systems. In such cases, an organisation will need to increase the time on average it takes an adversary to compromise a credential by continuing to increase its length over time. Such increases in length can be balanced against useability through the use of passphrases rather than passwords. In cases where systems do not support passphrases, and as an absolute last resort, the strongest password length and complexity supported by a system will need to be implemented.
        controls:
        - id: ism-0417
          class: ISM-control
          title: "Control: ism-0417"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[04].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Oct-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0417_smt
            name: statement
            prose: "When systems cannot support multi-factor authentication, single-factor authentication using passphrases is implemented instead."
        - id: ism-0421
          class: ISM-control
          title: "Control: ism-0421"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[04].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "8"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0421_smt
            name: statement
            prose: "Passphrases used for single-factor authentication are at least 4 random words with a total minimum length of 14 characters, unless more stringent requirements apply."
        - id: ism-0422
          class: ISM-control
          title: "Control: ism-0422"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[04].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "8"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0422_smt
            name: statement
            prose: Passphrases used for single-factor authentication on TOP SECRET systems are at least 6 random words with a total minimum length of 20 characters.
        - id: ism-1558
          class: ISM-control
          title: "Control: ism-1558"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[04].control[5]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1558_smt
            name: statement
            prose: "Passphrases used for single-factor authentication are not a list of categorised words; do not form a real sentence in a natural language; and are not constructed from song lyrics, movies, literature or any other publicly available material."
      - title: Setting credentials for user accounts
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[4].group[05]"
        parts:
        - name: overview
          prose: "Before new credentials are issued for user accounts, it is important that users’ provide sufficient evidence to verify their identity, such as by users physically presenting themselves and their pass to a service desk or by answering a set of challenge-response questions. Following the verification of user identity, credentials should be randomly generated and provided to users via a secure communications channel or, if not possible, split into two parts with one part provided to users and the other part provided to supervisors. Subsequently, users should reset their credentials on first use to ensure that they are not known by other parties."
        controls:
        - id: ism-1593
          class: ISM-control
          title: "Control: ism-1593"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[05].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1593_smt
            name: statement
            prose: Users provide sufficient evidence to verify their identity when requesting new credentials.
        - id: ism-1227
          class: ISM-control
          title: "Control: ism-1227"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[05].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1227_smt
            name: statement
            prose: Credentials set for user accounts are randomly generated.
        - id: ism-1594
          class: ISM-control
          title: "Control: ism-1594"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[05].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1594_smt
            name: statement
            prose: "Credentials are provided to users via a secure communications channel or, if not possible, split into two parts with one part provided to users and the other part provided to supervisors."
        - id: ism-1595
          class: ISM-control
          title: "Control: ism-1595"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[05].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1595_smt
            name: statement
            prose: Credentials provided to users are changed on first use.
        - id: ism-1596
          class: ISM-control
          title: "Control: ism-1596"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[05].control[5]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1596_smt
            name: statement
            prose: "Credentials, in the form of memorised secrets, are not reused by users across different systems."
      - title: Setting credentials for local administrator accounts and service accounts
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[4].group[06]"
        parts:
        - name: overview
          prose: |-
            When local administrator accounts and service accounts use common usernames and credentials, it can allow an adversary that compromises credentials on one workstation or server to easily compromise other workstations and servers. As such, it is critical that credentials for local administrator accounts and service accounts are long, unique, unpredictable and managed.

            To provide additional security and credential management functionality for service accounts, Microsoft introduced group Managed Service Accounts to Microsoft Windows Server. In doing so, service accounts that are created as group Managed Service Accounts do not require manual credential management by system administrators, as the operating system automatically ensures that they are long, unique, unpredictable and managed. This ensures that service account credentials are secure, not misplaced or forgotten, and that they are automatically changed on a regular basis. However, in cases where the use of group Managed Service Accounts is not possible, credentials for service accounts should still be unique and unpredictable with a minimum length of 30 characters.
        controls:
        - id: ism-1685
          class: ISM-control
          title: "Control: ism-1685"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[06].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1685_smt
            name: statement
            prose: "Credentials for local administrator accounts and service accounts are long, unique, unpredictable and managed."
        - id: ism-1619
          class: ISM-control
          title: "Control: ism-1619"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[06].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Oct-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1619_smt
            name: statement
            prose: Service accounts are created as group Managed Service Accounts.
        - id: ism-1795
          class: ISM-control
          title: "Control: ism-1795"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[06].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1795_smt
            name: statement
            prose: Credentials for local administrator accounts and service accounts are a minimum of 30 characters.
      - title: Changing credentials
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[4].group[07]"
        parts:
        - name: overview
          prose: "Generally, credentials should not need to be changed on a frequent basis. However, some events may necessitate the requirement for individual accounts, or groups of accounts, to change their credentials. This can include direct or suspected compromises of credentials, credentials appearing in online data breach databases, credentials being discovered stored on networks in the clear, credentials being transferred across networks in the clear, when membership of shared accounts change, and if credentials haven’t been changed in the past 12 months."
        controls:
        - id: ism-1590
          class: ISM-control
          title: "Control: ism-1590"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[07].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1590_smt
            name: statement
            prose: |-
              Credentials are changed if:

              * they are directly compromised
              * they are suspected of being compromised
              * they appear in an online data breach database
              * they are discovered stored on networks in the clear
              * they are discovered being transferred across networks in the clear
              * membership of a shared account changes
              * they have not been changed in the past 12 months.
        - id: ism-1847
          class: ISM-control
          title: "Control: ism-1847"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[07].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1847_smt
            name: statement
            prose: |-
              Credentials for the Kerberos Key Distribution Center’s service account (KRBTGT) are changed twice, allowing for replication to all Microsoft Active Directory Domain Services domain controllers in-between each change, if:

              * the domain has been directly compromised
              * the domain is suspected of being compromised
              * they have not been changed in the past 12 months.
      - title: Protecting credentials
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[4].group[08]"
        parts:
        - name: overview
          prose: |-
            Written down credentials (e.g. memorised secrets), and dedicated devices that store or generate credentials (e.g. security keys, smart cards and one-time password tokens), when kept together with systems they are used to authenticate to can increase the likelihood of an adversary gaining unauthorised access to systems. For example, when smart cards are left on desks, one-time password tokens are left in laptop bags, security keys are left connected to computers or passphrases are written down and stuck to computer monitors. Furthermore, obscuring credentials as they are entered into systems can assist in protecting them against screen scrapers and shoulder surfers.

            If storing credentials on systems, sufficient protection should be implemented to prevent them from being compromised. For example, credentials can be stored in a password manager or hardware security module, while credentials stored in a database should be hashed, salted and stretched. In addition, Windows Defender Credential Guard and Windows Defender Remote Credential Guard can be enabled to provide additional protection for credentials.

            When using Microsoft Windows systems, cached credentials are stored in the Security Accounts Manager database and can allow a user to logon to a workstation they have previously logged onto even if the domain is not available. Whilst this functionality may be desirable from an availability perspective, this functionality can be abused by an adversary who can retrieve these cached credentials. To reduce this security risk, cached credentials should be limited to only one previous logon.
        controls:
        - id: ism-0418
          class: ISM-control
          title: "Control: ism-0418"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[08].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0418_smt
            name: statement
            prose: "Credentials are kept separate from systems they are used to authenticate to, except for when performing authentication activities."
        - id: ism-1597
          class: ISM-control
          title: "Control: ism-1597"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[08].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Aug-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1597_smt
            name: statement
            prose: Credentials are obscured as they are entered into systems.
        - id: ism-1402
          class: ISM-control
          title: "Control: ism-1402"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[08].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1402_smt
            name: statement
            prose: "Credentials stored on systems are protected by a password manager; a hardware security module; or by salting, hashing and stretching them before storage within a database."
        - id: ism-1686
          class: ISM-control
          title: "Control: ism-1686"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[08].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1686_smt
            name: statement
            prose: Windows Defender Credential Guard and Windows Defender Remote Credential Guard are enabled.
        - id: ism-1749
          class: ISM-control
          title: "Control: ism-1749"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[08].control[5]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1749_smt
            name: statement
            prose: Cached credentials are limited to one previous logon.
      - title: Account lockouts
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[4].group[09]"
        parts:
        - name: overview
          prose: "Locking an account after a specified number of failed logon attempts reduces the likelihood of successful credential spraying attacks by an adversary. However, care should be taken as implementing account lockout functionality can increase the likelihood of a denial of service. Alternatively, some systems can be configured to automatically slowdown repeated failed logon attempts (known as rate limiting) rather than locking accounts. Implementing multi-factor authentication is also an effective way of reducing the likelihood of successful credential spraying attacks."
        controls:
        - id: ism-1403
          class: ISM-control
          title: "Control: ism-1403"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[09].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Oct-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1403_smt
            name: statement
            prose: Accounts are locked out after a maximum of five failed logon attempts.
      - title: Session termination
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[4].group[10]"
        parts:
        - name: overview
          prose: "Implementing measures to terminate user sessions and restart workstations on a daily basis, outside of business hours and after an appropriate period of inactivity, can assist in both system maintenance activities as well as removing an adversary that may have compromised a system but failed to gain persistence."
        controls:
        - id: ism-0853
          class: ISM-control
          title: "Control: ism-0853"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[10].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0853_smt
            name: statement
            prose: "On a daily basis, outside of business hours and after an appropriate period of inactivity, user sessions are terminated and workstations are restarted."
      - title: Session and screen locking
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[4].group[11]"
        parts:
        - name: overview
          prose: Session and screen locking prevents unauthorised access to a system which a user has already authenticated to.
        controls:
        - id: ism-0428
          class: ISM-control
          title: "Control: ism-0428"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[11].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "9"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0428_smt
            name: statement
            prose: |-
              Systems are configured with a session or screen lock that:

              * activates after a maximum of 15 minutes of user inactivity, or if manually activated by users
              * conceals all session content on the screen
              * ensures that the screen does not enter a power saving state before the session or screen lock is activated
              * requires users to authenticate to unlock the session
              * denies users the ability to disable the session or screen locking mechanism.
      - title: Logon banner
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[4].group[12]"
        parts:
        - name: overview
          prose: |-
            Displaying a logon banner to users before access is granted to a system reminds them of their security responsibilities. Logon banners may cover topics such as:

            * the sensitivity or classification of the system
            * access to the system being restricted to authorised users
            * acceptable usage and security policies for the system
            * an agreement to abide by acceptable usage and security policies for the system
            * legal ramifications of violating acceptable usage and security policies for the system
            * details of any monitoring activities for the system.
        controls:
        - id: ism-0408
          class: ISM-control
          title: "Control: ism-0408"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[12].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0408_smt
            name: statement
            prose: Systems have a logon banner that requires users to acknowledge and accept their security responsibilities before access is granted.
        - id: ism-0979
          class: ISM-control
          title: "Control: ism-0979"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[4].group[12].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0979_smt
            name: statement
            prose: Legal advice is sought on the exact wording of logon banners.
    - title: Virtualisation hardening
      props:
      - name: sort-id
        value: "catalog[1].group[15].group[5]"
      parts:
      - name: overview
        prose: |-
          # Hypervisors

          This section is applicable to both Type 1 hypervisors (those that run on bare metal) and Type 2 hypervisors (those that run on top of a general purpose operating system). In doing so, Type 1 hypervisors should be treated as operating systems while Type 2 hypervisors should be treated as applications. Note, as Type 1 hypervisors are themselves lightweight operating systems, they can be treated as a combination of both a software-based isolation mechanism and an underlying operating system. Conversely, Type 2 hypervisors will run on top of a general purpose operating system that may be provided by a different vendor to that of the software-isolation mechanism.

          # Containerisation

          Containers allow for versatile deployment of systems and, in doing so, should be treated the same as any other system. However, controls in a containerised environment may take a different form when compared to other types of systems. For example, patching the operating system of a workstation may be performed differently to ensuring that a patched image is used for a container, however, the principle is the same. In general, the same security risks that apply to non-containerised systems will likely apply to containerised systems.

          # Further information

          Further information on container security can be found in National Institute of Standards and Technology Special Publication 800-190,
          [Application Container Security Guide](#887c65c3-c853-41c6-89d5-3f297108889e).

          Further information on cyber supply chain risk management can be found in the cyber supply chain risk management section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).

          Further information on the use of cloud services can be found in the managed services and cloud services section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).

          Further information on hardening operating systems can be found in the operating system hardening section of these guidelines.

          Further information on patching or updating operating systems and applications can be found in the system patching section of the
          [Guidelines for System Management](#c6ca6620-ccd5-4c5d-b97c-9d92f1162948).

          Further information on event logging can be found in the event logging and monitoring section of the
          [Guidelines for System Monitoring](#edc24216-f52b-4513-bcda-5fa564661999).

          Further information on hypervisor security can be found in National Institute of Standards and Technology Special Publication 800-125A Rev. 1,
          [Security Recommendations for Server-based Hypervisor Platforms](#33d26cdd-51fc-45d3-a026-0814d51a4c7e).
      groups:
      - title: Functional separation between computing environments
        props:
        - name: sort-id
          value: "catalog[1].group[15].group[5].group[1]"
        parts:
        - name: overview
          prose: |-
            Physical servers often use a software-based isolation mechanism to share their hardware among multiple computing environments. In doing so, a computing environment could consist of an entire operating system installed in a virtual machine where the isolation mechanism is a hypervisor, such as cloud services providing Infrastructure as a Service, or alternatively, a computing environment could consist of an application which uses the shared kernel of the underlying operating system of the physical server where the isolation mechanism is an application container or application sandbox, such as cloud services providing Platform as a Service. Note, however, the logical separation of data within a single application, such as cloud services providing Software as a Service, is not considered to be the same as multiple computing environments.

            An adversary who has compromised a single computing environment, or who legitimately controls a single computing environment, might exploit a misconfiguration or security vulnerability in the isolation mechanism to compromise other computing environments on the same physical server or compromise the underlying operating system of the physical server. As such, it is important that additional controls are implemented when a software-based isolation mechanism is used to share a physical server’s hardware.
        controls:
        - id: ism-1460
          class: ISM-control
          title: "Control: ism-1460"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[5].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1460_smt
            name: statement
            prose: "When using a software-based isolation mechanism to share a physical server’s hardware, the isolation mechanism is from a vendor that has demonstrated a commitment to secure-by-design and secure-by-default principles, use of memory-safe programming languages where possible, secure programming practices, and maintaining the security of their products."
        - id: ism-1604
          class: ISM-control
          title: "Control: ism-1604"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[5].group[1].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Aug-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1604_smt
            name: statement
            prose: "When using a software-based isolation mechanism to share a physical server’s hardware, the configuration of the isolation mechanism is hardened by removing unneeded functionality and restricting access to the administrative interface used to manage the isolation mechanism."
        - id: ism-1605
          class: ISM-control
          title: "Control: ism-1605"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[5].group[1].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1605_smt
            name: statement
            prose: "When using a software-based isolation mechanism to share a physical server’s hardware, the underlying operating system is hardened."
        - id: ism-1606
          class: ISM-control
          title: "Control: ism-1606"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[5].group[1].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1606_smt
            name: statement
            prose: "When using a software-based isolation mechanism to share a physical server’s hardware, patches, updates or vendor mitigations for security vulnerabilities are applied to the isolation mechanism and underlying operating system in a timely manner."
        - id: ism-1848
          class: ISM-control
          title: "Control: ism-1848"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[5].group[1].control[5]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1848_smt
            name: statement
            prose: "When using a software-based isolation mechanism to share a physical server’s hardware, the isolation mechanism or underlying operating system is replaced when it is no longer supported by a vendor."
        - id: ism-1607
          class: ISM-control
          title: "Control: ism-1607"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[5].group[1].control[6]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Aug-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1607_smt
            name: statement
            prose: "When using a software-based isolation mechanism to share a physical server’s hardware, integrity and log monitoring are performed for the isolation mechanism and underlying operating system in a timely manner."
        - id: ism-1461
          class: ISM-control
          title: "Control: ism-1461"
          props:
          - name: sort-id
            value: "catalog[1].group[15].group[5].group[1].control[7]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1461_smt
            name: statement
            prose: "When using a software-based isolation mechanism to share a physical server’s hardware for SECRET or TOP SECRET computing environments, the physical server and all computing environments are of the same classification and belong to the same security domain."
  - title: Guidelines for System Management
    props:
    - name: sort-id
      value: "catalog[1].group[16]"
    groups:
    - title: System administration
      props:
      - name: sort-id
        value: "catalog[1].group[16].group[1]"
      parts:
      - name: overview
        prose: |-
          # System administration of cloud services

          System administration of cloud services brings unique challenges when compared to system administration of on-premises assets. Notably, responsibility for system administration of cloud services is often shared between service providers and their customers. As the system administration processes and procedures implemented by service providers are often opaque to their customers, customers should consider a service provider’s control plane to operate within a different security domain.

          # Further information

          Further information on system administration can be found in the Australian Cyber Security Centre (ACSC)’s
          [Secure Administration](#131048c7-a2e7-4da3-9257-7a058b06c1f8) publication.

          Further information on the use of privileged accounts for system administration activities can be found in the access to systems and their resources section of the
          [Guidelines for Personnel Security](#7d16ae67-87a7-4861-b939-e13ec279b5a2).

          Further information on multi-factor authentication can be found in the authentication hardening section of the
          [Guidelines for System Hardening](#de7525f3-a466-40a5-abdd-3ae24a6d1b44).

          Further information on event logging can be found in the event logging and monitoring section of the
          [Guidelines for System Monitoring](#edc24216-f52b-4513-bcda-5fa564661999).

          Further information on network segmentation and segregation can be found in the network design and configuration section of the
          [Guidelines for Networking](#f145ff5b-d396-4248-8f48-621349d6f0ed).
      groups:
      - title: System administration processes and procedures
        props:
        - name: sort-id
          value: "catalog[1].group[16].group[1].group[1]"
        parts:
        - name: overview
          prose: |-
            A key component of system administration is ensuring that administrative activities are undertaken in a repeatable and accountable manner using system administration processes and procedures. In doing so, requirements for administrative activities may cover:

            * configuring applications, operating systems, network devices or other ICT equipment
            * applying patches, updates or vendor mitigations to applications, drivers, operating systems or firmware
            * installing or removing applications, operating systems, network devices or other ICT equipment
            * implementing system changes or enhancements
            * resolving problems identified by users.

            Furthermore, in support of change management processes and procedures, system administrators should document requirements for administrative activities, consider potential security impacts, obtain any necessary approvals, notify users of any disruptions or outages, and maintain system and security documentation.
        controls:
        - id: ism-0042
          class: ISM-control
          title: "Control: ism-0042"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[1].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0042_smt
            name: statement
            prose: "System administration processes, and supporting system administration procedures, are developed, implemented and maintained."
        - id: ism-1211
          class: ISM-control
          title: "Control: ism-1211"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[1].group[1].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1211_smt
            name: statement
            prose: "System administrators document requirements for administrative activities, consider potential security impacts, obtain any necessary approvals, notify users of any disruptions or outages, and maintain system and security documentation."
      - title: Separate privileged operating environments
        props:
        - name: sort-id
          value: "catalog[1].group[16].group[1].group[2]"
        parts:
        - name: overview
          prose: |-
            One of the greatest threats to the security of networks is the compromise of privileged accounts. Providing a separate privileged operating environment for system administrators, in addition to their unprivileged operating environment, makes it much harder for administrative activities and privileged accounts to be compromised by an adversary.

            Using different physical workstations is the most secure approach to separating privileged and unprivileged operating environments for system administrators. However, a virtualisation-based solution may be sufficient for separating privileged and unprivileged operating environments. In such cases, privileged operating environments should not be virtualised within unprivileged operating environments.
        controls:
        - id: ism-1380
          class: ISM-control
          title: "Control: ism-1380"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[1].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1380_smt
            name: statement
            prose: Privileged users use separate privileged and unprivileged operating environments.
        - id: ism-1687
          class: ISM-control
          title: "Control: ism-1687"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[1].group[2].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1687_smt
            name: statement
            prose: Privileged operating environments are not virtualised within unprivileged operating environments.
        - id: ism-1688
          class: ISM-control
          title: "Control: ism-1688"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[1].group[2].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1688_smt
            name: statement
            prose: Unprivileged accounts cannot logon to privileged operating environments.
        - id: ism-1689
          class: ISM-control
          title: "Control: ism-1689"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[1].group[2].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1689_smt
            name: statement
            prose: Privileged accounts (excluding local administrator accounts) cannot logon to unprivileged operating environments.
      - title: Administrative infrastructure
        props:
        - name: sort-id
          value: "catalog[1].group[16].group[1].group[3]"
        parts:
        - name: overview
          prose: "The security of administrative activities can be improved by segregating administrative infrastructure from the wider network. In doing so, the use of a jump server (also known as a jump host or jump box) can be an effective way of simplifying and securing administrative activities. Specifically, a jump server can provide filtering of network management traffic while also acting as a focal point to perform multi-factor authentication; store and manage administrative tools; and perform logging, monitoring and alerting activities. Finally, using separate jump servers for the administration of critical servers, high-value servers and regular servers can further assist in protecting these assets."
        controls:
        - id: ism-1385
          class: ISM-control
          title: "Control: ism-1385"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[1].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1385_smt
            name: statement
            prose: Administrative infrastructure is segregated from the wider network.
        - id: ism-1750
          class: ISM-control
          title: "Control: ism-1750"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[1].group[3].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1750_smt
            name: statement
            prose: "Administrative infrastructure for critical servers, high-value servers and regular servers is segregated from each other."
        - id: ism-1386
          class: ISM-control
          title: "Control: ism-1386"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[1].group[3].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1386_smt
            name: statement
            prose: Network management traffic can only originate from administrative infrastructure.
        - id: ism-1387
          class: ISM-control
          title: "Control: ism-1387"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[1].group[3].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1387_smt
            name: statement
            prose: Administrative activities are conducted through jump servers.
        - id: ism-1381
          class: ISM-control
          title: "Control: ism-1381"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[1].group[3].control[5]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1381_smt
            name: statement
            prose: Only privileged operating environments can communicate with jump servers.
        - id: ism-1388
          class: ISM-control
          title: "Control: ism-1388"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[1].group[3].control[6]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1388_smt
            name: statement
            prose: Only jump servers can communicate with assets requiring administrative activities to be performed.
    - title: System patching
      props:
      - name: sort-id
        value: "catalog[1].group[16].group[2]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on system patching can be found in the ACSC’s
          [Assessing Security Vulnerabilities and Applying Patches](#02fb4cb5-e4c4-4097-97a2-f1b6aa04131a) publication.

          Further information on patching evaluated products can be found in the evaluated product usage section of the
          [Guidelines for Evaluated Products](#a699a3aa-828d-479b-b50b-98127bb19437).

          Further information on cessation of support for Microsoft Windows operating systems, including potential compensating controls for use beyond their cessation date for support, can be found in the ACSC’s
          [End of Support for Microsoft Windows and Microsoft Windows Server](#d36ce452-ec21-4b05-89c1-f29a444a3dca) publication.

          Further information on hardening user applications can be found in the user application hardening section of the
          [Guidelines for System Hardening](#de7525f3-a466-40a5-abdd-3ae24a6d1b44).

          Further information on hardening server applications can be found in the server application hardening section of the
          [Guidelines for System Hardening](#de7525f3-a466-40a5-abdd-3ae24a6d1b44).
      groups:
      - title: Patch management processes and procedures
        props:
        - name: sort-id
          value: "catalog[1].group[16].group[2].group[1]"
        parts:
        - name: overview
          prose: "Applying patches or updates is critical to ensuring the ongoing security of applications, drivers, operating systems and firmware. In doing so, it is important that patches or updates are applied consistently and in a secure manner. For example, by using a centralised and managed approach that maintains the integrity of patches or updates, and confirms that they have been applied successfully."
        controls:
        - id: ism-1143
          class: ISM-control
          title: "Control: ism-1143"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[2].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "9"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1143_smt
            name: statement
            prose: "Patch management processes, and supporting patch management procedures, are developed, implemented and maintained."
        - id: ism-0298
          class: ISM-control
          title: "Control: ism-0298"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[2].group[1].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "8"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0298_smt
            name: statement
            prose: "A centralised and managed approach that maintains the integrity of patches or updates, and confirms that they have been applied successfully, is used to patch or update applications, operating systems, drivers and firmware."
      - title: Software register
        props:
        - name: sort-id
          value: "catalog[1].group[16].group[2].group[2]"
        parts:
        - name: overview
          prose: "To assist with monitoring information sources for details of relevant patches or updates, an organisation should develop, implement, maintain and regularly verify software registers for workstations, servers, network devices and other ICT equipment."
        controls:
        - id: ism-1493
          class: ISM-control
          title: "Control: ism-1493"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[2].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1493_smt
            name: statement
            prose: "Software registers for workstations, servers, network devices and other ICT equipment are developed, implemented, maintained and verified on a regular basis."
        - id: ism-1643
          class: ISM-control
          title: "Control: ism-1643"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[2].group[2].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1643_smt
            name: statement
            prose: "Software registers contain versions and patch histories of applications, drivers, operating systems and firmware."
      - title: Scanning for missing patches or updates
        props:
        - name: sort-id
          value: "catalog[1].group[16].group[2].group[3]"
        parts:
        - name: overview
          prose: "To ensure that patches or updates are being applied to applications, operating systems, drivers and firmware, it is essential that an organisation regularly identifies all assets within their environment using an automated method of asset discovery, such as an asset discovery tool or a vulnerability scanner with equivalent functionality. Following asset discovery, identified assets can be scanned for missing patches or updates using a vulnerability scanner with an up-to-date vulnerability database. Ideally, vulnerability scanning should be conducted in an automated manner and take place at half the frequency in which patches or updates need to be applied. For example, if patches or updates are to be applied within two weeks of release then vulnerability scanning should be undertaken at least weekly."
        controls:
        - id: ism-1807
          class: ISM-control
          title: "Control: ism-1807"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[2].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1807_smt
            name: statement
            prose: An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activities.
        - id: ism-1808
          class: ISM-control
          title: "Control: ism-1808"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[2].group[3].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1808_smt
            name: statement
            prose: A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities.
        - id: ism-1698
          class: ISM-control
          title: "Control: ism-1698"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[2].group[3].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1698_smt
            name: statement
            prose: A vulnerability scanner is used at least daily to identify missing patches or updates for security vulnerabilities in internet-facing services.
        - id: ism-1699
          class: ISM-control
          title: "Control: ism-1699"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[2].group[3].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1699_smt
            name: statement
            prose: "A vulnerability scanner is used at least weekly to identify missing patches or updates for security vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF software, and security products."
        - id: ism-1700
          class: ISM-control
          title: "Control: ism-1700"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[2].group[3].control[5]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1700_smt
            name: statement
            prose: A vulnerability scanner is used at least fortnightly to identify missing patches or updates for security vulnerabilities in other applications.
        - id: ism-1701
          class: ISM-control
          title: "Control: ism-1701"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[2].group[3].control[6]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1701_smt
            name: statement
            prose: A vulnerability scanner is used at least daily to identify missing patches or updates for security vulnerabilities in operating systems of internet-facing services.
        - id: ism-1702
          class: ISM-control
          title: "Control: ism-1702"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[2].group[3].control[7]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1702_smt
            name: statement
            prose: "A vulnerability scanner is used at least weekly to identify missing patches or updates for security vulnerabilities in operating systems of workstations, servers and network devices."
        - id: ism-1752
          class: ISM-control
          title: "Control: ism-1752"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[2].group[3].control[8]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1752_smt
            name: statement
            prose: A vulnerability scanner is used at least weekly to identify missing patches or updates for security vulnerabilities in operating systems of other ICT equipment.
        - id: ism-1703
          class: ISM-control
          title: "Control: ism-1703"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[2].group[3].control[9]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1703_smt
            name: statement
            prose: A vulnerability scanner is used at least weekly to identify missing patches or updates for security vulnerabilities in drivers and firmware.
      - title: When to patch security vulnerabilities
        props:
        - name: sort-id
          value: "catalog[1].group[16].group[2].group[4]"
        parts:
        - name: overview
          prose: |-
            When patches or updates are released by vendors for security vulnerabilities, an organisation should apply them in a timeframe commensurate with the likelihood of attempted exploitation by an adversary. For example, by prioritising patches or updates for security vulnerabilities in internet-facing services and their operating systems, especially when exploitation code exists or active exploitation is occurring.

            If no patches or updates are available for security vulnerabilities, mitigation advice from vendors, trusted authorities or security researchers may provide some protection until patches or updates are made available. Such mitigation advice may be published in conjunction with, or soon after, announcements made relating to security vulnerabilities. Mitigation advice may cover how to disable or block access to vulnerable functionality, how to reconfigure vulnerable functionality, or how to detect attempted or successful exploitation of vulnerable functionality.

            If a patch or update is released for high assurance ICT equipment, the ACSC will conduct an assessment of the patch or update. Subsequently, if the patch or update is approved for deployment, the ACSC will provide guidance on the methods and timeframes in which it is to be applied.
        controls:
        - id: ism-1690
          class: ISM-control
          title: "Control: ism-1690"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[2].group[4].control[01]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1690_smt
            name: statement
            prose: "Patches, updates or vendor mitigations for security vulnerabilities in internet-facing services are applied within two weeks of release, or within 48 hours if an exploit exists."
        - id: ism-1691
          class: ISM-control
          title: "Control: ism-1691"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[2].group[4].control[02]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1691_smt
            name: statement
            prose: "Patches, updates or vendor mitigations for security vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF software, and security products are applied within two weeks of release."
        - id: ism-1692
          class: ISM-control
          title: "Control: ism-1692"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[2].group[4].control[03]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1692_smt
            name: statement
            prose: "Patches, updates or vendor mitigations for security vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF software, and security products are applied within 48 hours if an exploit exists."
        - id: ism-1693
          class: ISM-control
          title: "Control: ism-1693"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[2].group[4].control[04]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1693_smt
            name: statement
            prose: "Patches, updates or vendor mitigations for security vulnerabilities in other applications are applied within one month of release."
        - id: ism-1694
          class: ISM-control
          title: "Control: ism-1694"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[2].group[4].control[05]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1694_smt
            name: statement
            prose: "Patches, updates or vendor mitigations for security vulnerabilities in operating systems of internet-facing services are applied within two weeks of release, or within 48 hours if an exploit exists."
        - id: ism-1695
          class: ISM-control
          title: "Control: ism-1695"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[2].group[4].control[06]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1695_smt
            name: statement
            prose: "Patches, updates or vendor mitigations for security vulnerabilities in operating systems of workstations, servers and network devices are applied within two weeks of release."
        - id: ism-1696
          class: ISM-control
          title: "Control: ism-1696"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[2].group[4].control[07]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1696_smt
            name: statement
            prose: "Patches, updates or vendor mitigations for security vulnerabilities in operating systems of workstations, servers and network devices are applied within 48 hours if an exploit exists."
        - id: ism-1751
          class: ISM-control
          title: "Control: ism-1751"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[2].group[4].control[08]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1751_smt
            name: statement
            prose: "Patches, updates or vendor mitigations for security vulnerabilities in operating systems of other ICT equipment are applied within two weeks of release, or within 48 hours if an exploit exists."
        - id: ism-1697
          class: ISM-control
          title: "Control: ism-1697"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[2].group[4].control[09]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1697_smt
            name: statement
            prose: "Patches, updates or vendor mitigations for security vulnerabilities in drivers and firmware are applied within two weeks of release, or within 48 hours if an exploit exists."
        - id: ism-0300
          class: ISM-control
          title: "Control: ism-0300"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[2].group[4].control[10]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "8"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0300_smt
            name: statement
            prose: "Patches, updates or vendor mitigations for security vulnerabilities in high assurance ICT equipment are applied only when approved by the ACSC, and in doing so, using methods and timeframes prescribed by the ACSC."
      - title: Cessation of support
        props:
        - name: sort-id
          value: "catalog[1].group[16].group[2].group[5]"
        parts:
        - name: overview
          prose: |-
            When applications, operating systems, network devices and other ICT equipment reach their cessation date for support, an organisation will find it increasingly difficult to protect them against security vulnerabilities as patches, updates and other forms of support will no longer be made available by vendors. As such, unsupported applications, operating systems, network devices and other ICT equipment should be removed or replaced.

            In planning for cessation of support, it is important to note that while vendors generally advise the cessation date for support of operating systems well in advance, some applications, network devices and other ICT equipment may cease to receive support immediately after newer versions are released.

            Finally, when the immediate removal or replacement of unsupported applications, operating systems, network devices or other ICT equipment is not possible, compensating controls should be implemented until such time that they can be removed or replaced.
        controls:
        - id: ism-1704
          class: ISM-control
          title: "Control: ism-1704"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[2].group[5].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1704_smt
            name: statement
            prose: "Internet-facing services, office productivity suites, web browsers and their extensions, email clients, PDF software, Adobe Flash Player, and security products that are no longer supported by vendors are removed."
        - id: ism-0304
          class: ISM-control
          title: "Control: ism-0304"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[2].group[5].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-0304_smt
            name: statement
            prose: Applications that are no longer supported by vendors are removed.
        - id: ism-1501
          class: ISM-control
          title: "Control: ism-1501"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[2].group[5].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1501_smt
            name: statement
            prose: Operating systems that are no longer supported by vendors are replaced.
        - id: ism-1753
          class: ISM-control
          title: "Control: ism-1753"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[2].group[5].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1753_smt
            name: statement
            prose: Network devices and other ICT equipment that are no longer supported by vendors are replaced.
        - id: ism-1809
          class: ISM-control
          title: "Control: ism-1809"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[2].group[5].control[5]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1809_smt
            name: statement
            prose: "When applications, operating systems, network devices or other ICT equipment that are no longer supported by vendors cannot be immediately removed or replaced, compensating controls are implemented until such time that they can be removed or replaced."
    - title: Data backup and restoration
      props:
      - name: sort-id
        value: "catalog[1].group[16].group[3]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on
          [digital preservation planning](#53da8dba-961e-4222-94e0-68cb9510384d) and
          [data retention](#348be728-4459-4447-990e-1dfb3049c71f) is available from the National Archives of Australia.

          Further information on the collection and retention of personal information can be found in the Office of the Australian Information Commissioner’s
          [Australian Privacy Principles](#bac2c6f2-9356-46d2-b7c4-9af7393008df) and the associated
          [Australian Privacy Principles guidelines](#1e4a57a2-2832-441d-8ea4-12a98d2be417).

          Further information on business continuity and disaster recovery planning can be found in the Chief Information Security Officer section of the
          [Guidelines for Cyber Security Roles](#626dab35-81ab-45fe-8c12-0faff1c23c07).
      groups:
      - title: Digital preservation policy
        props:
        - name: sort-id
          value: "catalog[1].group[16].group[3].group[1]"
        parts:
        - name: overview
          prose: "Developing, implementing and maintaining a digital preservation policy, as part of digital continuity planning, can assist in ensuring the long term integrity and availability of important data is maintained, especially when taking into account the potential for data degradation and removable media, hardware and software obsolesce."
        controls:
        - id: ism-1510
          class: ISM-control
          title: "Control: ism-1510"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[3].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1510_smt
            name: statement
            prose: "A digital preservation policy is developed, implemented and maintained."
      - title: Data backup and restoration processes and procedures
        props:
        - name: sort-id
          value: "catalog[1].group[16].group[3].group[2]"
        parts:
        - name: overview
          prose: Having data backup and restoration processes and procedures is an important part of business continuity and disaster recovery planning. Such activities will also form an integral part of an overarching digital preservation policy.
        controls:
        - id: ism-1547
          class: ISM-control
          title: "Control: ism-1547"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[3].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1547_smt
            name: statement
            prose: "Data backup processes, and supporting data backup procedures, are developed, implemented and maintained."
        - id: ism-1548
          class: ISM-control
          title: "Control: ism-1548"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[3].group[2].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1548_smt
            name: statement
            prose: "Data restoration processes, and supporting data restoration procedures, are developed, implemented and maintained."
      - title: Performing and retaining backups
        props:
        - name: sort-id
          value: "catalog[1].group[16].group[3].group[3]"
        parts:
        - name: overview
          prose: "To mitigate the security risk of losing system availability or important data as part of a ransomware attack, or other form of destructive attack, backups of important data, software and configuration settings should be performed and retained with a frequency and retention timeframe in accordance with an organisation’s business continuity requirements. In doing so, backups of all important data, software and configuration settings should be synchronised to enable restoration to a common point in time. Furthermore, it is essential that all backups are retained in a secure and resilient manner. This will ensure that should a system fall victim to a ransomware attack, or other form of destructive attack, important data will not be lost and, if necessary, systems can be quickly restored."
        controls:
        - id: ism-1511
          class: ISM-control
          title: "Control: ism-1511"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[3].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1511_smt
            name: statement
            prose: "Backups of important data, software and configuration settings are performed and retained with a frequency and retention timeframe in accordance with business continuity requirements."
        - id: ism-1810
          class: ISM-control
          title: "Control: ism-1810"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[3].group[3].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1810_smt
            name: statement
            prose: "Backups of important data, software and configuration settings are synchronised to enable restoration to a common point in time."
        - id: ism-1811
          class: ISM-control
          title: "Control: ism-1811"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[3].group[3].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1811_smt
            name: statement
            prose: "Backups of important data, software and configuration settings are retained in a secure and resilient manner."
      - title: Backup access
        props:
        - name: sort-id
          value: "catalog[1].group[16].group[3].group[4]"
        parts:
        - name: overview
          prose: "To mitigate the security risk of unauthorised access to backups, an organisation should ensure that access to backups is controlled through the use of appropriate access controls."
        controls:
        - id: ism-1812
          class: ISM-control
          title: "Control: ism-1812"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[3].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1812_smt
            name: statement
            prose: Unprivileged accounts cannot access backups belonging to other accounts.
        - id: ism-1813
          class: ISM-control
          title: "Control: ism-1813"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[3].group[4].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1813_smt
            name: statement
            prose: Unprivileged accounts cannot access their own backups.
        - id: ism-1705
          class: ISM-control
          title: "Control: ism-1705"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[3].group[4].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1705_smt
            name: statement
            prose: Privileged accounts (excluding backup administrator accounts) cannot access backups belonging to other accounts.
        - id: ism-1706
          class: ISM-control
          title: "Control: ism-1706"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[3].group[4].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1706_smt
            name: statement
            prose: Privileged accounts (excluding backup administrator accounts) cannot access their own backups.
      - title: Backup modification and deletion
        props:
        - name: sort-id
          value: "catalog[1].group[16].group[3].group[5]"
        parts:
        - name: overview
          prose: "To mitigate the security risk of backups being accidentally or maliciously modified or deleted, an organisation should ensure that backups are sufficiently protected from unauthorised modification and deletion through the use of appropriate access controls during their retention period."
        controls:
        - id: ism-1814
          class: ISM-control
          title: "Control: ism-1814"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[3].group[5].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1814_smt
            name: statement
            prose: Unprivileged accounts are prevented from modifying and deleting backups.
        - id: ism-1707
          class: ISM-control
          title: "Control: ism-1707"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[3].group[5].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1707_smt
            name: statement
            prose: Privileged accounts (excluding backup administrator accounts) are prevented from modifying and deleting backups.
        - id: ism-1708
          class: ISM-control
          title: "Control: ism-1708"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[3].group[5].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1708_smt
            name: statement
            prose: Privileged accounts (including backup administrator accounts) are prevented from modifying and deleting backups during their retention period.
      - title: Testing restoration of backups
        props:
        - name: sort-id
          value: "catalog[1].group[16].group[3].group[6]"
        parts:
        - name: overview
          prose: "To ensure that backups can be restored when the need arises, and that any dependencies can be identified and managed beforehand, it is important that the restoration of important data, software and configuration settings from backups to a common point in time is tested in a coordinated manner as part of disaster recovery exercises."
        controls:
        - id: ism-1515
          class: ISM-control
          title: "Control: ism-1515"
          props:
          - name: sort-id
            value: "catalog[1].group[16].group[3].group[6].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML2
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1515_smt
            name: statement
            prose: "Restoration of important data, software and configuration settings from backups to a common point of time is tested as part of disaster recovery exercises."
  - title: Guidelines for System Monitoring
    props:
    - name: sort-id
      value: "catalog[1].group[17]"
    groups:
    - title: Event logging and monitoring
      props:
      - name: sort-id
        value: "catalog[1].group[17].group[1]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on logging intrusion activity can be found in the managing cyber security incidents section of the
          [Guidelines for Cyber Security Incidents](#fe0138db-e83b-4a23-85d3-d84e1c22816f).

          Further information on event logging for Cross Domain Solutions can be found in the Cross Domain Solutions section of the
          [Guidelines for Gateways](#e8bde527-526c-4a6a-b66f-05228f09dd7b).

          Further information on event logging for databases can be found in the databases section of the
          [Guidelines for Database Systems](#3f349d16-11a1-459a-a299-c9446aea7597).

          Further information on event logging for gateways can be found in the gateways section of the
          [Guidelines for Gateways](#e8bde527-526c-4a6a-b66f-05228f09dd7b).

          Further information on event logging for operating systems can be found in the operating system hardening and authentication hardening sections of the
          [Guidelines for System Hardening](#de7525f3-a466-40a5-abdd-3ae24a6d1b44).

          Further information on event logging for application-based security services can be found in the operating system hardening section of the
          [Guidelines for System Hardening](#de7525f3-a466-40a5-abdd-3ae24a6d1b44).

          Further information on event logging for network-based security services can be found in the network design and configuration section of the
          [Guidelines for Networking](#f145ff5b-d396-4248-8f48-621349d6f0ed).

          Further information on event logging for server applications can be found in the server application hardening section of the
          [Guidelines for System Hardening](#de7525f3-a466-40a5-abdd-3ae24a6d1b44).

          Further information on event logging for system access can be found in the access to systems and their resources section of the
          [Guidelines for Personnel Security](#7d16ae67-87a7-4861-b939-e13ec279b5a2).

          Further information on event logging for user applications can be found in the user application hardening section of the
          [Guidelines for System Hardening](#de7525f3-a466-40a5-abdd-3ae24a6d1b44).

          Further information on event logging for web applications can be found in the web application development section of the
          [Guidelines for Software Development](#506198a8-7ae8-4c95-8b7b-2a4833cfab4b).

          Further information on event logging for web proxies can be found in the web proxies section of the
          [Guidelines for Gateways](#e8bde527-526c-4a6a-b66f-05228f09dd7b).

          Further information on event logging and forwarding can be found in the Australian Cyber Security Centre’s
          [Windows Event Logging and Forwarding](#de239dae-d1e8-4969-9680-ef3444d32a83) publication.
      groups:
      - title: Event logging policy
        props:
        - name: sort-id
          value: "catalog[1].group[17].group[1].group[1]"
        parts:
        - name: overview
          prose: "By developing an event logging policy, taking into consideration any shared responsibilities between service providers and their customers, an organisation can improve their chances of detecting malicious behaviour on their systems. In doing so, an event logging policy should cover details of events to be logged, event logging facilities to be used, how event logs will be monitored and how long to retain event logs."
        controls:
        - id: ism-0580
          class: ISM-control
          title: "Control: ism-0580"
          props:
          - name: sort-id
            value: "catalog[1].group[17].group[1].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0580_smt
            name: statement
            prose: "An event logging policy is developed, implemented and maintained."
      - title: Event log details
        props:
        - name: sort-id
          value: "catalog[1].group[17].group[1].group[2]"
        parts:
        - name: overview
          prose: "For each event logged, sufficient detail needs to be recorded in order for the event log to be useful."
        controls:
        - id: ism-0585
          class: ISM-control
          title: "Control: ism-0585"
          props:
          - name: sort-id
            value: "catalog[1].group[17].group[1].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0585_smt
            name: statement
            prose: "For each event logged, the date and time of the event, the relevant user or process, the relevant filename, the event description, and the ICT equipment involved are recorded."
      - title: Centralised event logging facility
        props:
        - name: sort-id
          value: "catalog[1].group[17].group[1].group[3]"
        parts:
        - name: overview
          prose: "A centralised event logging facility can be used to capture, protect and manage event logs from multiple sources in a coordinated manner. This may be achieved by using a Security Information and Event Management solution. Furthermore, in support of a centralised event logging facility, it is important that an accurate time source is established and used consistently across systems to assist with identifying connections between events."
        controls:
        - id: ism-1405
          class: ISM-control
          title: "Control: ism-1405"
          props:
          - name: sort-id
            value: "catalog[1].group[17].group[1].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1405_smt
            name: statement
            prose: A centralised event logging facility is implemented and event logs are sent to the facility as soon as possible after they occur.
        - id: ism-1815
          class: ISM-control
          title: "Control: ism-1815"
          props:
          - name: sort-id
            value: "catalog[1].group[17].group[1].group[3].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1815_smt
            name: statement
            prose: Event logs stored within a centralised event logging facility are protected from unauthorised modification and deletion.
        - id: ism-0988
          class: ISM-control
          title: "Control: ism-0988"
          props:
          - name: sort-id
            value: "catalog[1].group[17].group[1].group[3].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0988_smt
            name: statement
            prose: An accurate time source is established and used consistently across systems to assist with identifying connections between events.
      - title: Event log monitoring
        props:
        - name: sort-id
          value: "catalog[1].group[17].group[1].group[4]"
        parts:
        - name: overview
          prose: "Event log monitoring is critical to maintaining the security posture of systems. Notably, such activities involve analysing event logs in a timely manner to detect cyber security events, thereby, leading to the identification of cyber security incidents."
        controls:
        - id: ism-0109
          class: ISM-control
          title: "Control: ism-0109"
          props:
          - name: sort-id
            value: "catalog[1].group[17].group[1].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "8"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-0109_smt
            name: statement
            prose: Event logs are analysed in a timely manner to detect cyber security events.
        - id: ism-1228
          class: ISM-control
          title: "Control: ism-1228"
          props:
          - name: sort-id
            value: "catalog[1].group[17].group[1].group[4].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          - name: essential-eight-applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ML3
          parts:
          - id: ism-1228_smt
            name: statement
            prose: Cyber security events are analysed in a timely manner to identify cyber security incidents.
      - title: Event log retention
        props:
        - name: sort-id
          value: "catalog[1].group[17].group[1].group[5]"
        parts:
        - name: overview
          prose: "The retention of event logs is integral to system monitoring, hunt and incident response activities. As such, event logs for Cross Domain Solutions, databases, Domain Name System services, email servers, gateways, operating systems, remote access services, security services, server applications, system access, user applications, web applications and web proxies should be retained for a suitable period of time to facilitate these activities."
        controls:
        - id: ism-0859
          class: ISM-control
          title: "Control: ism-0859"
          props:
          - name: sort-id
            value: "catalog[1].group[17].group[1].group[5].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0859_smt
            name: statement
            prose: "Event logs, excluding those for Domain Name System services and web proxies, are retained for at least seven years."
        - id: ism-0991
          class: ISM-control
          title: "Control: ism-0991"
          props:
          - name: sort-id
            value: "catalog[1].group[17].group[1].group[5].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0991_smt
            name: statement
            prose: Event logs for Domain Name System services and web proxies are retained for at least 18 months.
  - title: Guidelines for Software Development
    props:
    - name: sort-id
      value: "catalog[1].group[18]"
    groups:
    - title: Application development
      props:
      - name: sort-id
        value: "catalog[1].group[18].group[1]"
      parts:
      - name: overview
        prose: |-
          # Types of application development

          These guidelines are applicable to both traditional application development and mobile application development.

          # Further information

          Further information on a secure development life cycle model, known as
          [The Trustworthy Computing Security Development Lifecycle](#3ec0f0b2-5565-46ad-a1e8-e39cb2219bd2), is available from Microsoft.

          Further information on a secure software development framework can be found in National Institute of Standards and Technology Special Publication 800-218,
          [Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities](#6f1f2f2b-abe6-46e4-9c9d-8339f1d9dab7).

          Further information on memory-safe programming languages can be found in the United States’ National Security Agency’s
          [Software Memory Safety](#26137381-dc34-485c-8331-3bc9876ed48c) publication.

          Further information on
          [secure programming practices](#672e85cc-2d40-46ba-9e94-c604b9731c75) is available from the Carnegie Mellon University’s Software Engineering Institute.

          Further information on
          [cyber supply chain transparency](#d0ace151-3c21-49af-bde7-eda58ab18a82), and recommended content for a software bill of materials, can be found in the United States’ National Telecommunications and Information Administration’s
          [The Minimum Elements For a Software Bill of Materials (SBOM)](#70371e26-f3fb-4b05-85ea-7f6e1f2ee184) publication.

          Further information on implementing a vulnerability disclosure program can be found in:

          * Google’s Starting a Vulnerability Disclosure Program
          * European Union Agency for Cybersecurity’s Good Practice Guide on Vulnerability Disclosure
          * Netherland’s National Cyber Security Centre’s Coordinated Vulnerability Disclosure: The Guideline
          * Carnegie Mellon University’s Software Engineering Institute’s The CERT Guide to Coordinated Vulnerability Disclosure
          * International Organization for Standardization/International Electrotechnical Commission 29147:2018, Information technology – Security techniques – Vulnerability disclosure
          * International Organization for Standardization/International Electrotechnical Commission 30111:2019, Information technology – Security techniques – Vulnerability handling processes.

          Further information on
          [developing a vulnerability disclosure policy](#aab0523a-513e-48c9-978e-32d5b9adeea6) is available from the disclose.io project to assist an organisation with their implementation.

          Further information on
          [recommended contents for a ‘security.txt’ file](#24eb9af8-fb43-4772-a461-2c36dd0f6d7e) is available to assist an organisation with their implementation.

          Further information on
          [reporting security vulnerabilities](#03f761fa-7014-459c-aa16-02c303d50abb) to the ACSC as an independent coordinator is available from the ACSC.
      groups:
      - title: "Development, testing and production environments"
        props:
        - name: sort-id
          value: "catalog[1].group[18].group[1].group[1]"
        parts:
        - name: overview
          prose: "Segregating development, testing and production environments, and associated data, can limit the spread of malicious code and minimises the likelihood of faulty code being introduced into a production environment. Furthermore, protecting the authoritative source for software is critical to preventing malicious code being surreptitiously introduced into software."
        controls:
        - id: ism-0400
          class: ISM-control
          title: "Control: ism-0400"
          props:
          - name: sort-id
            value: "catalog[1].group[18].group[1].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Aug-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0400_smt
            name: statement
            prose: "Development, testing and production environments are segregated."
        - id: ism-1419
          class: ISM-control
          title: "Control: ism-1419"
          props:
          - name: sort-id
            value: "catalog[1].group[18].group[1].group[1].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1419_smt
            name: statement
            prose: Development and modification of software only takes place in development environments.
        - id: ism-1420
          class: ISM-control
          title: "Control: ism-1420"
          props:
          - name: sort-id
            value: "catalog[1].group[18].group[1].group[1].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1420_smt
            name: statement
            prose: Data from production environments is not used in a development or testing environment unless the environment is secured to the same level as the production environment.
        - id: ism-1422
          class: ISM-control
          title: "Control: ism-1422"
          props:
          - name: sort-id
            value: "catalog[1].group[18].group[1].group[1].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1422_smt
            name: statement
            prose: Unauthorised access to the authoritative source for software is prevented.
        - id: ism-1816
          class: ISM-control
          title: "Control: ism-1816"
          props:
          - name: sort-id
            value: "catalog[1].group[18].group[1].group[1].control[5]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1816_smt
            name: statement
            prose: Unauthorised modification of the authoritative source for software is prevented.
      - title: Secure software design and development
        props:
        - name: sort-id
          value: "catalog[1].group[18].group[1].group[2]"
        parts:
        - name: overview
          prose: "The use of secure-by-design and secure-by-default principles, memory-safe programming languages (such as C#, Go, Java, Ruby, Rust and Swift), and secure programming practices, that are supported by agile software development practices and threat modelling, are an important part of application development as they can assist with the identification and mitigation of at risk software components and risky programming practices. In addition, providing mechanisms to assist in determining the authenticity and integrity of applications, while configuring them in a secure manner, can assist with software supply chain security activities."
        controls:
        - id: ism-0401
          class: ISM-control
          title: "Control: ism-0401"
          props:
          - name: sort-id
            value: "catalog[1].group[18].group[1].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0401_smt
            name: statement
            prose: "Secure-by-design and secure-by-default principles, use of memory-safe programming languages where possible, and secure programming practices are used as part of application development."
        - id: ism-1780
          class: ISM-control
          title: "Control: ism-1780"
          props:
          - name: sort-id
            value: "catalog[1].group[18].group[1].group[2].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1780_smt
            name: statement
            prose: SecDevOps practices are used for application development.
        - id: ism-1238
          class: ISM-control
          title: "Control: ism-1238"
          props:
          - name: sort-id
            value: "catalog[1].group[18].group[1].group[2].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1238_smt
            name: statement
            prose: Threat modelling is used in support of application development.
        - id: ism-1796
          class: ISM-control
          title: "Control: ism-1796"
          props:
          - name: sort-id
            value: "catalog[1].group[18].group[1].group[2].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1796_smt
            name: statement
            prose: Files containing executable content are digitally signed as part of application development.
        - id: ism-1797
          class: ISM-control
          title: "Control: ism-1797"
          props:
          - name: sort-id
            value: "catalog[1].group[18].group[1].group[2].control[5]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1797_smt
            name: statement
            prose: "Installers, patches and updates are digitally signed or provided with cryptographic checksums as part of application development."
        - id: ism-1798
          class: ISM-control
          title: "Control: ism-1798"
          props:
          - name: sort-id
            value: "catalog[1].group[18].group[1].group[2].control[6]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1798_smt
            name: statement
            prose: Secure configuration guidance is produced as part of application development.
      - title: Software bill of materials
        props:
        - name: sort-id
          value: "catalog[1].group[18].group[1].group[3]"
        parts:
        - name: overview
          prose: A software bill of materials is a list of open source and commercial software components used in application development. This can assist in providing greater cyber supply chain transparency for consumers by allowing for easier identification and management of security risks associated with individual software components used by applications.
        controls:
        - id: ism-1730
          class: ISM-control
          title: "Control: ism-1730"
          props:
          - name: sort-id
            value: "catalog[1].group[18].group[1].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1730_smt
            name: statement
            prose: A software bill of materials is produced and made available to consumers of software.
      - title: Application security testing
        props:
        - name: sort-id
          value: "catalog[1].group[18].group[1].group[4]"
        parts:
        - name: overview
          prose: "Application security testing can assist software developers in identifying security vulnerabilities in their applications. In doing so, both static application security testing, as well as dynamic application security testing, should be performed in order to achieve comprehensive test coverage. Furthermore, software developers may choose to use an additional independent party to assist with removing any potential for bias that might occur when they test their own applications."
        controls:
        - id: ism-0402
          class: ISM-control
          title: "Control: ism-0402"
          props:
          - name: sort-id
            value: "catalog[1].group[18].group[1].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0402_smt
            name: statement
            prose: "Applications are comprehensively tested for security vulnerabilities, using both static application security testing and dynamic application security testing, prior to their initial release and any subsequent releases."
        - id: ism-1754
          class: ISM-control
          title: "Control: ism-1754"
          props:
          - name: sort-id
            value: "catalog[1].group[18].group[1].group[4].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1754_smt
            name: statement
            prose: Security vulnerabilities identified in applications are resolved by software developers in a timely manner.
      - title: Vulnerability disclosure program
        props:
        - name: sort-id
          value: "catalog[1].group[18].group[1].group[5]"
        parts:
        - name: overview
          prose: |-
            Implementing a vulnerability disclosure program, based on responsible disclosure, can assist an organisation to improve the security of their products and services as it provides a way for security researchers and other members of the public to responsibly notify them of security vulnerabilities in a coordinated manner. Furthermore, following the verification and resolution of reported security vulnerabilities, it can assist an organisation in notifying their customers of security vulnerabilities that have been discovered in their products and services, and any patches, updates or vendor mitigations that should be applied.

            A vulnerability disclosure program should include processes and procedures for receiving, verifying, resolving and reporting security vulnerabilities disclosed by both internal and external parties. In support of this, a vulnerability disclosure policy should be made publicly available that covers:

            * the purpose of the vulnerability disclosure program
            * types of security research that are and are not allowed
            * how to report any security vulnerabilities
            * actions, and associated timeframes, upon notification of security vulnerabilities
            * expectations regarding the public disclosure of security vulnerabilities
            * any recognition or reward for finders of security vulnerabilities.

            Finally, the Australian Cyber Security Centre (ACSC) encourages security researchers and other members of the public to responsibly report security vulnerabilities directly to an organisation. However, the ACSC recognises that this is not always practical, initial attempts at communication may be unsuccessful or the person making the report may not wish to do so directly. In such cases, security vulnerabilities can be reported to the ACSC as an independent coordinator.
        controls:
        - id: ism-1616
          class: ISM-control
          title: "Control: ism-1616"
          props:
          - name: sort-id
            value: "catalog[1].group[18].group[1].group[5].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Aug-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1616_smt
            name: statement
            prose: A vulnerability disclosure program is implemented to assist with the secure development and maintenance of products and services.
        - id: ism-1755
          class: ISM-control
          title: "Control: ism-1755"
          props:
          - name: sort-id
            value: "catalog[1].group[18].group[1].group[5].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1755_smt
            name: statement
            prose: "A vulnerability disclosure policy is developed, implemented and maintained."
        - id: ism-1756
          class: ISM-control
          title: "Control: ism-1756"
          props:
          - name: sort-id
            value: "catalog[1].group[18].group[1].group[5].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1756_smt
            name: statement
            prose: "Vulnerability disclosure processes, and supporting vulnerability disclosure procedures, are developed, implemented and maintained."
        - id: ism-1717
          class: ISM-control
          title: "Control: ism-1717"
          props:
          - name: sort-id
            value: "catalog[1].group[18].group[1].group[5].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1717_smt
            name: statement
            prose: A ‘security.txt’ file is hosted for all internet-facing organisational domains to assist in the responsible disclosure of security vulnerabilities in an organisation’s products and services.
    - title: Web application development
      props:
      - name: sort-id
        value: "catalog[1].group[18].group[2]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on web application security can be found in the
          [OWASP Application Security Verification Standard](#d2f005c5-2ad3-4b5e-9eb1-d0642f3560f4) and
          [OWASP Top Ten Proactive Controls](#18274424-7086-419e-9fae-a6ba64870459) publications.

          Further information on web application security risks can be found in the
          [OWASP Top 10](#436de247-4c95-4449-89a4-fec912605e7d) publication.

          Further information on implementing HTTPS can be found in the ACSC’s
          [Implementing Certificates, TLS, HTTPS and Opportunistic TLS](#b8cdbf18-31cb-4e10-bb43-e8488ee8c2f6) publication.

          Further information on using TLS in HTTPS can be found in the Transport Layer Security section of the
          [Guidelines for Cryptography](#195abe87-bb1e-4006-8b42-eaecca4d51f1).

          Further information on web application security can be found in the ACSC’s
          [Protecting Web Applications and Users](#b3fa2724-3a61-4d68-843a-61cab9e28750) and
          [Securing Content Management Systems](#baf3f7d2-750f-43c8-b805-8fc10228a6fd) publications.

          Further information on API security can be found in the
          [OWASP API Security Top 10](#76087ab6-88d4-4610-9a98-6ddc5f7bd7e6) publication.

          Further information on strong authentication can be found in the authentication hardening section of the
          [Guidelines for System Hardening](#de7525f3-a466-40a5-abdd-3ae24a6d1b44).

          Further information on event logging can be found in the event logging and monitoring section of the
          [Guidelines for System Monitoring](#edc24216-f52b-4513-bcda-5fa564661999).
      groups:
      - title: Open Web Application Security Projects
        props:
        - name: sort-id
          value: "catalog[1].group[18].group[2].group[1]"
        parts:
        - name: overview
          prose: The Open Web Application Security Project (OWASP) provides comprehensive resources for software developers that should be followed when developing web applications.
        controls:
        - id: ism-0971
          class: ISM-control
          title: "Control: ism-0971"
          props:
          - name: sort-id
            value: "catalog[1].group[18].group[2].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "8"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0971_smt
            name: statement
            prose: The OWASP Application Security Verification Standard is used in the development of web applications.
        - id: ism-1849
          class: ISM-control
          title: "Control: ism-1849"
          props:
          - name: sort-id
            value: "catalog[1].group[18].group[2].group[1].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1849_smt
            name: statement
            prose: The OWASP Top Ten Proactive Controls are used in the development of web applications.
        - id: ism-1850
          class: ISM-control
          title: "Control: ism-1850"
          props:
          - name: sort-id
            value: "catalog[1].group[18].group[2].group[1].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1850_smt
            name: statement
            prose: The OWASP Top 10 are mitigated in the development of web applications.
      - title: Web application frameworks
        props:
        - name: sort-id
          value: "catalog[1].group[18].group[2].group[2]"
        parts:
        - name: overview
          prose: "Web application frameworks can be leveraged by software developers to enhance the security of web applications while decreasing development time. These resources can assist in securely implementing complex software functions, such as session management, input handling and cryptographic operations."
        controls:
        - id: ism-1239
          class: ISM-control
          title: "Control: ism-1239"
          props:
          - name: sort-id
            value: "catalog[1].group[18].group[2].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1239_smt
            name: statement
            prose: Robust web application frameworks are used in the development of web applications.
      - title: Web application interactions
        props:
        - name: sort-id
          value: "catalog[1].group[18].group[2].group[3]"
        parts:
        - name: overview
          prose: Hypertext Transfer Protocol Secure (HTTPS) is the Hypertext Transfer Protocol secured by Transport Layer Security (TLS) encryption. The use of HTTPS for web applications can assist in ensuring that interactions with web applications are confidential and that the integrity of such interactions are also maintained.
        controls:
        - id: ism-1552
          class: ISM-control
          title: "Control: ism-1552"
          props:
          - name: sort-id
            value: "catalog[1].group[18].group[2].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Oct-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1552_smt
            name: statement
            prose: All web application content is offered exclusively using HTTPS.
      - title: Web application programming interfaces
        props:
        - name: sort-id
          value: "catalog[1].group[18].group[2].group[4]"
        parts:
        - name: overview
          prose: "Web application programming interfaces (APIs) can facilitate the exchange of data between computing devices. However, poorly-secured web APIs might facilitate unauthorised access to data not authorised for release into the public domain. In addition, poorly-secured web APIs might facilitate unauthorised modification of data. In such cases, ensuring authentication and authorisation of clients is performed when clients call web APIs can assist in mitigating unauthorised access to, or modification of, data."
        controls:
        - id: ism-1817
          class: ISM-control
          title: "Control: ism-1817"
          props:
          - name: sort-id
            value: "catalog[1].group[18].group[2].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1817_smt
            name: statement
            prose: Authentication and authorisation of clients is performed when clients call web APIs that facilitate access to data not authorised for release into the public domain.
        - id: ism-1818
          class: ISM-control
          title: "Control: ism-1818"
          props:
          - name: sort-id
            value: "catalog[1].group[18].group[2].group[4].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1818_smt
            name: statement
            prose: Authentication and authorisation of clients is performed when clients call web APIs that facilitate modification of data.
        - id: ism-1851
          class: ISM-control
          title: "Control: ism-1851"
          props:
          - name: sort-id
            value: "catalog[1].group[18].group[2].group[4].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1851_smt
            name: statement
            prose: The OWASP API Security Top 10 are mitigated in the development of web APIs.
      - title: Web application input handling
        props:
        - name: sort-id
          value: "catalog[1].group[18].group[2].group[5]"
        parts:
        - name: overview
          prose: "Most web application security vulnerabilities are caused by a lack of secure input handling. As such, it is essential that web applications do not trust any input, such as website addresses and their parameters, Hypertext Markup Language (HTML) form data, cookie values, or request headers, without performing validation or sanitisation. Examples of validation and sanitisation include ensuring a telephone form field contains only numerals, ensuring data used in a Structured Query Language query is sanitised properly and ensuring Unicode input is handled appropriately."
        controls:
        - id: ism-1240
          class: ISM-control
          title: "Control: ism-1240"
          props:
          - name: sort-id
            value: "catalog[1].group[18].group[2].group[5].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1240_smt
            name: statement
            prose: Validation or sanitisation is performed on all input handled by web applications.
      - title: Web application output encoding
        props:
        - name: sort-id
          value: "catalog[1].group[18].group[2].group[6]"
        parts:
        - name: overview
          prose: "The likelihood of cross-site scripting and other content injection attacks can be reduced through the use of output encoding. In particular, output encoding is useful when external data sources, which may not be subject to the same level of input filtering, are output to users. The most common example of output encoding is the conversion of potentially dangerous HTML characters into their encoded equivalents, such as ‘\\<’, ‘\\>’ and ‘\\&’ into ‘\\<’, ‘\\>’ and ‘\\&’."
        controls:
        - id: ism-1241
          class: ISM-control
          title: "Control: ism-1241"
          props:
          - name: sort-id
            value: "catalog[1].group[18].group[2].group[6].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1241_smt
            name: statement
            prose: Output encoding is performed on all output produced by web applications.
      - title: Web browser-based controls
        props:
        - name: sort-id
          value: "catalog[1].group[18].group[2].group[7]"
        parts:
        - name: overview
          prose: "Web browser-based controls, such as Content-Security-Policy, Hypertext Transfer Protocol Strict Transport Security (HSTS) and X-Frame-Options, can be used by web applications to help protect themselves and their users. This is achieved via setting security policy in response headers from web applications which web browsers then apply. Note, since the controls are applied via response headers, they can be applied to legacy or proprietary web applications where changes to their source code may be impractical."
        controls:
        - id: ism-1424
          class: ISM-control
          title: "Control: ism-1424"
          props:
          - name: sort-id
            value: "catalog[1].group[18].group[2].group[7].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1424_smt
            name: statement
            prose: "Web applications implement Content-Security-Policy, HSTS and X-Frame-Options via security policy in response headers."
      - title: Web application event logging
        props:
        - name: sort-id
          value: "catalog[1].group[18].group[2].group[8]"
        parts:
        - name: overview
          prose: "Web application events can assist in monitoring the security posture of web applications, detecting malicious behaviour and contributing to investigations following cyber security incidents. To facilitate such activities, web application event logs should be captured and stored centrally."
        controls:
        - id: ism-1536
          class: ISM-control
          title: "Control: ism-1536"
          props:
          - name: sort-id
            value: "catalog[1].group[18].group[2].group[8].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1536_smt
            name: statement
            prose: "The following events are logged for web applications: attempted access that is denied, crashes and error messages, and search queries initiated by users."
        - id: ism-1757
          class: ISM-control
          title: "Control: ism-1757"
          props:
          - name: sort-id
            value: "catalog[1].group[18].group[2].group[8].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1757_smt
            name: statement
            prose: Web application event logs are stored centrally.
  - title: Guidelines for Database Systems
    props:
    - name: sort-id
      value: "catalog[1].group[19]"
    groups:
    - title: Database servers
      props:
      - name: sort-id
        value: "catalog[1].group[19].group[1]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on the functional separation of computing environments can be found in the virtualisation hardening section of the
          [Guidelines for System Hardening](#de7525f3-a466-40a5-abdd-3ae24a6d1b44).

          Further information on encrypting communications can be found in the cryptographic fundamentals section of the
          [Guidelines for Cryptography](#195abe87-bb1e-4006-8b42-eaecca4d51f1).

          Further information on network segmentation and segregation can be found in the network design and configuration section of the
          [Guidelines for Networking](#f145ff5b-d396-4248-8f48-621349d6f0ed).

          Further information on database management system software can be found in the server application hardening section of the
          [Guidelines for System Hardening](#de7525f3-a466-40a5-abdd-3ae24a6d1b44).
      groups:
      - title: Functional separation between database servers and web servers
        props:
        - name: sort-id
          value: "catalog[1].group[19].group[1].group[1]"
        parts:
        - name: overview
          prose: "Due to the higher threat environment that web servers are typically exposed to, hosting database servers and web servers within the same operating environment increases the likelihood of database servers being compromise by an adversary. This security risk can be mitigated by ensuring that database servers are functionally separated from web servers."
        controls:
        - id: ism-1269
          class: ISM-control
          title: "Control: ism-1269"
          props:
          - name: sort-id
            value: "catalog[1].group[19].group[1].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1269_smt
            name: statement
            prose: Database servers and web servers are functionally separated.
      - title: Communications between database servers and web servers
        props:
        - name: sort-id
          value: "catalog[1].group[19].group[1].group[2]"
        parts:
        - name: overview
          prose: "Data communicated between database servers and web servers, especially over the internet, is susceptible to capture by an adversary. As such, it is important that all data communicated between database servers and web servers is encrypted."
        controls:
        - id: ism-1277
          class: ISM-control
          title: "Control: ism-1277"
          props:
          - name: sort-id
            value: "catalog[1].group[19].group[1].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1277_smt
            name: statement
            prose: Data communicated between database servers and web servers is encrypted.
      - title: Network environment
        props:
        - name: sort-id
          value: "catalog[1].group[19].group[1].group[3]"
        parts:
        - name: overview
          prose: "Placing database servers on the same network segment as user workstations can increase the likelihood of database servers being compromise by an adversary. Additionally, in cases where databases will only be accessed from their own database server, allowing remote access to the database server poses an unnecessary security risk."
        controls:
        - id: ism-1270
          class: ISM-control
          title: "Control: ism-1270"
          props:
          - name: sort-id
            value: "catalog[1].group[19].group[1].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1270_smt
            name: statement
            prose: Database servers are placed on a different network segment to user workstations.
        - id: ism-1271
          class: ISM-control
          title: "Control: ism-1271"
          props:
          - name: sort-id
            value: "catalog[1].group[19].group[1].group[3].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jan-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1271_smt
            name: statement
            prose: "Network access controls are implemented to restrict database server communications to strictly defined network resources, such as web servers, application servers and storage area networks."
        - id: ism-1272
          class: ISM-control
          title: "Control: ism-1272"
          props:
          - name: sort-id
            value: "catalog[1].group[19].group[1].group[3].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1272_smt
            name: statement
            prose: "If only local access to a database is required, networking functionality of database management system software is disabled or directed to listen solely to the localhost interface."
      - title: "Separation of development, testing and production database servers"
        props:
        - name: sort-id
          value: "catalog[1].group[19].group[1].group[4]"
        parts:
        - name: overview
          prose: Using production database servers for development and testing activities could result in accidental damage to their integrity or contents.
        controls:
        - id: ism-1273
          class: ISM-control
          title: "Control: ism-1273"
          props:
          - name: sort-id
            value: "catalog[1].group[19].group[1].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1273_smt
            name: statement
            prose: Development and testing environments do not use the same database servers as production environments.
    - title: Databases
      props:
      - name: sort-id
        value: "catalog[1].group[19].group[2]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on event logging can be found in the event logging and monitoring section of the
          [Guidelines for System Monitoring](#edc24216-f52b-4513-bcda-5fa564661999).
      groups:
      - title: Database register
        props:
        - name: sort-id
          value: "catalog[1].group[19].group[2].group[1]"
        parts:
        - name: overview
          prose: "Without knowledge of all the databases in an organisation, and their contents, an organisation will be unable to appropriately protect their assets. As such, it is important that a database register is developed, implemented, maintained and verified on a regular basis."
        controls:
        - id: ism-1243
          class: ISM-control
          title: "Control: ism-1243"
          props:
          - name: sort-id
            value: "catalog[1].group[19].group[2].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1243_smt
            name: statement
            prose: "A database register is developed, implemented, maintained and verified on a regular basis."
      - title: Protecting databases
        props:
        - name: sort-id
          value: "catalog[1].group[19].group[2].group[2]"
        parts:
        - name: overview
          prose: "Databases can be protected from unauthorised copying, and subsequent offline analysis, by applying file-based access controls to database files."
        controls:
        - id: ism-1256
          class: ISM-control
          title: "Control: ism-1256"
          props:
          - name: sort-id
            value: "catalog[1].group[19].group[2].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1256_smt
            name: statement
            prose: File-based access controls are applied to database files.
      - title: Protecting database contents
        props:
        - name: sort-id
          value: "catalog[1].group[19].group[2].group[3]"
        parts:
        - name: overview
          prose: |-
            Database administrators and database users should know the sensitivity or classification associated with databases and their contents. In cases where all of a database’s contents are the same sensitivity or classification, an organisation should classify the entire database at this level and protect it as such. Alternatively, in cases where a database’s contents are of varying sensitivities or classifications, and database users have varying levels of access to the database’s contents, an organisation should protect the database’s contents at a more granular level.

            Restricting database users’ ability to access, insert, modify or remove database contents, based on their work duties, ensures that the likelihood of unauthorised access, modification or deletion of database contents is reduced. Furthermore, where concerns exist that the aggregation of separate pieces of content from within a database could lead to an adversary determining more sensitive or classified content, the need-to-know principle can be enforced through the use of minimum privileges, database views and database roles. Alternatively, the content of concern could be separated by implementing multiple databases, each with restricted data sets.
        controls:
        - id: ism-0393
          class: ISM-control
          title: "Control: ism-0393"
          props:
          - name: sort-id
            value: "catalog[1].group[19].group[2].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "8"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0393_smt
            name: statement
            prose: Databases and their contents are classified based on the sensitivity or classification of data that they contain.
        - id: ism-1255
          class: ISM-control
          title: "Control: ism-1255"
          props:
          - name: sort-id
            value: "catalog[1].group[19].group[2].group[3].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1255_smt
            name: statement
            prose: "Database users’ ability to access, insert, modify and remove database contents is restricted based on their work duties."
        - id: ism-1268
          class: ISM-control
          title: "Control: ism-1268"
          props:
          - name: sort-id
            value: "catalog[1].group[19].group[2].group[3].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1268_smt
            name: statement
            prose: "The need-to-know principle is enforced for database contents through the application of minimum privileges, database views and database roles."
      - title: "Separation of development, testing and production databases"
        props:
        - name: sort-id
          value: "catalog[1].group[19].group[2].group[4]"
        parts:
        - name: overview
          prose: Using database contents from production environments in development or testing environments could result in inadequate protection being applied to the database contents.
        controls:
        - id: ism-1274
          class: ISM-control
          title: "Control: ism-1274"
          props:
          - name: sort-id
            value: "catalog[1].group[19].group[2].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1274_smt
            name: statement
            prose: Database contents from production environments are not used in development or testing environments unless the environment is secured to the same level as the production environment.
      - title: Web application interaction with databases
        props:
        - name: sort-id
          value: "catalog[1].group[19].group[2].group[5]"
        parts:
        - name: overview
          prose: "Structured Query Language (SQL) injection attacks, facilitated by the use of dynamically generated queries, are a significant threat to the confidentiality, integrity and availability of database contents. Specifically, SQL injection attacks can allow an adversary to steal database contents, modify database contents, delete an entire database or even in some circumstances gain control of the underlying database server. Furthermore, when database queries from web applications fail they may display detailed error information about the structure of databases. This can be used by an adversary to further tailor their SQL injection attacks."
        controls:
        - id: ism-1275
          class: ISM-control
          title: "Control: ism-1275"
          props:
          - name: sort-id
            value: "catalog[1].group[19].group[2].group[5].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1275_smt
            name: statement
            prose: All queries to databases from web applications are filtered for legitimate content and correct syntax.
        - id: ism-1276
          class: ISM-control
          title: "Control: ism-1276"
          props:
          - name: sort-id
            value: "catalog[1].group[19].group[2].group[5].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1276_smt
            name: statement
            prose: "Parameterised queries or stored procedures, instead of dynamically generated queries, are used for database interactions."
        - id: ism-1278
          class: ISM-control
          title: "Control: ism-1278"
          props:
          - name: sort-id
            value: "catalog[1].group[19].group[2].group[5].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1278_smt
            name: statement
            prose: Web applications are designed or configured to provide as little error information as possible about the structure of databases.
      - title: Database event logging
        props:
        - name: sort-id
          value: "catalog[1].group[19].group[2].group[6]"
        parts:
        - name: overview
          prose: "Database events can assist in monitoring the security posture of databases, detecting malicious behaviour and contributing to investigations following cyber security incidents. To facilitate such activities, database event logs should be captured and stored centrally."
        controls:
        - id: ism-1537
          class: ISM-control
          title: "Control: ism-1537"
          props:
          - name: sort-id
            value: "catalog[1].group[19].group[2].group[6].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1537_smt
            name: statement
            prose: |-
              The following events are logged for databases:

              * access or modification of particularly important content
              * addition of new users, especially privileged users
              * changes to user roles or privileges
              * attempts to elevate user privileges
              * queries containing comments
              * queries containing multiple embedded queries
              * database and query alerts or failures
              * database structure changes
              * database administrator actions
              * use of executable commands
              * database logons and logoffs.
        - id: ism-1758
          class: ISM-control
          title: "Control: ism-1758"
          props:
          - name: sort-id
            value: "catalog[1].group[19].group[2].group[6].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1758_smt
            name: statement
            prose: Database event logs are stored centrally.
  - title: Guidelines for Email
    props:
    - name: sort-id
      value: "catalog[1].group[20]"
    groups:
    - title: Email usage
      props:
      - name: sort-id
        value: "catalog[1].group[20].group[1]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on the Australian Government’s email protective marking standard can be found in the Attorney-General’s Department’s
          [Protective Security Policy Framework](#92679127-f61d-486a-a93e-df2a26dfb07a),
          [Sensitive and classified information](#e1ebbfe4-ac16-4286-884e-907b2eada22b) policy.
      groups:
      - title: Email usage policy
        props:
        - name: sort-id
          value: "catalog[1].group[20].group[1].group[1]"
        parts:
        - name: overview
          prose: "As there are many security risks associated with the use of email services, it is important that an organisation develops, implements and maintains an email usage policy governing its use."
        controls:
        - id: ism-0264
          class: ISM-control
          title: "Control: ism-0264"
          props:
          - name: sort-id
            value: "catalog[1].group[20].group[1].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0264_smt
            name: statement
            prose: "An email usage policy is developed, implemented and maintained."
      - title: Webmail services
        props:
        - name: sort-id
          value: "catalog[1].group[20].group[1].group[2]"
        parts:
        - name: overview
          prose: "When users access non-approved webmail services, they often bypass controls that have been implemented by an organisation, such as email content filtering. To mitigate this security risk, access to non-approved webmail services should be blocked."
        controls:
        - id: ism-0267
          class: ISM-control
          title: "Control: ism-0267"
          props:
          - name: sort-id
            value: "catalog[1].group[20].group[1].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0267_smt
            name: statement
            prose: Access to non-approved webmail services is blocked.
      - title: Protective markings for emails
        props:
        - name: sort-id
          value: "catalog[1].group[20].group[1].group[3]"
        parts:
        - name: overview
          prose: "Implementing protective markings for emails helps to prevent data spills, such as unauthorised data being released into the public domain. In doing so, it is important that protective markings reflect the highest sensitivity or classification of the subject, body and attachments of emails."
        controls:
        - id: ism-0270
          class: ISM-control
          title: "Control: ism-0270"
          props:
          - name: sort-id
            value: "catalog[1].group[20].group[1].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0270_smt
            name: statement
            prose: "Protective markings are applied to emails and reflect the highest sensitivity or classification of the subject, body and attachments."
      - title: Protective marking tools
        props:
        - name: sort-id
          value: "catalog[1].group[20].group[1].group[4]"
        parts:
        - name: overview
          prose: |-
            Requiring user involvement in the protective marking of emails ensures a conscious decision is made by users, thereby lessening the chance of incorrect protective markings being applied to emails. In addition, allowing users to select only protective markings for which a system is authorised to process, store or communicate lessens the chance of users inadvertently over-classifying emails.

            Email content filters may only check the most recent protective marking applied to emails. Therefore, when users are responding to or forwarding emails, requiring protective markings which are at least as high as that of emails that are received will help email content filters prevent emails being sent to systems that are not authorised to handle their original sensitivity or classification.
        controls:
        - id: ism-0271
          class: ISM-control
          title: "Control: ism-0271"
          props:
          - name: sort-id
            value: "catalog[1].group[20].group[1].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0271_smt
            name: statement
            prose: Protective marking tools do not automatically insert protective markings into emails.
        - id: ism-0272
          class: ISM-control
          title: "Control: ism-0272"
          props:
          - name: sort-id
            value: "catalog[1].group[20].group[1].group[4].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0272_smt
            name: statement
            prose: "Protective marking tools do not allow users to select protective markings that a system has not been authorised to process, store or communicate."
        - id: ism-1089
          class: ISM-control
          title: "Control: ism-1089"
          props:
          - name: sort-id
            value: "catalog[1].group[20].group[1].group[4].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1089_smt
            name: statement
            prose: Protective marking tools do not allow users replying to or forwarding emails to select protective markings lower than previously used.
      - title: "Handling emails with inappropriate, invalid or missing protective markings"
        props:
        - name: sort-id
          value: "catalog[1].group[20].group[1].group[5]"
        parts:
        - name: overview
          prose: |-
            It is important that email servers are configured to block emails with inappropriate protective markings. For example, blocking inbound and outbound emails with protective markings higher than the sensitivity or classification of the receiving system, as this will prevent a data spill from occurring. In doing so, it is important to inform the intended recipients of blocked inbound emails, and the senders of blocked outbound emails, that this has occurred.

            If emails are received with invalid or missing protective markings they may still be passed to their intended recipients. However, the recipients will have an obligation to determine appropriate protective markings if emails are to be responded to, forwarded or printed. If unsure, original senders of emails should be contacted to provide guidance on appropriate protective markings.
        controls:
        - id: ism-0565
          class: ISM-control
          title: "Control: ism-0565"
          props:
          - name: sort-id
            value: "catalog[1].group[20].group[1].group[5].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0565_smt
            name: statement
            prose: "Email servers are configured to block, log and report emails with inappropriate protective markings."
        - id: ism-1023
          class: ISM-control
          title: "Control: ism-1023"
          props:
          - name: sort-id
            value: "catalog[1].group[20].group[1].group[5].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1023_smt
            name: statement
            prose: "The intended recipients of blocked inbound emails, and the senders of blocked outbound emails, are notified."
      - title: Email distribution lists
        props:
        - name: sort-id
          value: "catalog[1].group[20].group[1].group[6]"
        parts:
        - name: overview
          prose: "In some cases, the membership and nationality of members of email distribution lists will be unknown. As such, emails containing Australian Eyes Only, Australian Government Access Only or Releasable To data that are sent to email distribution lists could accidentally cause a data spill."
        controls:
        - id: ism-0269
          class: ISM-control
          title: "Control: ism-0269"
          props:
          - name: sort-id
            value: "catalog[1].group[20].group[1].group[6].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0269_smt
            name: statement
            prose: "Emails containing Australian Eyes Only, Australian Government Access Only or Releasable To data are not sent to email distribution lists unless the nationality of all members of email distribution lists can be confirmed."
    - title: Email gateways and servers
      props:
      - name: sort-id
        value: "catalog[1].group[20].group[2]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on implementing opportunistic TLS encryption for email servers can be found in the Australian Cyber Security Centre (ACSC)’s
          [Implementing Certificates, TLS, HTTPS and Opportunistic TLS](#b8cdbf18-31cb-4e10-bb43-e8488ee8c2f6) publication.

          Further information on implementing SPF, DKIM and DMARC can be found in the ACSC’s
          [How to Combat Fake Emails](#d3572f80-d9d6-4023-b6e6-23720bb0d618) publication.

          Further information on engaging the services of email service providers for marketing or filtering purposes can be found in the ACSC’s
          [Marketing and Filtering Email Service Providers](#e4eee462-f6e5-4921-a8fe-26f3de6c6f45) publication.

          Further information on email content filtering can be found in the content filtering section of the
          [Guidelines for Gateways](#e8bde527-526c-4a6a-b66f-05228f09dd7b).

          Further information on email content filtering can be found in the ACSC’s
          [Malicious Email Mitigation Strategies](#6136b137-0cc9-4d21-94ee-0abfac2b4e18) publication.

          Further information on email security can be found in the following National Institute of Standards and Technology (NIST) publications:

          * NIST Special Publication (SP) 800-45 Rev. 2, Guidelines on Electronic Mail Security
          * NIST SP 800-177 Rev. 1, Trustworthy Email
          * NIST SP 1800-6, Domain Name System-Based Electronic Mail Security.
      groups:
      - title: Centralised email gateways
        props:
        - name: sort-id
          value: "catalog[1].group[20].group[2].group[01]"
        parts:
        - name: overview
          prose: "When routing emails via centralised email gateways it will be easier for an organisation to deploy Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), Domain-based Message Authentication, Reporting and Conformance (DMARC) and protective marking checks."
        controls:
        - id: ism-0569
          class: ISM-control
          title: "Control: ism-0569"
          props:
          - name: sort-id
            value: "catalog[1].group[20].group[2].group[01].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0569_smt
            name: statement
            prose: Emails are routed via centralised email gateways.
        - id: ism-0571
          class: ISM-control
          title: "Control: ism-0571"
          props:
          - name: sort-id
            value: "catalog[1].group[20].group[2].group[01].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0571_smt
            name: statement
            prose: "When users send or receive emails, an authenticated and encrypted channel is used to route emails via their organisation’s centralised email gateways."
      - title: Email gateway maintenance activities
        props:
        - name: sort-id
          value: "catalog[1].group[20].group[2].group[02]"
        parts:
        - name: overview
          prose: "As backup and alternative email gateways are often poorly maintained in terms of patches and email content filtering, an adversary will often seek to exploit this when sending malicious emails to an organisation. As such, it is important that backup and alternative email gateways are maintained at the same standard as an organisation’s primary email gateway."
        controls:
        - id: ism-0570
          class: ISM-control
          title: "Control: ism-0570"
          props:
          - name: sort-id
            value: "catalog[1].group[20].group[2].group[02].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0570_smt
            name: statement
            prose: "Where backup or alternative email gateways are in place, they are maintained at the same standard as the primary email gateway."
      - title: Open relay email servers
        props:
        - name: sort-id
          value: "catalog[1].group[20].group[2].group[03]"
        parts:
        - name: overview
          prose: An open relay email server (or open mail relay) is an email server that is configured to allow anyone on the internet to send emails through it. Such configurations are highly undesirable as spammers and worms can exploit them.
        controls:
        - id: ism-0567
          class: ISM-control
          title: "Control: ism-0567"
          props:
          - name: sort-id
            value: "catalog[1].group[20].group[2].group[03].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0567_smt
            name: statement
            prose: Email servers only relay emails destined for or originating from their domains (including subdomains).
      - title: Email server transport encryption
        props:
        - name: sort-id
          value: "catalog[1].group[20].group[2].group[04]"
        parts:
        - name: overview
          prose: |-
            Emails can be intercepted anywhere between originating email servers and destination email servers. Implementing opportunistic Transport Layer Security (TLS) encryption can mitigate this security risk while ensuring email servers remain compatible with each other. However, opportunistic TLS encryption is susceptible to downgrade attacks. To mitigate this security risk, Mail Transfer Agent Strict Transport Security (MTA-STS) allows domain owners to indicate that email transfers should only occur if satisfactory TLS encryption is negotiated beforehand.

            Implementing MTA-STS reduces the opportunity for downgrade attacks during email transfers, and provides visibility of when they are attempted. TLS reporting supports the implementation of MTA-STS by providing a mechanism for a domain owner to publish a location where reports can be submitted regarding the success or failure of attempts to initiate encrypted connections when sending emails to a specified domain.
        controls:
        - id: ism-0572
          class: ISM-control
          title: "Control: ism-0572"
          props:
          - name: sort-id
            value: "catalog[1].group[20].group[2].group[04].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0572_smt
            name: statement
            prose: Opportunistic TLS encryption is enabled on email servers that make incoming or outgoing email connections over public network infrastructure.
        - id: ism-1589
          class: ISM-control
          title: "Control: ism-1589"
          props:
          - name: sort-id
            value: "catalog[1].group[20].group[2].group[04].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1589_smt
            name: statement
            prose: MTA-STS is enabled to prevent the unencrypted transfer of emails between complying servers.
      - title: Sender Policy Framework
        props:
        - name: sort-id
          value: "catalog[1].group[20].group[2].group[05]"
        parts:
        - name: overview
          prose: "SPF aids in the detection of spoofed emails by specifying a list of hosts or Internet Protocol (IP) addresses that are allowed to send emails on behalf of a specified domain or subdomain. If an email server is not in the SPF record for a domain or subdomain, SPF verification will not pass. In specifying SPF records, domain owners should ensure that they delegate the minimum necessary set of hosts or IP addresses necessary for sending emails. In addition, extra care should be taken when delegating to hosts or IP addresses not under an organisation’s control."
        controls:
        - id: ism-0574
          class: ISM-control
          title: "Control: ism-0574"
          props:
          - name: sort-id
            value: "catalog[1].group[20].group[2].group[05].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0574_smt
            name: statement
            prose: SPF is used to specify authorised email servers (or lack thereof) for all domains (including subdomains).
        - id: ism-1183
          class: ISM-control
          title: "Control: ism-1183"
          props:
          - name: sort-id
            value: "catalog[1].group[20].group[2].group[05].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1183_smt
            name: statement
            prose: A hard fail SPF record is used when specifying authorised email servers (or lack thereof) for all domains (including subdomains).
        - id: ism-1151
          class: ISM-control
          title: "Control: ism-1151"
          props:
          - name: sort-id
            value: "catalog[1].group[20].group[2].group[05].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Oct-19
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1151_smt
            name: statement
            prose: SPF is used to verify the authenticity of incoming emails.
      - title: DomainKeys Identified Mail
        props:
        - name: sort-id
          value: "catalog[1].group[20].group[2].group[06]"
        parts:
        - name: overview
          prose: "DKIM enables the detection of spoofed email contents. This is achieved by DKIM records specifying the public key used to verify the digital signature in an email. Specifically, if the signed digest in an email header does not match the signed contents of the email, verification will not pass."
        controls:
        - id: ism-0861
          class: ISM-control
          title: "Control: ism-0861"
          props:
          - name: sort-id
            value: "catalog[1].group[20].group[2].group[06].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0861_smt
            name: statement
            prose: DKIM signing is enabled on emails originating from an organisation’s domains (including subdomains).
        - id: ism-1026
          class: ISM-control
          title: "Control: ism-1026"
          props:
          - name: sort-id
            value: "catalog[1].group[20].group[2].group[06].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jan-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1026_smt
            name: statement
            prose: DKIM signatures on received emails are verified.
        - id: ism-1027
          class: ISM-control
          title: "Control: ism-1027"
          props:
          - name: sort-id
            value: "catalog[1].group[20].group[2].group[06].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1027_smt
            name: statement
            prose: Email distribution list software used by external senders is configured such that it does not break the validity of the sender’s DKIM signature.
      - title: "Domain-based Message Authentication, Reporting and Conformance"
        props:
        - name: sort-id
          value: "catalog[1].group[20].group[2].group[07]"
        parts:
        - name: overview
          prose: |-
            DMARC enables a domain owner to specify what action receiving email servers should take as a result of domain alignment, SPF and DKIM checks. For emails that do not pass DMARC checks, this includes ‘reject’ (emails are rejected), ‘quarantine’ (emails are marked as spam) or ‘none’ (no action is taken).

            DMARC also provides a reporting feature which enables a domain owner to receive reports on the actions taken by receiving email servers. While this feature does not mitigate malicious emails sent to the domain owner’s organisation, it can give the domain owner some visibility of attempts by an adversary to spoof their organisation’s domains.
        controls:
        - id: ism-1540
          class: ISM-control
          title: "Control: ism-1540"
          props:
          - name: sort-id
            value: "catalog[1].group[20].group[2].group[07].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1540_smt
            name: statement
            prose: DMARC records are configured for all domains (including subdomains) such that emails are rejected if they do not pass DMARC checks.
        - id: ism-1799
          class: ISM-control
          title: "Control: ism-1799"
          props:
          - name: sort-id
            value: "catalog[1].group[20].group[2].group[07].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1799_smt
            name: statement
            prose: Incoming emails are rejected if they do not pass DMARC checks.
      - title: Email content filtering
        props:
        - name: sort-id
          value: "catalog[1].group[20].group[2].group[08]"
        parts:
        - name: overview
          prose: Content filtering performed on email bodies and attachments provides a defence-in-depth approach to preventing malicious code being introduced into networks.
        controls:
        - id: ism-1234
          class: ISM-control
          title: "Control: ism-1234"
          props:
          - name: sort-id
            value: "catalog[1].group[20].group[2].group[08].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1234_smt
            name: statement
            prose: Email content filtering is implemented to filter potentially harmful content in email bodies and attachments.
      - title: Blocking suspicious emails
        props:
        - name: sort-id
          value: "catalog[1].group[20].group[2].group[09]"
        parts:
        - name: overview
          prose: "Blocking specific types of suspicious emails, such as where the email source address uses an internal domain, or internal subdomain, reduces the likelihood of phishing emails entering an organisation’s network."
        controls:
        - id: ism-1502
          class: ISM-control
          title: "Control: ism-1502"
          props:
          - name: sort-id
            value: "catalog[1].group[20].group[2].group[09].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1502_smt
            name: statement
            prose: "Emails arriving via an external connection where the email source address uses an internal domain, or internal subdomain, are blocked at the email gateway."
      - title: Notifications of undeliverable emails
        props:
        - name: sort-id
          value: "catalog[1].group[20].group[2].group[10]"
        parts:
        - name: overview
          prose: "Notifications of undeliverable emails are commonly sent by receiving email servers when emails cannot be delivered, usually because destination addresses are invalid. Due to the common spamming practice of spoofing sender addresses, this often results in a large number of notifications of undeliverable emails being sent to innocent third parties. Sending notifications of undeliverable emails only to senders that can be verified via SPF, or other trusted means, avoids contributing to this problem while allowing legitimate senders to be notified."
        controls:
        - id: ism-1024
          class: ISM-control
          title: "Control: ism-1024"
          props:
          - name: sort-id
            value: "catalog[1].group[20].group[2].group[10].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1024_smt
            name: statement
            prose: Notifications of undeliverable emails are only sent to senders that can be verified via SPF or other trusted means.
  - title: Guidelines for Networking
    props:
    - name: sort-id
      value: "catalog[1].group[21]"
    groups:
    - title: Network design and configuration
      props:
      - name: sort-id
        value: "catalog[1].group[21].group[1]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on wireless networks can be found in the wireless networks section of these guidelines.

          Further information on gateways can be found in the gateways section of the
          [Guidelines for Gateways](#e8bde527-526c-4a6a-b66f-05228f09dd7b).

          Further information on encrypting communications can be found in the cryptographic fundamentals section of the
          [Guidelines for Cryptography](#195abe87-bb1e-4006-8b42-eaecca4d51f1).

          Further information on network segmentation and segregation can be found in the ACSC’s
          [Implementing Network Segmentation and Segregation](#23d977b2-e64e-4ebc-a59f-cd95212045c5) publication.

          Further information on network security zones can be found in the Canadian Centre for Cyber Security’s
          [Baseline Security Requirements for Network Security Zones (Version 2.0)](#b43b0377-c2e4-4cdc-acec-a9ece7371e36) publication.

          Further information on implementing network segmentation and segregation for system administration purposes can be found in the system administration section of the
          [Guidelines for System Management](#c6ca6620-ccd5-4c5d-b97c-9d92f1162948).

          Further information on functional separation of servers using virtualisation can be found in the virtualisation hardening section of the
          [Guidelines for System Hardening](#de7525f3-a466-40a5-abdd-3ae24a6d1b44).

          Further information on event logging can be found in the event logging and monitoring section of the
          [Guidelines for System Monitoring](#edc24216-f52b-4513-bcda-5fa564661999).

          Further information on blocking anonymity network traffic can be found in the ACSC’s
          [Defending Against the Malicious Use of the Tor Network](#ded13757-3c76-40cb-b46e-f84e46a1c1c7) publication.

          Further information on Domain Name System services can be found in the ACSC’s
          [Domain Name System Security for Domain Owners](#b66f8d23-4209-4775-a1fd-bd4dc299a027) and
          [Domain Name System Security for Domain Resolvers](#b13cb68a-a94a-4a69-b094-b1b68d10239e) publications.

          Further information on selecting a protective DNS service can be found in the United States’ National Security Agency and Cybersecurity \& Infrastructure Security Agency’s
          [Selecting a Protective DNS Service](#63b0d043-b6b3-4e2b-bca8-99b42cfd9904) publication.

          Further information on network design and configuration can be found in the United States’ National Security Agency’s
          [Network Infrastructure Security Guide](#1ecfc41e-f6a8-4c96-ac41-1587718ca459) publication.

          Further information on cyber supply chain risk management can be found in the cyber supply chain risk management section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).
      groups:
      - title: Network documentation
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[1].group[01]"
        parts:
        - name: overview
          prose: "It is important that network documentation is developed and accurately depicts the current state of networks, as this can assist in troubleshooting network problems as well as responding to and recovering from cyber security incidents. As such, network documentation should include, at a minimum, high-level network diagrams showing all connections into networks and logical network diagrams showing all critical servers, high-value servers, network devices and network security appliances. Finally, as network documentation could be used by an adversary to assist in compromising networks, it is important that it is appropriately protected."
        controls:
        - id: ism-0518
          class: ISM-control
          title: "Control: ism-0518"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[01].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0518_smt
            name: statement
            prose: "Network documentation is developed, implemented, maintained."
        - id: ism-0516
          class: ISM-control
          title: "Control: ism-0516"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[01].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0516_smt
            name: statement
            prose: "Network documentation includes high-level network diagrams showing all connections into networks and logical network diagrams showing all critical servers, high-value servers, network devices and network security appliances."
        - id: ism-1178
          class: ISM-control
          title: "Control: ism-1178"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[01].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1178_smt
            name: statement
            prose: "Network documentation provided to a third party, or published in public tender documentation, only contains details necessary for other parties to undertake contractual services."
      - title: Network encryption
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[1].group[02]"
        parts:
        - name: overview
          prose: "While physical security can provide a degree of protection against unauthorised physical access to network infrastructure, unauthorised access to unencrypted data can still be gained via other means, such as compromised network devices. For this reason, it is important that all data communicated over network infrastructure is encrypted, even within appropriately secure areas. Note, however, some protocols do not have encrypted equivalents. In such situations, where practical and feasible, an organisation should consider transitioning to the use of alternative protocols that support encryption."
        controls:
        - id: ism-1781
          class: ISM-control
          title: "Control: ism-1781"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[02].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1781_smt
            name: statement
            prose: All data communicated over network infrastructure is encrypted.
      - title: Network segmentation and segregation
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[1].group[03]"
        parts:
        - name: overview
          prose: "Network segmentation and segregation is one of the most effective controls in preventing an adversary from easily propagating throughout networks once initial access has been gained. To achieve this, networks can be segregated into multiple network zones in order to protect servers, services and data. For example, administrative infrastructure used for managing critical servers, high-value servers and regular servers should be segregated from each other. In addition, all administrative infrastructure should be segregated from other assets on networks."
        controls:
        - id: ism-1181
          class: ISM-control
          title: "Control: ism-1181"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[03].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1181_smt
            name: statement
            prose: "Networks are segregated into multiple network zones according to the criticality of servers, services and data."
        - id: ism-1577
          class: ISM-control
          title: "Control: ism-1577"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[03].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1577_smt
            name: statement
            prose: An organisation’s networks are segregated from their service providers’ networks.
      - title: Using Virtual Local Area Networks
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[1].group[04]"
        parts:
        - name: overview
          prose: |-
            Virtual Local Area Networks (VLANs) can be used to implement network segmentation and segregation as long as networks belong to the same security domain. In such cases, if a data spill occurs the impact will be less than if a data spill occurred between two networks of different classifications or between an organisation’s network and public network infrastructure. Should an organisation choose to risk manage implementing VLANs between networks belonging to different security domains, such as at the same classification, additional controls for network devices will apply, such as not sharing VLAN trunks and terminating VLANs on separate physical network interfaces.

            For the purposes of this topic, Multiprotocol Label Switching is considered to be equivalent to VLANs and is subject to the same controls.
        controls:
        - id: ism-1532
          class: ISM-control
          title: "Control: ism-1532"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[04].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1532_smt
            name: statement
            prose: VLANs are not used to separate network traffic between an organisation’s networks and public network infrastructure.
        - id: ism-0529
          class: ISM-control
          title: "Control: ism-0529"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[04].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0529_smt
            name: statement
            prose: VLANs are not used to separate network traffic between networks belonging to different security domains.
        - id: ism-0530
          class: ISM-control
          title: "Control: ism-0530"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[04].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0530_smt
            name: statement
            prose: Network devices managing VLANs are administered from the most trusted security domain.
        - id: ism-0535
          class: ISM-control
          title: "Control: ism-0535"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[04].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0535_smt
            name: statement
            prose: Network devices managing VLANs belonging to different security domains do not share VLAN trunks.
        - id: ism-1364
          class: ISM-control
          title: "Control: ism-1364"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[04].control[5]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1364_smt
            name: statement
            prose: Network devices managing VLANs terminate VLANs belonging to different security domains on separate physical network interfaces.
      - title: Using Internet Protocol version 6
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[1].group[05]"
        parts:
        - name: overview
          prose: |-
            The use of Internet Protocol version 6 (IPv6) can introduce additional security risks to networks. As such, an organisation exclusively using Internet Protocol version 4 (IPv4) should disable IPv6. This will assist in minimising the attack surface of networks and ensure that IPv6 cannot be exploited by an adversary.

            To aid in the transition from IPv4 to IPv6, numerous tunnelling protocols have been developed to allow interoperability between IPv4 and IPv6. Disabling IPv6 tunnelling protocols on networks that do not require such functionality will prevent an adversary from bypassing traditional network defences by encapsulating IPv6 data inside IPv4 packets.

            Stateless Address Autoconfiguration is a method of stateless Internet Protocol (IP) address configuration in IPv6 networks. Notably, it reduces the ability of an organisation to maintain effective logs of IP address assignments on networks. For this reason, stateless IP addressing should be avoided.
        controls:
        - id: ism-0521
          class: ISM-control
          title: "Control: ism-0521"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[05].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0521_smt
            name: statement
            prose: IPv6 functionality is disabled in dual-stack network devices unless it is being used.
        - id: ism-1186
          class: ISM-control
          title: "Control: ism-1186"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[05].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1186_smt
            name: statement
            prose: IPv6 capable network security appliances are used on IPv6 and dual-stack networks.
        - id: ism-1428
          class: ISM-control
          title: "Control: ism-1428"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[05].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1428_smt
            name: statement
            prose: "Unless explicitly required, IPv6 tunnelling is disabled on all network devices."
        - id: ism-1429
          class: ISM-control
          title: "Control: ism-1429"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[05].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1429_smt
            name: statement
            prose: IPv6 tunnelling is blocked by network security appliances at externally-connected network boundaries.
        - id: ism-1430
          class: ISM-control
          title: "Control: ism-1430"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[05].control[5]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1430_smt
            name: statement
            prose: Dynamically assigned IPv6 addresses are configured with Dynamic Host Configuration Protocol version 6 in a stateful manner with lease data stored in a centralised event logging facility.
      - title: Network access controls
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[1].group[06]"
        parts:
        - name: overview
          prose: "If an adversary has reduced opportunities to physically connect unauthorised network devices to networks, they also have reduced opportunities to compromise networks. Network access controls can not only prevent unauthorised physical access to networks, but also prevent personnel from carelessly bridging networks by connecting one network to another network. Furthermore, network access controls can also be useful for limiting the flow of network traffic between network segments."
        controls:
        - id: ism-0520
          class: ISM-control
          title: "Control: ism-0520"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[06].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0520_smt
            name: statement
            prose: Network access controls are implemented on networks to prevent the connection of unauthorised network devices.
        - id: ism-1182
          class: ISM-control
          title: "Control: ism-1182"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[06].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1182_smt
            name: statement
            prose: Network access controls are implemented to limit network traffic within and between network segments to only those required for business purposes.
      - title: Functional separation between servers
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[1].group[07]"
        parts:
        - name: overview
          prose: Implementing functional separation between servers reduces the likelihood that a server compromised by an adversary will pose an increased security risk to other servers.
        controls:
        - id: ism-0385
          class: ISM-control
          title: "Control: ism-0385"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[07].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0385_smt
            name: statement
            prose: Servers maintain effective functional separation with other servers allowing them to operate independently.
        - id: ism-1479
          class: ISM-control
          title: "Control: ism-1479"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[07].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1479_smt
            name: statement
            prose: Servers minimise communications with other servers at both the network and file system level.
      - title: Network management traffic
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[1].group[08]"
        parts:
        - name: overview
          prose: "Implementing security measures specifically for network management traffic provides another layer of defence should an adversary find an opportunity to connect to networks. In addition, this also makes it more difficult for an adversary to enumerate networks."
        controls:
        - id: ism-1006
          class: ISM-control
          title: "Control: ism-1006"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[08].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1006_smt
            name: statement
            prose: Security measures are implemented to prevent unauthorised access to network management traffic.
      - title: Use of Simple Network Management Protocol
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[1].group[09]"
        parts:
        - name: overview
          prose: "The Simple Network Management Protocol (SNMP) can be used to monitor the status of network devices. The first two iterations of SNMP were inherently insecure as they used trivial authentication methods. Furthermore, changing all default SNMP community strings on network devices, and limiting their access to read-only, is strongly encouraged."
        controls:
        - id: ism-1311
          class: ISM-control
          title: "Control: ism-1311"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[09].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1311_smt
            name: statement
            prose: SNMP version 1 and SNMP version 2 are not used on networks.
        - id: ism-1312
          class: ISM-control
          title: "Control: ism-1312"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[09].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1312_smt
            name: statement
            prose: All default SNMP community strings on network devices are changed and write access is disabled.
      - title: Using Network-based Intrusion Detection and Prevention Systems
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[1].group[10]"
        parts:
        - name: overview
          prose: "A Network-based Intrusion Detection System (NIDS) or Network-based Intrusion Prevention System (NIPS) can be an effective way of identifying and responding to network intrusions. In addition, generating event logs and alerts for network traffic that contravenes any rule in a firewall ruleset can help identify suspicious or malicious network traffic entering networks due to a failure of, or configuration change to, firewalls."
        controls:
        - id: ism-1028
          class: ISM-control
          title: "Control: ism-1028"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[10].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "8"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1028_smt
            name: statement
            prose: A NIDS or NIPS is deployed in gateways between an organisation’s networks and other networks they do not manage.
        - id: ism-1030
          class: ISM-control
          title: "Control: ism-1030"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[10].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "8"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1030_smt
            name: statement
            prose: A NIDS or NIPS is located immediately inside the outermost firewall for gateways and configured to generate event logs and alerts for network traffic that contravenes any rule in a firewall ruleset.
      - title: Blocking anonymity network traffic
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[1].group[11]"
        parts:
        - name: overview
          prose: "Inbound network connections from anonymity networks, such as the Tor network, to an organisation’s internet-facing services can be used by an adversary for reconnaissance and malware delivery purposes with minimal risk of detection and attribution. As such, this network traffic should be blocked. However, an organisation might choose to support anonymous connections to their websites to cater for individuals who want to remain anonymous for privacy reasons. In such cases, it is suggested that network traffic from anonymity networks be logged and monitored instead. Additionally, outbound network connections to anonymity networks can be used by malware for command and control or data exfiltration purposes and should be blocked."
        controls:
        - id: ism-1627
          class: ISM-control
          title: "Control: ism-1627"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[11].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Nov-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1627_smt
            name: statement
            prose: Inbound network connections from anonymity networks to internet-facing services are blocked.
        - id: ism-1628
          class: ISM-control
          title: "Control: ism-1628"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[11].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Nov-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1628_smt
            name: statement
            prose: Outbound network connections to anonymity networks are blocked.
      - title: Protective Domain Name System Services
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[1].group[12]"
        parts:
        - name: overview
          prose: |-
            A protective Domain Name System (DNS) service can be an effective way of blocking requests made by an organisation’s users, or an adversary on an organisation’s network, to known malicious domain names – either as part of an initial compromise or subsequent command and control activities. DNS event logs captured by a protective DNS service can also be useful for investigating any exploitation attempt or successful compromise of a network by an adversary.

            In selecting a protective DNS service, many commercial offerings exist. In addition, the Australian Cyber Security Centre (ACSC) also offers a free protective DNS service for all levels of government.
        controls:
        - id: ism-1782
          class: ISM-control
          title: "Control: ism-1782"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[12].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1782_smt
            name: statement
            prose: A protective DNS service is used to block access to known malicious domain names.
      - title: Flashing network devices with trusted firmware before first use
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[1].group[13]"
        parts:
        - name: overview
          prose: "Flashing network devices with trusted firmware, obtained from vendors via trusted means, before network devices are used for the first time can assist in reducing cyber supply chain risks, such as the introduction of malicious firmware resulting from a cyber supply chain interdiction attack or a compromised vendor development environment or source code repository."
        controls:
        - id: ism-1800
          class: ISM-control
          title: "Control: ism-1800"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[13].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1800_smt
            name: statement
            prose: Network devices are flashed with trusted firmware before they are used for the first time.
      - title: Default accounts and credentials for network devices
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[1].group[14]"
        parts:
        - name: overview
          prose: "Network devices can come pre-configured with default accounts and credentials. For example, wireless access points with an account named ‘admin’ and a password of ‘admin’. Ensuring default accounts or credentials are changed can assist in reducing the likelihood of network devices being exploited by an adversary."
        controls:
        - id: ism-1304
          class: ISM-control
          title: "Control: ism-1304"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[14].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1304_smt
            name: statement
            prose: "Default accounts or credentials for network devices including for any pre-configured accounts, are changed."
      - title: Disabling unused physical ports on network devices
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[1].group[15]"
        parts:
        - name: overview
          prose: Disabling unused physical ports on network devices reduces the opportunity for an adversary to connect to networks if they can gain physical access to network devices.
        controls:
        - id: ism-0534
          class: ISM-control
          title: "Control: ism-0534"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[15].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0534_smt
            name: statement
            prose: Unused physical ports on network devices are disabled.
      - title: Regularly restarting network devices
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[1].group[16]"
        parts:
        - name: overview
          prose: Implementing measures to restart network devices on at least a monthly basis can assist in maintaining network device performance as well as removing an adversary that may have compromised a network device but failed to gain persistence.
        controls:
        - id: ism-1801
          class: ISM-control
          title: "Control: ism-1801"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[1].group[16].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1801_smt
            name: statement
            prose: Network devices are restarted on at least a monthly basis.
    - title: Wireless networks
      props:
      - name: sort-id
        value: "catalog[1].group[21].group[2]"
      parts:
      - name: overview
        prose: |-
          # Wireless networks

          This section describes the controls applicable to wireless networks and extends upon the prior network design and configuration section.

          # Further information

          Further information on
          [Wi-Fi technologies](#a9b6660b-fc4c-4a08-8db6-1130370b6b09) and associated
          [certification programs](#86b273d9-e9d7-4919-9a41-631a5ae5bf88) are available from the Wi-Fi Alliance.

          Further information on cyber supply chain risk management can be found in the cyber supply chain risk management section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).

          Further information on evaluated products can be found in the evaluated product procurement section of the
          [Guidelines for Evaluated Products](#a699a3aa-828d-479b-b50b-98127bb19437).

          Further information on encrypting communications can be found in the cryptographic fundamentals section of the
          [Guidelines for Cryptography](#195abe87-bb1e-4006-8b42-eaecca4d51f1).
      groups:
      - title: Choosing wireless devices
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[2].group[01]"
        parts:
        - name: overview
          prose: "Using wireless devices, such as wireless access points, wireless adapters and wireless network cards, which have been certified against a Wi-Fi Alliance certification program, provides an organisation with the assurance that they conform to wireless standards and are guaranteed to be interoperable with other wireless devices on wireless networks."
        controls:
        - id: ism-1314
          class: ISM-control
          title: "Control: ism-1314"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[2].group[01].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1314_smt
            name: statement
            prose: All wireless devices are Wi-Fi Alliance certified.
      - title: Public wireless networks
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[2].group[02]"
        parts:
        - name: overview
          prose: "When an organisation provides a public wireless network for general public use, connecting the public wireless network to, or sharing infrastructure with, any other organisation networks can create an entry point for an adversary allowing them to target organisation networks in order to steal data or disrupt services."
        controls:
        - id: ism-0536
          class: ISM-control
          title: "Control: ism-0536"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[2].group[02].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0536_smt
            name: statement
            prose: Public wireless networks provided for general public use are segregated from all other organisation networks.
      - title: Administrative interfaces for wireless access points
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[2].group[03]"
        parts:
        - name: overview
          prose: "Administrative interfaces allow users to modify the configuration and security settings of wireless access points. Often, by default, wireless access points allow users to access administrative interfaces over fixed network connections or wireless network connections. To assist in reducing the attack surface for wireless access points, the administrative interface should be disabled for wireless network connections."
        controls:
        - id: ism-1315
          class: ISM-control
          title: "Control: ism-1315"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[2].group[03].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1315_smt
            name: statement
            prose: The administrative interface on wireless access points is disabled for wireless network connections.
      - title: Default settings
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[2].group[04]"
        parts:
        - name: overview
          prose: |-
            Some wireless access points come pre-configured with weak configuration settings. As such, it is important to harden the configuration settings of wireless access points prior to their deployment in networks. In addition, some wireless access points come with default Service Set Identifiers (SSIDs). As default SSIDs are often documented on the internet, it is important to change default SSIDs of wireless access points.

            When changing default SSIDs, it is important that new SSIDs do not bring undue attention to an organisation’s wireless networks. In doing so, SSIDs of wireless networks should not be readily associated with an organisation, the location of their premises or the functionality of wireless networks.

            A method commonly recommended to lower the profile of wireless networks is disabling SSID broadcasting. While this ensures that the existence of wireless networks are not broadcast overtly using beacon frames, SSIDs are still broadcast in probe requests, probe responses, association requests and re-association requests. As such, it is easy to determine SSIDs of wireless networks by capturing these requests and responses. By disabling SSID broadcasting, an organisation will make it more difficult for users to connect to wireless networks. Furthermore, an adversary could configure a malicious wireless access point to broadcast the same SSID as a hidden SSID used by a legitimate wireless network, thereby fooling users or devices into automatically connecting to the adversary’s malicious wireless access point instead. In doing so, the adversary could steal authentication credentials in order to gain access to the legitimate wireless network.
        controls:
        - id: ism-1710
          class: ISM-control
          title: "Control: ism-1710"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[2].group[04].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1710_smt
            name: statement
            prose: Configuration settings for wireless access points are hardened.
        - id: ism-1316
          class: ISM-control
          title: "Control: ism-1316"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[2].group[04].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1316_smt
            name: statement
            prose: Default SSIDs of wireless access points are changed.
        - id: ism-1317
          class: ISM-control
          title: "Control: ism-1317"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[2].group[04].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1317_smt
            name: statement
            prose: "SSIDs of non-public wireless networks are not readily associated with an organisation, the location of their premises or the functionality of wireless networks."
        - id: ism-1318
          class: ISM-control
          title: "Control: ism-1318"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[2].group[04].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1318_smt
            name: statement
            prose: SSID broadcasting is not disabled on wireless access points.
      - title: Media Access Control address filtering
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[2].group[05]"
        parts:
        - name: overview
          prose: "Devices that connect to wireless networks generally have a unique Media Access Control (MAC) address. Using MAC address filtering can prevent rogue devices from connecting to wireless networks. However, an adversary may be able to determine MAC addresses of legitimate devices and use this information to gain access to wireless networks. As such, MAC address filtering introduces management overhead without any tangible security benefit."
        controls:
        - id: ism-1320
          class: ISM-control
          title: "Control: ism-1320"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[2].group[05].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1320_smt
            name: statement
            prose: MAC address filtering is not used to restrict which devices can connect to wireless networks.
      - title: Static addressing
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[2].group[06]"
        parts:
        - name: overview
          prose: "Assigning static IP addresses for devices accessing wireless networks can prevent rogue devices connecting to wireless networks from being assigned routable IP addresses. However, an adversary may be able to determine IP addresses of legitimate devices and use this information to gain access to wireless networks. As such, configuring devices to use static IP addresses introduces management overhead without any tangible security benefit."
        controls:
        - id: ism-1319
          class: ISM-control
          title: "Control: ism-1319"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[2].group[06].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1319_smt
            name: statement
            prose: Static addressing is not used for assigning IP addresses on wireless networks.
      - title: Confidentiality and integrity of wireless network traffic
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[2].group[07]"
        parts:
        - name: overview
          prose: |-
            As wireless networks are often capable of being accessed from outside the perimeter of secured spaces, all wireless network traffic requires suitable cryptographic protection. For this purpose it is recommended that Wi-Fi Protected Access 3 (WPA3) be used as it provides equivalent or greater security than its predecessor Wi-Fi Protected Access 2 (WPA2). WPA3 has also prohibited the use of various outdated and insecure cipher suites.

            WPA3-Enterprise supports three enterprise modes of operation: enterprise only mode, transition mode and 192-bit mode. Preference is given to WPA3-Enterprise 192-bit mode as this mode ensures no algorithms with known weaknesses are used. However, if any other WPA3-Enterprise modes are used then Authentication and Key Management suite 00-0F-AC:1 should be disabled (if this option is available).
        controls:
        - id: ism-1332
          class: ISM-control
          title: "Control: ism-1332"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[2].group[07].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1332_smt
            name: statement
            prose: WPA3-Enterprise 192-bit mode is used to protect the confidentiality and integrity of all wireless network traffic.
      - title: 802.1X authentication
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[2].group[08]"
        parts:
        - name: overview
          prose: |-
            WPA3-Enterprise uses 802.1X authentication which requires the use of an Extensible Authentication Protocol (EAP). A number of EAP methods supported by both WPA2 and WPA3 are available.

            Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) is considered one of the most secure EAP methods and is widely supported. It uses a Public Key Infrastructure to secure communications between devices and a Remote Access Dial-In User Service (RADIUS) server through the use of X.509 certificates. While EAP-TLS provides strong mutual authentication, it requires an organisation to have established a Public Key Infrastructure. This involves deploying their own certificate authority and issuing certificates, or sourcing certificates from a commercial certificate authority, for every device that accesses their wireless networks. While this introduces additional costs and management overheads, the security advantages are significant.
        controls:
        - id: ism-1321
          class: ISM-control
          title: "Control: ism-1321"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[2].group[08].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1321_smt
            name: statement
            prose: "802.1X authentication with EAP-TLS, using X.509 certificates, is used for mutual authentication; with all other EAP methods disabled on supplications and authentication servers."
        - id: ism-1711
          class: ISM-control
          title: "Control: ism-1711"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[2].group[08].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1711_smt
            name: statement
            prose: User identity confidentiality is used if available with EAP-TLS implementations.
      - title: Evaluation of 802.1X authentication implementation
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[2].group[09]"
        parts:
        - name: overview
          prose: "The security of 802.1X authentication is dependent on four main elements and how they interact with each other. These four elements include supplicants, authenticators, wireless access points and authentication servers. To provide assurance that these elements have been implemented correctly, they should have completed an evaluation."
        controls:
        - id: ism-1322
          class: ISM-control
          title: "Control: ism-1322"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[2].group[09].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1322_smt
            name: statement
            prose: "Evaluated supplicants, authenticators, wireless access points and authentication servers are used in wireless networks."
      - title: Generating and issuing certificates for authentication
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[2].group[10]"
        parts:
        - name: overview
          prose: |-
            When issuing certificates to devices in order to access wireless networks, an organisation should be aware that certificates could be stolen by malicious code. Once compromised, certificates could be used on other devices to gain unauthorised access to wireless networks. An organisation should also be aware that in only issuing certificates to devices, any actions taken by users will only be attributable to specific devices.

            When issuing certificates to users in order to access wireless networks, it can be in the form of certificates that are stored on devices or certificates that are stored on smart cards. While issuing certificates on smart cards provides increased security, it comes at a higher cost. However, users are more likely to notice missing smart cards and alert their security team, who are then able to revoke their credentials, which can minimise the time an adversary has access to wireless networks. In addition, to reduce the likelihood of stolen smart cards from being used to gain unauthorised access to wireless networks, multi-factor authentication can be implemented through the use of personal identification numbers on smart cards. This is particularly important when smart cards grant users any form of administrative access.
        controls:
        - id: ism-1324
          class: ISM-control
          title: "Control: ism-1324"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[2].group[10].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1324_smt
            name: statement
            prose: Certificates are generated using an evaluated certificate authority or hardware security module.
        - id: ism-1323
          class: ISM-control
          title: "Control: ism-1323"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[2].group[10].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1323_smt
            name: statement
            prose: Certificates are required for both devices and users accessing wireless networks.
        - id: ism-1327
          class: ISM-control
          title: "Control: ism-1327"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[2].group[10].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1327_smt
            name: statement
            prose: "Certificates are protected by encryption, user authentication, and both logical and physical access controls."
      - title: Caching 802.1X authentication outcomes
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[2].group[11]"
        parts:
        - name: overview
          prose: "When 802.1X authentication is used, a shared secret key known as the Pairwise Master Key (PMK) is generated upon successful authentication of devices. This PMK is then capable of being cached to assist with fast roaming between wireless access points. When devices roam away from wireless access points they have authenticated to, they will not need to perform a full re-authentication should they roam back while the cached PMK remains valid. To further assist with roaming, wireless access points can be configured to pre-authenticate devices to neighbouring wireless access points that devices might roam to. Although requiring full authentication for devices each time they roam between wireless access points is ideal, an organisation can choose to use PMK caching and pre-authentication if they have a business requirement for fast roaming. If PMK caching is used, the PMK caching period should not be set to greater than 1440 minutes (24 hours)."
        controls:
        - id: ism-1330
          class: ISM-control
          title: "Control: ism-1330"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[2].group[11].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1330_smt
            name: statement
            prose: The PMK caching period is not set to greater than 1440 minutes (24 hours).
      - title: Fast Basic Service Set Transition
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[2].group[12]"
        parts:
        - name: overview
          prose: "The WPA3 standard specifies support for Fast Basic Service Set Transition (FT) (802.11r). FT is a feature designed to improve user mobility and combat lag introduced by the need to authenticate to each wireless access point. However, FT requires authenticators to request and send keys to other authenticators within a security domain. If any of these keys are intercepted, all security properties are lost. Therefore, it is imperative that communications are appropriately secured. As such, FT should be disabled unless it can be confirmed that authenticator-to-authenticator communications are secured by a suitable ASD-Approved Cryptographic Protocol that provides confidentiality, integrity and mutual authentication."
        controls:
        - id: ism-1712
          class: ISM-control
          title: "Control: ism-1712"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[2].group[12].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1712_smt
            name: statement
            prose: The use of FT (802.11r) is disabled unless authenticator-to-authenticator communications are secured by an ASD-Approved Cryptographic Protocol.
      - title: Remote Authentication Dial-In User Service authentication
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[2].group[13]"
        parts:
        - name: overview
          prose: "Separate to the 802.1X authentication process is the RADIUS authentication process that occurs between authenticators and a RADIUS server. RADIUS is what is known as an authentication, authorisation and accounting protocol, and is intended to mediate network access. However, RADIUS is not secure enough to be used without protection. To protect credentials communicated between authenticators and a RADIUS server, communications should be encapsulated with an additional layer of encryption, such as RADIUS over Internet Protocol Security or RADIUS over Transport Layer Security."
        controls:
        - id: ism-1454
          class: ISM-control
          title: "Control: ism-1454"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[2].group[13].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1454_smt
            name: statement
            prose: Communications between authenticators and a RADIUS server are encapsulated with an additional layer of encryption using RADIUS over Internet Protocol Security or RADIUS over Transport Layer Security.
      - title: Interference between wireless networks
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[2].group[14]"
        parts:
        - name: overview
          prose: "When wireless networks are deployed in close proximity, there is the potential for interference to impact their availability, especially when operating on commonly used 802.11b/g (2.4 GHz) default channels of 1 and 11. Sufficiently separating wireless networks through the use of frequency separation can help reduce this security risk. This can be achieved by using wireless networks that are configured to operate on channels that minimise overlapping frequencies or by using both 802.11b/g (2.4 GHz) channels and 802.11n (5 GHz) channels. It is important to note though, if implementing a mix of 2.4 GHz and 5 GHz channels, not all devices may be compatible with 802.11n and able to connect to 5 GHz channels."
        controls:
        - id: ism-1334
          class: ISM-control
          title: "Control: ism-1334"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[2].group[14].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1334_smt
            name: statement
            prose: Wireless networks implement sufficient frequency separation from other wireless networks.
      - title: Protecting management frames on wireless networks
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[2].group[15]"
        parts:
        - name: overview
          prose: "An effective denial-of-service attack can be performed by exploiting unprotected management frames using inexpensive commercial hardware. The 802.11 standard provides no protection for management frames and therefore does not protect against spoofing or denial-of-service attacks. However, the 802.11w amendment specifically addresses the protection of management frames on wireless networks and should be enabled for WPA2. Note, in WPA3 this feature is built into the standard."
        controls:
        - id: ism-1335
          class: ISM-control
          title: "Control: ism-1335"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[2].group[15].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1335_smt
            name: statement
            prose: Wireless access points enable the use of the 802.11w amendment to protect management frames.
      - title: Wireless network footprint
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[2].group[16]"
        parts:
        - name: overview
          prose: |-
            Instead of deploying a small number of wireless access points that broadcast on high power, a greater number of wireless access points that use less broadcast power can be deployed to achieve the desired footprint for wireless networks. This has the benefit of providing service continuity should wireless access points become unserviceable. In such cases, the output power of nearby wireless access points can be increased to cover the footprint gap until the unserviceable wireless access points can be replaced.

            In addition to minimising the output power of wireless access points to reduce the footprint of wireless networks, the use of Radio Frequency (RF) shielding can be used for an organisation’s facilities. While expensive, this will limit wireless communications to areas under the control of an organisation. RF shielding on an organisation’s facilities also has the added benefit of preventing the jamming of wireless networks from outside of the facilities in which wireless networks are operating.
        controls:
        - id: ism-1338
          class: ISM-control
          title: "Control: ism-1338"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[2].group[16].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1338_smt
            name: statement
            prose: "Instead of deploying a small number of wireless access points that broadcast on high power, a greater number of wireless access points that use less broadcast power are deployed to achieve the desired footprint for wireless networks."
        - id: ism-1013
          class: ISM-control
          title: "Control: ism-1013"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[2].group[16].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1013_smt
            name: statement
            prose: The effective range of wireless communications outside an organisation’s area of control is limited by implementing RF shielding on facilities in which SECRET or TOP SECRET wireless networks are used.
    - title: Service continuity for online services
      props:
      - name: sort-id
        value: "catalog[1].group[21].group[3]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on cyber supply chain risk management can be found in the cyber supply chain risk management section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).

          Further information on the use of cloud service providers can be found in the managed services and cloud services section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).

          Further information on business continuity and disaster recovery planning can be found in the Chief Information Security Officer section of the
          [Guidelines for Cyber Security Roles](#626dab35-81ab-45fe-8c12-0faff1c23c07).

          Further information on mitigating denial-of-service attacks can be found in the ACSC’s
          [Preparing for and Responding to Denial-of-Service Attacks](#c54cc4db-22f4-4d10-8977-2ce62b647bd2) publication.
      groups:
      - title: Cloud-based hosting of online services
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[3].group[1]"
        parts:
        - name: overview
          prose: "Using cloud service providers can allow an organisation to build highly resilient online services due to the increased computing resources, bandwidth and multiple separate physical sites made available by the cloud server providers. An organisation can achieve the same results using their own infrastructure. However, doing so may require significant upfront costs and may still result in a limited capability to scale dynamically to meet increased demand. In case of a denial-of-service attack, cloud-based hosting can also provide segregation from self-hosted or other cloud-hosted services ensuring that other systems, such as email, are not affected."
        controls:
        - id: ism-1437
          class: ISM-control
          title: "Control: ism-1437"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[3].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1437_smt
            name: statement
            prose: Cloud service providers are used for hosting online services.
      - title: Location policies for online services
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[3].group[2]"
        parts:
        - name: overview
          prose: "When using cloud service providers, an organisation will need to consider whether they should lock their data to specific regions or availability zones. In choosing to do so, an organisation will have an expectation that their data will not be relocated to different regions or availability zones by cloud service providers."
        controls:
        - id: ism-1578
          class: ISM-control
          title: "Control: ism-1578"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[3].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1578_smt
            name: statement
            prose: An organisation is notified by cloud service providers of any change to configured regions or availability zones for online services.
      - title: Availability planning and monitoring for online services
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[3].group[3]"
        parts:
        - name: overview
          prose: |-
            It is important that connectivity between an organisation and their cloud service providers meets requirements for bandwidth, latency and reliability. In support of this, an organisation and their cloud service providers should discuss any specific network requirements, performance characteristics or planned responses to availability failures, especially when a requirement for high availability exists. Furthermore, an organisation and their cloud service providers should discuss whether dedicated communication links or connections over the internet will be used and whether any secondary communications links will provide sufficient capacity to maintain operational requirements should the primary communication link become unavailable.

            Furthermore, capacity monitoring should be performed in order to manage workloads and monitor the health of online services. This can be achieved through continuous real-time monitoring of metrics, such as latency, jitter, packet loss, throughput and availability. In addition, feedback should be provided to cloud service providers when performance does not meet service level agreement targets. To assist with this, anomaly detection can be performed through network telemetry that is integrated into security monitoring tools.
        controls:
        - id: ism-1579
          class: ISM-control
          title: "Control: ism-1579"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[3].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1579_smt
            name: statement
            prose: Cloud service providers’ ability to dynamically scale resources due to a genuine spike in demand or a denial-of-service attack is tested as part of capacity planning processes for online services.
        - id: ism-1580
          class: ISM-control
          title: "Control: ism-1580"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[3].group[3].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1580_smt
            name: statement
            prose: "Where a high availability requirement exists for online services, the services are architected to automatically transition between availability zones."
        - id: ism-1441
          class: ISM-control
          title: "Control: ism-1441"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[3].group[3].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1441_smt
            name: statement
            prose: "Where a requirement for high availability exists for online services, a denial of service mitigation service is used."
        - id: ism-1581
          class: ISM-control
          title: "Control: ism-1581"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[3].group[3].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1581_smt
            name: statement
            prose: Continuous real-time monitoring of the availability of online services is performed.
      - title: Using content delivery networks
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[3].group[4]"
        parts:
        - name: overview
          prose: |-
            Similar to cloud-based hosting, the use of content delivery networks (CDNs) can allow an organisation to create highly resilient online services by leveraging the large bandwidth, geographically dispersed hosting locations, traffic scrubbing and other controls offered by CDNs.

            The use of CDNs is particularly effective when serving static bandwidth intensive media, such as images, sound or video files. However, the services offered by CDNs can include more than basic content hosting, such as web response caching, load balancing, web application security and denial of service mitigations.

            Care should be taken when configuring the use of CDNs to ensure that the IP addresses of an organisation’s web servers are not identifiable by an adversary, as this could allow for protections to be bypassed. Additionally, appropriate controls should be applied to only allow communication between an organisation’s web servers, CDNs and authorised management networks.
        controls:
        - id: ism-1438
          class: ISM-control
          title: "Control: ism-1438"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[3].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1438_smt
            name: statement
            prose: "Where a high availability requirement exists for website hosting, CDNs that cache websites are used."
        - id: ism-1439
          class: ISM-control
          title: "Control: ism-1439"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[3].group[4].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1439_smt
            name: statement
            prose: "If using CDNs, disclosing the IP addresses of web servers under an organisation’s control (referred to as origin servers) is avoided and access to the origin servers is restricted to the CDNs and authorised management networks."
      - title: Denial of service strategies
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[3].group[5]"
        parts:
        - name: overview
          prose: |-
            Denial-of-service attacks are designed to disrupt or degrade online services, such as website, email and Domain Name System services. To achieve this goal, an adversary may use a number of methods to deny access to legitimate users of online services. This includes using multiple computers to direct a large volume of unwanted network traffic at online services in an attempt to consume all available network bandwidth, using multiple computers to direct tailored network traffic at online services in an attempt to consume the processing resources of online services, or hijacking online services in an attempt to redirect legitimate users away from those services to other services that the adversary controls.

            Although an organisation cannot avoid being targeted by denial-of-service attacks, there are a number of measures they can implement to prepare for and potentially reduce the impact if targeted. This includes engaging with their cloud service providers to identify the denial of service detection technologies that may be available for their use. For example, real-time capacity reporting dashboards that provide out-of-band and real-time alerts based on organisation-defined thresholds can assist with the rapid identification of denial-of-service attacks.

            Finally, not all online services offered by an organisation may be business critical. Understanding what online services can be disabled or offered with reduced functionality during denial-of-service attacks can help an organisation reduce or eliminate the impact on essential services. Overall, preparing for denial-of-service attacks before they occur is by far the best strategy as it is very difficult to respond once they begin and efforts at this stage are unlikely to be effective.
        controls:
        - id: ism-1431
          class: ISM-control
          title: "Control: ism-1431"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[3].group[5].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1431_smt
            name: statement
            prose: |-
              Denial-of-service attack mitigation strategies are discussed with cloud service providers, specifically:

              * their capacity to withstand denial-of-service attacks
              * any costs likely to be incurred as a result of denial-of-service attacks
              * thresholds for notification of denial-of-service attacks
              * thresholds for turning off online services during denial-of-service attacks
              * pre-approved actions that can be undertaken during denial-of-service attacks
              * any arrangements with upstream service providers to block malicious network traffic as far upstream as possible.
        - id: ism-1458
          class: ISM-control
          title: "Control: ism-1458"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[3].group[5].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1458_smt
            name: statement
            prose: "The functionality and quality of online services, how to maintain such functionality, and what functionality can be lived without during a denial-of-service attack, are determined and documented."
      - title: Domain name registrar locking
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[3].group[6]"
        parts:
        - name: overview
          prose: The use of domain name registrar locking can prevent a denial of service caused by unauthorised modification of a domain’s registration details or unauthorised deletion or transfer of a domain.
        controls:
        - id: ism-1432
          class: ISM-control
          title: "Control: ism-1432"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[3].group[6].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1432_smt
            name: statement
            prose: Domain names for online services are protected via registrar locking and confirming domain registration details are correct.
      - title: Monitoring with real-time alerting for online services
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[3].group[7]"
        parts:
        - name: overview
          prose: An organisation should perform automated monitoring of online services with real-time alerting to ensure that a denial-of-service attack is detected and responded to as soon as possible.
        controls:
        - id: ism-1435
          class: ISM-control
          title: "Control: ism-1435"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[3].group[7].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1435_smt
            name: statement
            prose: Availability monitoring with real-time alerting is implemented for online services to detect denial-of-service attacks and measure their impact.
      - title: Segregation of critical online services
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[3].group[8]"
        parts:
        - name: overview
          prose: "Denial-of-service attacks are typically focused on highly visible online services, such as an organisation’s core website, in order to have a publicly noticeable impact. By segregating online services, such as using one internet connection for email and internet access, and a separate internet connection for web hosting services, the impact of a denial-of-service attack can be limited."
        controls:
        - id: ism-1436
          class: ISM-control
          title: "Control: ism-1436"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[3].group[8].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1436_smt
            name: statement
            prose: Critical online services are segregated from other online services that are more likely to be targeted.
      - title: Preparing for service continuity
        props:
        - name: sort-id
          value: "catalog[1].group[21].group[3].group[9]"
        parts:
        - name: overview
          prose: "An organisation’s full-featured website may have higher processing or resource demands due to database integration or the presence of high-resolution images and videos. These additional resource requirements may make the website more susceptible to denial-of-service attacks. As such, depending on the nature of a denial-of-service attack, replacing the full-featured website with a minimal impact static version can help provide a level of service which would otherwise not be possible."
        controls:
        - id: ism-1518
          class: ISM-control
          title: "Control: ism-1518"
          props:
          - name: sort-id
            value: "catalog[1].group[21].group[3].group[9].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1518_smt
            name: statement
            prose: A static version of a website is pre-prepared that requires minimal processing and bandwidth in order to facilitate at least a basic level of service when under a denial-of-service attack.
  - title: Guidelines for Cryptography
    props:
    - name: sort-id
      value: "catalog[1].group[22]"
    groups:
    - title: Cryptographic fundamentals
      props:
      - name: sort-id
        value: "catalog[1].group[22].group[1]"
      parts:
      - name: overview
        prose: |-
          # Purpose of cryptography

          The purpose of cryptography is to provide confidentiality, integrity, authentication and non-repudiation of data. In doing so, confidentiality protects data by making it unreadable to all but authorised entities, integrity protects data from accidental or deliberate manipulation by entities, authentication ensures that an entity is who they claim to be, and non-repudiation provides proof that an entity performed a particular action.

          # Using encryption

          Encryption of data at rest can be used to protect sensitive or classified data stored on ICT equipment and media. In addition, encryption of data in transit can be used to protect sensitive or classified data communicated over public network infrastructure. However, when an organisation uses encryption for data at rest, or data in transit, they are not reducing the sensitivity or classification of the data, they are simply reducing the immediate consequences of the data being accessed by an adversary.

          # International standards for cryptographic modules

          International Organization for Standardization (ISO)/International Electrotechnical Commission (IEC) 19790:2012,
          [Information technology – Security techniques – Security requirements for cryptographic modules](#a07c439d-b2f4-4ee2-b56e-f17000f3722f), and ISO/IEC 24759:2017,
          [Information technology – Security techniques – Test requirements for cryptographic modules](#aaf83df2-02e3-4f9f-bdf5-33fbff42842d), are international standards for the design and validation of hardware and software cryptographic modules.

          Federal Information Processing Standard (FIPS) 140-3,
          [Security Requirements for Cryptographic Modules](#32c8fa3a-45bb-4f88-baee-73a7696aa2ad) and National Institute of Standards and Technology (NIST) Special Publication (SP) 180-140,
          [FIPS 140-3 Derived Test Requirements (DTR): CMVP Validation Authority Updates to ISO/IEC 24759](#197db872-c6a9-4b29-9888-1552e908252c) are United States standards based upon ISO/IEC 19790:2012 and ISO/IEC 24759:2017.

          # Further information

          Further information on cryptographic key management practices can be found in NIST SP 800-57 Part 1 Rev. 5,
          [Recommendation for Key Management: Part 1 – General](#ffc8a1f6-f4e3-4ff5-a7f9-f41f766274eb).

          Further information on cryptographic key management practices for ASD-approved HACE is available from the ACSC.

          Further information on cyber supply chain risk management can be found in the cyber supply chain risk management section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).

          Further information on evaluated products can be found in the evaluated product procurement section of the
          [Guidelines for Evaluated Products](#a699a3aa-828d-479b-b50b-98127bb19437).

          Further information on the evaluation of cryptographic modules, including testing requirements, is available as part of the
          [Cryptographic Module Validation Program](#28cd91d2-e5cb-4896-bcfc-abb32e05e61d) which is jointly operated by NIST and the Canadian Centre for Cyber Security.

          Further information on the protection of ICT equipment and media can be found in the Attorney-General’s Department’s
          [Protective Security Policy Framework](#92679127-f61d-486a-a93e-df2a26dfb07a),
          [Physical security for entity resources](#6e456a92-f405-4151-88ca-5621aa23519b) policy.
      groups:
      - title: ASD-approved High Assurance Cryptographic Equipment
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[1].group[1]"
        parts:
        - name: overview
          prose: "In order to ensure interoperability and maintain trust, all High Assurance Cryptographic Equipment (HACE) that processes, stores or communicates SECRET or TOP SECRET data must be approved for use by the Australian Signals Directorate (ASD). In addition, the Australian Cyber Security Centre (ACSC) specifies additional requirements in Australian Communications Security Instructions and other cyber security-related publications for ASD-approved HACE that must be complied with. Such requirements supplement these guidelines and, where conflicts occur, take precedence."
        controls:
        - id: ism-1802
          class: ISM-control
          title: "Control: ism-1802"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[1].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1802_smt
            name: statement
            prose: "HACE does not process, store or communicate SECRET or TOP SECRET data until approved for use by ASD."
        - id: ism-0499
          class: ISM-control
          title: "Control: ism-0499"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[1].group[1].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "10"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0499_smt
            name: statement
            prose: All communications security and equipment-specific doctrine produced by the ACSC for the management and use of ASD-approved HACE is complied with.
      - title: Cryptographic key management processes and procedures
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[1].group[2]"
        parts:
        - name: overview
          prose: "Well documented cryptographic key management processes and procedures can assist with the secure use and management of cryptographic keys and associated hardware and software. In doing so, cryptographic key management processes and procedures should cover cryptographic key generation, registration, distribution, installation, usage, protection, storage, access, recovery and destruction."
        controls:
        - id: ism-0507
          class: ISM-control
          title: "Control: ism-0507"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[1].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0507_smt
            name: statement
            prose: "Cryptographic key management processes, and supporting cryptographic key management procedures, are developed, implemented and maintained."
      - title: Encrypting data at rest
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[1].group[3]"
        parts:
        - name: overview
          prose: "When encryption is applied to data at rest it provides an additional layer of defence against unauthorised access by an adversary. In doing so, it is important that full disk encryption is used as it provides a greater level of protection than file-based encryption. This is due to the fact that while file-based encryption may encrypt individual files, there is the possibility that unencrypted copies of files may be left in temporary locations used by an operating system. When selecting cryptographic equipment or software for this purpose, the level of assurance required will depend on the sensitivity or classification of the data."
        controls:
        - id: ism-1080
          class: ISM-control
          title: "Control: ism-1080"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[1].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1080_smt
            name: statement
            prose: An ASD-Approved Cryptographic Algorithm (AACA) or high assurance cryptographic algorithm is used when encrypting media.
        - id: ism-0460
          class: ISM-control
          title: "Control: ism-0460"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[1].group[3].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "12"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0460_smt
            name: statement
            prose: ASD-approved HACE is used when encrypting media that contains SECRET or TOP SECRET data.
        - id: ism-0459
          class: ISM-control
          title: "Control: ism-0459"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[1].group[3].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0459_smt
            name: statement
            prose: "Full disk encryption, or partial encryption where access controls will only allow writing to the encrypted partition, is implemented when encrypting data at rest."
      - title: Encrypting data in transit
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[1].group[4]"
        parts:
        - name: overview
          prose: "When data is communicated over network infrastructure, encryption should be used to protect the data from unauthorised access or manipulation. When selecting cryptographic equipment or software for this purpose, the level of assurance required will depend on the sensitivity or classification of the data and the environment in which it is being applied."
        controls:
        - id: ism-0469
          class: ISM-control
          title: "Control: ism-0469"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[1].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0469_smt
            name: statement
            prose: An ASD-Approved Cryptographic Protocol (AACP) or high assurance cryptographic protocol is used to protect data when communicated over network infrastructure.
        - id: ism-0467
          class: ISM-control
          title: "Control: ism-0467"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[1].group[4].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "11"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0467_smt
            name: statement
            prose: "ASD-approved HACE is used to protect SECRET and TOP SECRET data when communicated over insufficiently secure networks, outside of appropriately secure areas or via public network infrastructure."
      - title: Data recovery
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[1].group[5]"
        parts:
        - name: overview
          prose: "To ensure that access to encrypted data is not lost due to the loss, damage or failure of an encryption key, it is important that where practical cryptographic equipment and software provides a means of data recovery."
        controls:
        - id: ism-0455
          class: ISM-control
          title: "Control: ism-0455"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[1].group[5].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0455_smt
            name: statement
            prose: "Where practical, cryptographic equipment and software provides a means of data recovery to allow for circumstances where the encryption key is unavailable due to loss, damage or failure."
      - title: Handling encrypted ICT equipment and media
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[1].group[6]"
        parts:
        - name: overview
          prose: "When a user authenticates to the encryption functionality of ICT equipment or media, encrypted data is made available. At such a time, the ICT equipment or media should be handled according to its original sensitivity or classification. Once the user deauthenticates from the encryption functionality, such as shutting down a device or activating a lock screen, the ICT equipment or media can be considered to be protected by the encryption functionality again."
        controls:
        - id: ism-0462
          class: ISM-control
          title: "Control: ism-0462"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[1].group[6].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0462_smt
            name: statement
            prose: "When a user authenticates to the encryption functionality of ICT equipment or media, it is treated in accordance with its original sensitivity or classification until the user deauthenticates from the encryption functionality."
      - title: Transporting cryptographic equipment
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[1].group[7]"
        parts:
        - name: overview
          prose: "Transporting cryptographic equipment in a keyed state may expose its keying material to potential compromise. Therefore, if cryptographic equipment is transported in a keyed state it should be done based on the sensitivity or classification of its keying material."
        controls:
        - id: ism-0501
          class: ISM-control
          title: "Control: ism-0501"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[1].group[7].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0501_smt
            name: statement
            prose: Keyed cryptographic equipment is transported based on the sensitivity or classification of its keying material.
      - title: Reporting cryptographic-related cyber security incidents
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[1].group[8]"
        parts:
        - name: overview
          prose: "If cryptographic equipment or associated keying material is compromised, or suspected of being compromised, then the confidentiality and integrity of previous and future communications may also be compromised. In such cases, the cyber security incident should be reported to an organisation’s Chief Information Security Officer, or one of their delegates, as soon as possible after it occurs and all keying material should be changed."
        controls:
        - id: ism-0142
          class: ISM-control
          title: "Control: ism-0142"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[1].group[8].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0142_smt
            name: statement
            prose: "The compromise or suspected compromise of cryptographic equipment or associated keying material is reported to an organisation’s Chief Information Security Officer, or one of their delegates, as soon as possible after it occurs."
        - id: ism-1091
          class: ISM-control
          title: "Control: ism-1091"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[1].group[8].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1091_smt
            name: statement
            prose: Keying material is changed when compromised or suspected of being compromised.
    - title: ASD-Approved Cryptographic Algorithms
      props:
      - name: sort-id
        value: "catalog[1].group[22].group[2]"
      parts:
      - name: overview
        prose: |-
          # High assurance cryptographic algorithms

          High assurance cryptographic algorithms, which are not covered in this section, can be used for the protection of SECRET and TOP SECRET data if they are suitably implemented in ASD-approved HACE. Further information on high assurance cryptographic algorithms can be obtained from the ACSC.

          # ASD-Approved Cryptographic Algorithms

          There is no guarantee of an algorithm’s resistance to currently unknown attacks. However, the algorithms listed in this section have been extensively scrutinised by industry and academic communities in a practical and theoretical setting. Approval for the use of the algorithms listed in this section is limited to cases where they are implemented in accordance with these guidelines.

          The approved asymmetric/public key algorithms are:

          * Diffie-Hellman (DH) for agreeing on encryption session keys
          * Digital Signature Algorithm (DSA) for digital signatures
          * Elliptic Curve Diffie-Hellman (ECDH) for key exchange
          * Elliptic Curve Digital Signature Algorithm (ECDSA) for digital signatures
          * Rivest-Shamir-Adleman (RSA) for digital signatures and passing encryption session keys or similar keys.

          The only approved hashing algorithm is Secure Hashing Algorithm 2 (SHA-2).

          The only approved symmetric encryption algorithm is Advanced Encryption Standard (AES).

          Where there is a range of key sizes for an algorithm, some of the smaller key sizes are not approved as they do not provide an adequate safety margin against possible future attacks. For example, advances in integer factorisation methods could render smaller RSA moduli vulnerable.

          The targets used for the effective security strength of algorithms listed within this section are 112 bits for PROTECTED and below data, 128 bits for SECRET data and 192 bits for TOP SECRET data. However, some key sizes and curves are preferred in order to ensure interoperability with the United States’ initial Commercial National Security Algorithm Suite (now referred to as CNSA 1.0).

          # Further information

          Further information on the United States’
          [Commercial National Security Algorithm Suite](#e8a28fa5-4ea1-4ef5-a870-4d59e40fab37) is available from the United States’ National Security Agency.

          Further information on post-quantum cryptographic algorithms can be found in the ACSC’s
          [Planning for Post-Quantum Cryptography](#0b1a477d-b08a-4491-9cfc-c9d435b28dc8) publication.
      groups:
      - title: Using ASD-Approved Cryptographic Algorithms
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[2].group[01]"
        parts:
        - name: overview
          prose: "If cryptographic equipment or software implements unapproved algorithms, it is possible that these algorithms could be used without a user’s knowledge. In combination with an assumed level of security confidence, this can represent a security risk. As such, an organisation can ensure that only AACAs or high assurance cryptographic algorithms can be used by disabling all unapproved algorithms (preferred) or by advising users not to use the unapproved algorithms via usage policies."
        controls:
        - id: ism-0471
          class: ISM-control
          title: "Control: ism-0471"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[2].group[01].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0471_smt
            name: statement
            prose: Only AACAs or high assurance cryptographic algorithms are used by cryptographic equipment and software.
      - title: Asymmetric/public key algorithms
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[2].group[02]"
        parts:
        - name: overview
          prose: "DH and DSA are vulnerable to different types of attacks than ECDH and ECDSA. As a result, ECDH and ECDSA offer more effective security per bit increase. This leads to smaller data requirements which in turn means that elliptic curve variants have become de facto global standards. For reduced data cost, and to promote interoperability, ECDH and ECDSA should be used where possible."
        controls:
        - id: ism-0994
          class: ISM-control
          title: "Control: ism-0994"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[2].group[02].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0994_smt
            name: statement
            prose: ECDH and ECDSA are used in preference to DH and DSA.
      - title: Using Diffie-Hellman
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[2].group[03]"
        parts:
        - name: overview
          prose: |-
            A modulus of 2048 bits for correctly implemented DH provides 112 bits of effective security strength. Taking into account projected technological advances, it is assessed that 112 bits of effective security strength will remain secure until 2030.

            When DH in a prime field is used, the prime modulus impacts the security of the algorithm. The security considerations when creating such a prime modulus can be found in NIST SP 800-56A Rev. 3, along with a collection of commonly used secure moduli.
        controls:
        - id: ism-1759
          class: ISM-control
          title: "Control: ism-1759"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[2].group[03].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1759_smt
            name: statement
            prose: "When using DH for agreeing on encryption session keys, a modulus of at least 3072 bits is used, preferably 3072 bits."
        - id: ism-1629
          class: ISM-control
          title: "Control: ism-1629"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[2].group[03].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1629_smt
            name: statement
            prose: "When using DH for agreeing on encryption session keys, a modulus and associated parameters are selected according to NIST SP 800-56A Rev. 3."
      - title: Using the Digital Signature Algorithm
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[2].group[04]"
        parts:
        - name: overview
          prose: "A modulus of 2048 bits for correctly implemented DSA provides 112 bits of effective security strength. Taking into account projected technological advances, it is assessed that 112 bits of effective security strength will remain secure until 2030."
        controls:
        - id: ism-1760
          class: ISM-control
          title: "Control: ism-1760"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[2].group[04].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1760_smt
            name: statement
            prose: DSA is not used for digital signatures.
      - title: Using Elliptic Curve Cryptography
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[2].group[05]"
        parts:
        - name: overview
          prose: "The curve used within an elliptic curve algorithm impacts the security of the algorithm. As such, only suitable curves from FIPS 186-4 should be used."
        controls:
        - id: ism-1446
          class: ISM-control
          title: "Control: ism-1446"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[2].group[05].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1446_smt
            name: statement
            prose: "When using elliptic curve cryptography, a curve from FIPS 186-4 is used."
      - title: Using Elliptic Curve Diffie-Hellman
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[2].group[06]"
        parts:
        - name: overview
          prose: "When using a curve from FIPS 186-4, a base point order and key size of at least 224 bits for correctly implemented ECDH provides 112 bits of effective security strength. Security of a curve selected from another source cannot be assumed to have the same security using base point order and key size alone."
        controls:
        - id: ism-1762
          class: ISM-control
          title: "Control: ism-1762"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[2].group[06].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1762_smt
            name: statement
            prose: "When using ECDH for agreeing on encryption session keys, NIST P-384 or P-521 curves are used, preferably the NIST P-384 curve."
      - title: Using the Elliptic Curve Digital Signature Algorithm
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[2].group[07]"
        parts:
        - name: overview
          prose: "When using a curve from FIPS 186-4, a base point order and key size of 224 bits for correctly implemented ECDSA provides 112 bits of effective security strength. Security of a curve selected from another source cannot be assumed to have the same security using base point order and key size alone."
        controls:
        - id: ism-1764
          class: ISM-control
          title: "Control: ism-1764"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[2].group[07].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1764_smt
            name: statement
            prose: "When using ECDSA for digital signatures, NIST P-384 or P-521 curves are used, preferably the NIST P-384 curve."
      - title: Using Rivest-Shamir-Adleman
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[2].group[08]"
        parts:
        - name: overview
          prose: "A modulus of 2048 bits for correctly implemented RSA provides 112 bits of effective security strength. Taking into account projected technological advances, it is assessed that 112 bits of effective security strength will remain secure until 2030."
        controls:
        - id: ism-1765
          class: ISM-control
          title: "Control: ism-1765"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[2].group[08].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1765_smt
            name: statement
            prose: "When using RSA for digital signatures, and passing encryption session keys or similar keys, a modulus of at least 3072 bits is used, preferably 3072 bits."
        - id: ism-0477
          class: ISM-control
          title: "Control: ism-0477"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[2].group[08].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "8"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0477_smt
            name: statement
            prose: "When using RSA for digital signatures, and for passing encryption session keys or similar keys, a different key pair is used for digital signatures and passing encrypted session keys."
      - title: Using hashing algorithms
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[2].group[09]"
        parts:
        - name: overview
          prose: "For most purposes, a hashing algorithm with an output size of 224 bits provides 112 bits of effective security strength. Similarly, a hashing algorithm with an output size of 256 bits provides 128 bits of effective security strength, and an output size of 384 bits provides 192 bits of effective security strength. Only hashing algorithms from the SHA-2 family are approved for use."
        controls:
        - id: ism-1768
          class: ISM-control
          title: "Control: ism-1768"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[2].group[09].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1768_smt
            name: statement
            prose: "When using SHA-2 for hashing, an output size of at least 384 bits is used, preferably SHA-384."
      - title: Using symmetric encryption algorithms
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[2].group[10]"
        parts:
        - name: overview
          prose: "The use of Electronic Codebook Mode with block ciphers allows repeated patterns in plaintext to appear as repeated patterns in ciphertext. Most plaintext, including written language and formatted files, contains significant repeated patterns. As such, an adversary can use this to deduce possible meanings of ciphertext. The use of other modes, such as Cipher Block Chaining, Cipher Feedback, Galois/Counter Mode or Output Feedback, can prevent such attacks, although each has different properties which can make them inappropriate for certain use cases. AES is the only approved symmetric encryption algorithm."
        controls:
        - id: ism-1770
          class: ISM-control
          title: "Control: ism-1770"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[2].group[10].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1770_smt
            name: statement
            prose: "When using AES for encryption, AES-192 or AES-256 is used, preferably AES-256."
        - id: ism-0479
          class: ISM-control
          title: "Control: ism-0479"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[2].group[10].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0479_smt
            name: statement
            prose: Symmetric cryptographic algorithms are not used in Electronic Codebook Mode.
    - title: ASD-Approved Cryptographic Protocols
      props:
      - name: sort-id
        value: "catalog[1].group[22].group[3]"
      parts:
      - name: overview
        prose: |-
          # High assurance cryptographic protocols

          High assurance cryptographic protocols, which are not covered in this section, can be used for the protection of SECRET and TOP SECRET data if they are suitably implemented in ASD-approved HACE. Further information on high assurance cryptographic protocols can be obtained from the ACSC.

          # ASD-Approved Cryptographic Protocols

          There is no guarantee of a protocol’s resistance to currently unknown attacks. However, the protocols listed in this section have been extensively scrutinised by industry and academic communities in a practical and theoretical setting. Approval for the use of the protocols listed in this section is limited to cases where they are implemented in accordance with these guidelines.

          The AACPs are:

          * Transport Layer Security (TLS)
          * Secure Shell (SSH)
          * Secure/Multipurpose Internet Mail Extension (S/MIME)
          * OpenPGP Message Format
          * Internet Protocol Security (IPsec)
          * Wi-Fi Protected Access 2
          * Wi-Fi Protected Access 3.

          # Further information

          Further information on AACPs can be found in the following sections of these guidelines.

          Further information on the use of Wi-Fi Protected Access 2 and Wi-Fi Protected Access 3 can be found in the wireless networks section of the
          [Guidelines for Networking](#f145ff5b-d396-4248-8f48-621349d6f0ed).
      groups:
      - title: Using ASD-Approved Cryptographic Protocols
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[3].group[1]"
        parts:
        - name: overview
          prose: "If cryptographic equipment or software implements unapproved protocols, it is possible that these protocols could be used without a user’s knowledge. In combination with an assumed level of security confidence, this can represent a security risk. As such, an organisation can ensure that only AACPs or high assurance cryptographic protocols can be used by disabling unapproved protocols (preferred) or by advising users not to use unapproved protocols via usage policies."
        controls:
        - id: ism-0481
          class: ISM-control
          title: "Control: ism-0481"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[3].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0481_smt
            name: statement
            prose: Only AACPs or high assurance cryptographic protocols are used by cryptographic equipment and software.
    - title: Transport Layer Security
      props:
      - name: sort-id
        value: "catalog[1].group[22].group[4]"
      parts:
      - name: overview
        prose: |-
          # Using Transport Layer Security

          When using ICT equipment or software that implements TLS, controls for using AACAs and AACPs in the ASD-Approved Cryptographic Algorithms and ASD-Approved Cryptographic Protocols sections of these guidelines will also need to be consulted.

          # Further information

          Further information on implementing TLS can be found in in the ACSC’s
          [Implementing Certificates, TLS, HTTPS and Opportunistic TLS](#b8cdbf18-31cb-4e10-bb43-e8488ee8c2f6) publication.

          Further information on TLS filtering in gateways can be found in the web content filters section of the
          [Guidelines for Gateways](#e8bde527-526c-4a6a-b66f-05228f09dd7b).
      groups:
      - title: Configuring Transport Layer Security
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[4].group[1]"
        parts:
        - name: overview
          prose: "The terms Secure Sockets Layer and TLS have traditionally been used interchangeably. However, Secure Sockets Layer and earlier versions of TLS are no longer considered suitable for use as an AACP. As such, an organisation implementing TLS should implement TLS version 1.3. In addition, a number of security risks exist when TLS is configured in an insecure manner. To mitigate these security risks, TLS should be configured as per the configuration settings below."
        controls:
        - id: ism-1139
          class: ISM-control
          title: "Control: ism-1139"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[4].group[1].control[01]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1139_smt
            name: statement
            prose: Only the latest version of TLS is used for TLS connections.
        - id: ism-1369
          class: ISM-control
          title: "Control: ism-1369"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[4].group[1].control[02]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1369_smt
            name: statement
            prose: AES-GCM is used for encryption of TLS connections.
        - id: ism-1370
          class: ISM-control
          title: "Control: ism-1370"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[4].group[1].control[03]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1370_smt
            name: statement
            prose: Only server-initiated secure renegotiation is used for TLS connections.
        - id: ism-1372
          class: ISM-control
          title: "Control: ism-1372"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[4].group[1].control[04]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1372_smt
            name: statement
            prose: DH or ECDH is used for key establishment of TLS connections.
        - id: ism-1448
          class: ISM-control
          title: "Control: ism-1448"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[4].group[1].control[05]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1448_smt
            name: statement
            prose: "When using DH or ECDH for key establishment of TLS connections, the ephemeral variant is used."
        - id: ism-1373
          class: ISM-control
          title: "Control: ism-1373"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[4].group[1].control[06]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1373_smt
            name: statement
            prose: Anonymous DH is not used for TLS connections.
        - id: ism-1374
          class: ISM-control
          title: "Control: ism-1374"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[4].group[1].control[07]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1374_smt
            name: statement
            prose: SHA-2-based certificates are used for TLS connections.
        - id: ism-1375
          class: ISM-control
          title: "Control: ism-1375"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[4].group[1].control[08]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1375_smt
            name: statement
            prose: SHA-2 is used for the Hash-based Message Authentication Code (HMAC) and pseudorandom function (PRF) for TLS connections.
        - id: ism-1553
          class: ISM-control
          title: "Control: ism-1553"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[4].group[1].control[09]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1553_smt
            name: statement
            prose: TLS compression is disabled for TLS connections.
        - id: ism-1453
          class: ISM-control
          title: "Control: ism-1453"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[4].group[1].control[10]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1453_smt
            name: statement
            prose: Perfect Forward Secrecy (PFS) is used for TLS connections.
    - title: Secure Shell
      props:
      - name: sort-id
        value: "catalog[1].group[22].group[5]"
      parts:
      - name: overview
        prose: |-
          # Using Secure Shell

          When using ICT equipment or software that implements SSH, controls for using AACAs and AACPs in the ASD-Approved Cryptographic Algorithms and ASD-Approved Cryptographic Protocols sections of these guidelines will also need to be consulted.

          # Further information

          Further information on
          [configuring OpenSSH](#f832363c-d81e-4908-afd9-cf45047dd19c) is available from the OpenSSH project.
      groups:
      - title: Configuring Secure Shell
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[5].group[1]"
        parts:
        - name: overview
          prose: |-
            SSH version 1 was found to have a number of security vulnerabilities, and was subsequently replaced by SSH version 2. As such, an organisation implementing SSH should disable the use of SSH version 1. In addition, a number of security risks exist when SSH is configured in an insecure manner. To mitigate these security risks, SSH should be configured as per the configuration settings below.

            The configuration settings below are based on OpenSSH. An organisation using other implementations of SSH should adapt these settings to suit their SSH implementation.
        controls:
        - id: ism-1506
          class: ISM-control
          title: "Control: ism-1506"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[5].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1506_smt
            name: statement
            prose: The use of SSH version 1 is disabled for SSH connections.
        - id: ism-0484
          class: ISM-control
          title: "Control: ism-0484"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[5].group[1].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0484_smt
            name: statement
            prose: |-
              The SSH daemon is configured to:

              * only listen on the required interfaces (ListenAddress xxx.xxx.xxx.xxx)
              * have a suitable login banner (Banner x)
              * have a login authentication timeout of no more than 60 seconds (LoginGraceTime 60)
              * disable host-based authentication (HostbasedAuthentication no)
              * disable rhosts-based authentication (IgnoreRhosts yes)
              * disable the ability to login directly as root (PermitRootLogin no)
              * disable empty passwords (PermitEmptyPasswords no)
              * disable connection forwarding (AllowTCPForwarding no)
              * disable gateway ports (GatewayPorts no)
              * disable X11 forwarding (X11Forwarding no).
      - title: Authentication mechanisms
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[5].group[2]"
        parts:
        - name: overview
          prose: "As public key-based authentication schemes offer stronger authentication than passphrase-based authentication schemes, due to being much less susceptible to brute-force attacks, they should be used for SSH connections. Furthermore, in order to protect SSH private keys, access to such keys should be protected via the use of passphrases or key encryption keys."
        controls:
        - id: ism-0485
          class: ISM-control
          title: "Control: ism-0485"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[5].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0485_smt
            name: statement
            prose: Public key-based authentication is used for SSH connections.
        - id: ism-1449
          class: ISM-control
          title: "Control: ism-1449"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[5].group[2].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1449_smt
            name: statement
            prose: SSH private keys are protected with a passphrase or a key encryption key.
      - title: Automated remote access
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[5].group[3]"
        parts:
        - name: overview
          prose: |-
            If using logins without a passphrase for automated purposes, a number of security risks may arise, specifically:

            * if access from unknown Internet Protocol (IP) addresses is not restricted, an adversary could automatically authenticate to systems without needing to know any passphrases
            * if port forwarding is not disabled, or it is not configured securely, access may be gained to forwarded ports, thereby, creating a communication channel between an adversary and a host
            * if agent credential forwarding is enabled, an adversary could connect to the stored authentication credentials and use them to connect to other trusted hosts, or even intranet hosts if port forwarding has been allowed as well
            * if X11 display remoting is not disabled, an adversary could gain control of displays as well as keyboard and mouse control functions
            * if console access is allowed, every user who logs into the console could run programs that are normally restricted to authenticated users.

            To assist in mitigating these security risks, it is essential that the ‘forced command’ option is used to specify what command is executed and parameter checking is enabled.
        controls:
        - id: ism-0487
          class: ISM-control
          title: "Control: ism-0487"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[5].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0487_smt
            name: statement
            prose: |-
              When using logins without a passphrase for SSH connections, the following are disabled:

              * access from IP addresses that do not require access
              * port forwarding
              * agent credential forwarding
              * X11 display remoting
              * console access.
        - id: ism-0488
          class: ISM-control
          title: "Control: ism-0488"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[5].group[3].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0488_smt
            name: statement
            prose: "If using remote access without the use of a passphrase for SSH connections, the ‘forced command’ option is used to specify what command is executed and parameter checking is enabled."
      - title: SSH-agent
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[5].group[4]"
        parts:
        - name: overview
          prose: "SSH-agent and similar key caching programs manage private keys stored on workstations and servers. Specifically, when an SSH-agent launches, it requests a user’s passphrase to unlock the user’s private key. Subsequent access to remote systems is then performed by the SSH-agent and does not require the user to re-enter their passphrase. Screen locks and expiring key caches can be used to ensure that a user’s private key is not left unlocked for a long period of time."
        controls:
        - id: ism-0489
          class: ISM-control
          title: "Control: ism-0489"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[5].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0489_smt
            name: statement
            prose: "When SSH-agent or similar key caching programs are used, it is limited to workstations and servers with screen locks and key caches that are set to expire within four hours of inactivity."
    - title: Secure/Multipurpose Internet Mail Extension
      props:
      - name: sort-id
        value: "catalog[1].group[22].group[6]"
      parts:
      - name: overview
        prose: |-
          # Using Secure/Multipurpose Internet Mail Extension

          When using ICT equipment or software that implements S/MIME, controls for using AACAs and AACPs in the ASD-Approved Cryptographic Algorithms and ASD-Approved Cryptographic Protocols sections of these guidelines will also need to be consulted.
      groups:
      - title: Configuring Secure/Multipurpose Internet Mail Extension
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[6].group[1]"
        parts:
        - name: overview
          prose: "S/MIME version 2.0 required the use of weaker cryptography than approved for use in these guidelines. As such, S/MIME version 3.0 was the first version to be approved for use as an AACP."
        controls:
        - id: ism-0490
          class: ISM-control
          title: "Control: ism-0490"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[6].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0490_smt
            name: statement
            prose: Versions of S/MIME earlier than S/MIME version 3.0 are not used for S/MIME connections.
    - title: Internet Protocol Security
      props:
      - name: sort-id
        value: "catalog[1].group[22].group[7]"
      parts:
      - name: overview
        prose: |-
          # Using Internet Protocol Security

          When using ICT equipment or software that implements IPsec, controls for using AACAs and AACPs in the ASD-Approved Cryptographic Algorithms and ASD-Approved Cryptographic Protocols sections of these guidelines will also need to be consulted.
      groups:
      - title: Mode of operation
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[7].group[1]"
        parts:
        - name: overview
          prose: IPsec can be operated in tunnel mode or transport mode. The tunnel mode of operation is preferred as it provides full encapsulation of IP packets while the transport mode of operation only encapsulates the payload of IP packets.
        controls:
        - id: ism-0494
          class: ISM-control
          title: "Control: ism-0494"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[7].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0494_smt
            name: statement
            prose: "Tunnel mode is used for IPsec connections; however, if using transport mode, an IP tunnel is used."
      - title: Protocol selection
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[7].group[2]"
        parts:
        - name: overview
          prose: |-
            IPsec contains two major protocols, the Authentication Header (AH) protocol and the Encapsulating Security Payload (ESP) protocol. In order to provide a secure Virtual Private Network style connection, both authentication and encryption are needed. While the AH and ESP protocols can both provide authentication, for the IP packet and the payload respectively, only the ESP protocol can provide encryption.

            As the combined use of the AH protocol and the ESP protocol is not supported by Internet Key Exchange (IKE) version 2, the ESP protocol should be used for authentication and encryption of IPsec connections.
        controls:
        - id: ism-0496
          class: ISM-control
          title: "Control: ism-0496"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[7].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0496_smt
            name: statement
            prose: The ESP protocol is used for authentication and encryption of IPsec connections.
      - title: Key exchange
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[7].group[3]"
        parts:
        - name: overview
          prose: "There are several methods for establishing shared keying material for IPsec connections, including manual keying and the IKE protocol. As the IKE protocol addresses a number of security risks associated with manual keying, it is the preferred method for key establishment. Note, as IKE version 1 has been deprecated, IKE version 2 should be used."
        controls:
        - id: ism-1233
          class: ISM-control
          title: "Control: ism-1233"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[7].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1233_smt
            name: statement
            prose: IKE version 2 is used for key exchange when establishing IPsec connections.
      - title: Encryption algorithms
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[7].group[4]"
        parts:
        - name: overview
          prose: "The only approved encryption algorithm for IPsec connections is AES. IKE version 2 supports the use of AES with Cipher Block Chaining, Counter Mode, Counter with Cipher Block Chaining Message Authentication Code, and Galois/Counter Mode. Note, however, supported modes may vary between different cryptographic equipment and software."
        controls:
        - id: ism-1771
          class: ISM-control
          title: "Control: ism-1771"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[7].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1771_smt
            name: statement
            prose: "AES is used for encrypting IPsec connections, preferably ENCR_AES_GCM_16."
      - title: Pseudorandom function algorithms
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[7].group[5]"
        parts:
        - name: overview
          prose: "IKE version 2 requires the use of a PRF in order to generate random data for cryptographic operations. The approved algorithms that can be used for PRF are HMAC-SHA256, HMAC-SHA384 and HMAC-SHA512."
        controls:
        - id: ism-1772
          class: ISM-control
          title: "Control: ism-1772"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[7].group[5].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1772_smt
            name: statement
            prose: "PRF_HMAC_SHA2_256, PRF_HMAC_SHA2_384 or PRF_HMAC_SHA2_512 is used for IPsec connections, preferably PRF_HMAC_SHA2_512."
      - title: Integrity algorithms
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[7].group[6]"
        parts:
        - name: overview
          prose: "The approved integrity algorithms for IPsec connections are HMAC-SHA256, HMAC-SHA384 and HMAC-SHA512. However, if using AES with Galois/Counter Mode as the encryption algorithm, it can also be used for authentication purposes. In such cases, the integrity algorithm should be configured as NONE."
        controls:
        - id: ism-0998
          class: ISM-control
          title: "Control: ism-0998"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[7].group[6].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0998_smt
            name: statement
            prose: "AUTH_HMAC_SHA2_256_128, AUTH_HMAC_SHA2_384_192, AUTH_HMAC_SHA2_512_256 or NONE (only with AES-GCM) is used for authenticating IPsec connections, preferably NONE."
      - title: Diffie-Hellman groups
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[7].group[7]"
        parts:
        - name: overview
          prose: A sufficiently large DH modulus provides greater security for key exchanges when establishing IPsec connections.
        controls:
        - id: ism-0999
          class: ISM-control
          title: "Control: ism-0999"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[7].group[7].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0999_smt
            name: statement
            prose: "DH or ECDH is used for key establishment of IPsec connections, preferably 384-bit random ECP group, 3072-bit MODP Group or 4096-bit MODP Group."
      - title: Security association lifetimes
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[7].group[8]"
        parts:
        - name: overview
          prose: Using a security association lifetime of less than four hours (14400 seconds) can provide a balance between security and usability.
        controls:
        - id: ism-0498
          class: ISM-control
          title: "Control: ism-0498"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[7].group[8].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0498_smt
            name: statement
            prose: A security association lifetime of less than four hours (14400 seconds) is used for IPsec connections.
      - title: Perfect Forward Secrecy
        props:
        - name: sort-id
          value: "catalog[1].group[22].group[7].group[9]"
        parts:
        - name: overview
          prose: Using PFS reduces the impact of the compromise of a security association.
        controls:
        - id: ism-1000
          class: ISM-control
          title: "Control: ism-1000"
          props:
          - name: sort-id
            value: "catalog[1].group[22].group[7].group[9].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Sep-18
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1000_smt
            name: statement
            prose: PFS is used for IPsec connections.
  - title: Guidelines for Gateways
    props:
    - name: sort-id
      value: "catalog[1].group[23]"
    groups:
    - title: Gateways
      props:
      - name: sort-id
        value: "catalog[1].group[23].group[1]"
      parts:
      - name: overview
        prose: |-
          # Introduction to gateways

          Gateways securely manage data flows between connected networks from different security domains. In doing so, gateways take on the highest sensitivity or classification of connected security domains.

          This section describes controls applicable to all types of gateways. Additional sections of these guidelines should also be consulted depending on the types of gateways being deployed and the security domains involved. For example, the Cross Domain Solutions section should be consulted for gateways between different security domains where at least one security domain is classified SECRET or TOP SECRET.

          Personnel involved in the planning, design, implementation or assessment of gateways should also refer to the Australian Cyber Security Centre (ACSC)’s
          [gateway security guidance package](#3df21b72-0559-4bbf-a990-5ee509f70747) of publications.

          # Further information

          Further information on cyber supply chain risk management can be found in the cyber supply chain risk management section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).

          Further information on the procurement of outsourced services can be found in the managed services and cloud services section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).

          Further information on designing, configuring and managing networks can be found in the network design and configuration section of the
          [Guidelines for Networking](#f145ff5b-d396-4248-8f48-621349d6f0ed).

          Further information on privileged access to systems can be found in the access to systems and their resources section of the
          [Guidelines for Personnel Security](#7d16ae67-87a7-4861-b939-e13ec279b5a2).

          Further information on cyber security awareness training can be found in the cyber security awareness training section of the
          [Guidelines for Personnel Security](#7d16ae67-87a7-4861-b939-e13ec279b5a2).

          Further information on authenticating users can be found in the authentication hardening section of the
          [Guidelines for System Hardening](#de7525f3-a466-40a5-abdd-3ae24a6d1b44).

          Further information on authenticating ICT equipment can be found in the network design and configuration section of the
          [Guidelines for Networking](#f145ff5b-d396-4248-8f48-621349d6f0ed).

          Further information on
          [RPKI](#7da35efd-7196-4aba-bd79-30c19e8ef48b) and
          [ROA records](#355b47b5-6253-4be5-ba7c-274833d84b75) is available from the Asia Pacific Network Information Centre.

          Further information on event logging can be found in the event logging and monitoring section of the
          [Guidelines for System Monitoring](#edc24216-f52b-4513-bcda-5fa564661999).

          Further information on
          [the purpose of IRAP](#84d3cbab-ab84-4981-a4f7-2bd469c8deaf), and
          [a list of current IRAP assessors](#bdd11ace-cb4e-470a-92ad-556c79b6c14a), is available from the ACSC.
      groups:
      - title: Implementing gateways
        props:
        - name: sort-id
          value: "catalog[1].group[23].group[1].group[1]"
        parts:
        - name: overview
          prose: |-
            Gateways are critical for an organisation to reduce the security risks associated with providing external parties with access to their networks. In doing so, it is important that gateways are used not only between an organisation’s networks and public network infrastructure, but also between an organisation’s networks that belong to different security domains and between an organisation’s networks and other organisations’ networks that are connected via means other than public network infrastructure.

            When implementing gateways between an organisation’s networks and public network infrastructure, an organisation should place any services that external parties require access to within a demilitarised zone. This can mitigate security risks for an organisation when hosting such services in an internet-accessible manner.

            Finally, in architecting gateways, it is important that they only allow explicitly authorised data flows. In support of this, gateways should inspect and filter data flows at the transport and above network layers. Furthermore, gateways should be capable of performing ingress traffic filtering to detect and prevent Internet Protocol (IP) source address spoofing.
        controls:
        - id: ism-0628
          class: ISM-control
          title: "Control: ism-0628"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[1].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0628_smt
            name: statement
            prose: Gateways are implemented between networks belonging to different security domains.
        - id: ism-0637
          class: ISM-control
          title: "Control: ism-0637"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[1].group[1].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0637_smt
            name: statement
            prose: Gateways implement a demilitarised zone if external parties require access to an organisation’s services.
        - id: ism-0631
          class: ISM-control
          title: "Control: ism-0631"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[1].group[1].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0631_smt
            name: statement
            prose: Gateways only allow explicitly authorised data flows.
        - id: ism-1192
          class: ISM-control
          title: "Control: ism-1192"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[1].group[1].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1192_smt
            name: statement
            prose: Gateways inspect and filter data flows at the transport and above network layers.
        - id: ism-1427
          class: ISM-control
          title: "Control: ism-1427"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[1].group[1].control[5]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1427_smt
            name: statement
            prose: Gateways perform ingress traffic filtering to detect and prevent IP source address spoofing.
      - title: System administrators for gateways
        props:
        - name: sort-id
          value: "catalog[1].group[23].group[1].group[2]"
        parts:
        - name: overview
          prose: |-
            In identifying suitable system administrators for gateways, it is important that individuals comply with any citizenship requirements, undergo appropriate employment screening and, where necessary, hold an appropriate security clearance based on the sensitivity or classification of gateways. For example, all systems administrators for gateways between OFFICIAL and PROTECTED networks will need to hold baseline security clearances.

            In addition, when creating privileged accounts for performing administrative activities, it is important that the principle of least privilege is followed. In turn, this should be supported by the principle of separation of duties. Adhering to these two principles can ensure that system administrators for gateways are not given enough privileges to abuse gateways on their own.

            Finally, providing system administrators for gateways with formal training on the operation and management of gateways will ensure that they are fully aware of, and accept, their roles and responsibilities. In doing so, formal training should be conducted through tailored privileged user training.
        controls:
        - id: ism-1520
          class: ISM-control
          title: "Control: ism-1520"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[1].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1520_smt
            name: statement
            prose: "System administrators for gateways undergo appropriate employment screening and, where necessary, hold an appropriate security clearance based on the sensitivity or classification of gateways."
        - id: ism-0613
          class: ISM-control
          title: "Control: ism-0613"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[1].group[2].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0613_smt
            name: statement
            prose: System administrators for gateways that connect to Australian Eyes Only or Releasable To networks are Australian nationals.
        - id: ism-1773
          class: ISM-control
          title: "Control: ism-1773"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[1].group[2].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1773_smt
            name: statement
            prose: System administrators for gateways that connect to Australian Government Access Only networks are Australian nationals or seconded foreign nationals.
        - id: ism-0611
          class: ISM-control
          title: "Control: ism-0611"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[1].group[2].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0611_smt
            name: statement
            prose: System administrators for gateways are assigned the minimum privileges required to perform their duties.
        - id: ism-0616
          class: ISM-control
          title: "Control: ism-0616"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[1].group[2].control[5]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0616_smt
            name: statement
            prose: Separation of duties is implemented in performing administrative activities for gateways.
        - id: ism-0612
          class: ISM-control
          title: "Control: ism-0612"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[1].group[2].control[6]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0612_smt
            name: statement
            prose: System administrators for gateways are formally trained on the operation and management of gateways.
      - title: System administration of gateways
        props:
        - name: sort-id
          value: "catalog[1].group[23].group[1].group[3]"
        parts:
        - name: overview
          prose: "In performing administrative activities for gateways, it is important that they are conducted via a secure path isolated from all connected networks. In doing so, this will minimise threats should connected networks be compromised by an adversary. Furthermore, where gateways exist between networks belonging to different security domains, any shared components should be managed by system administrators for the higher security domain, alternatively, it may be more appropriate to use system administrators from a mutually-agreed third party."
        controls:
        - id: ism-1774
          class: ISM-control
          title: "Control: ism-1774"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[1].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1774_smt
            name: statement
            prose: Gateways are managed via a secure path isolated from all connected networks.
        - id: ism-0629
          class: ISM-control
          title: "Control: ism-0629"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[1].group[3].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0629_smt
            name: statement
            prose: "For gateways between networks belonging to different security domains, any shared components are managed by system administrators for the higher security domain or by system administrators from a mutually-agreed third party."
      - title: Authenticating to networks accessed via gateways
        props:
        - name: sort-id
          value: "catalog[1].group[23].group[1].group[4]"
        parts:
        - name: overview
          prose: Ensuring users and ICT equipment are authenticated to other networks accessed via gateways can reduce the likelihood of unauthorised access.
        controls:
        - id: ism-0619
          class: ISM-control
          title: "Control: ism-0619"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[1].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0619_smt
            name: statement
            prose: Users authenticate to other networks accessed via gateways.
        - id: ism-0622
          class: ISM-control
          title: "Control: ism-0622"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[1].group[4].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0622_smt
            name: statement
            prose: ICT equipment authenticates to other networks accessed via gateways.
      - title: Border Gateway Protocol route security
        props:
        - name: sort-id
          value: "catalog[1].group[23].group[1].group[5]"
        parts:
        - name: overview
          prose: "Resource Public Key Infrastructure (RPKI) uses public key cryptography to authenticate routing data on the internet. This allows an organisation, particularly a telecommunications carrier or cloud service provider, to verify routing data they receive, transmit and process in order to determine routing calculations for internet traffic. By using RPKI, an organisation may reduce Border Gateway Protocol-related cyber threats, such as some types of denial-of-service attacks, accidental or deliberate rerouting of internet traffic, and opportunities for the undermining of IP address-based reputational services. RPKI Route Origin Authorization (ROA) records, which describe routes in terms of network/prefix and Autonomous Systems from which they are expected to originate, should be configured for the public IP addresses controlled by, or used by, an organisation. ROA records should also be configured for the unannounced IP address space controlled by an organisation."
        controls:
        - id: ism-1783
          class: ISM-control
          title: "Control: ism-1783"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[1].group[5].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1783_smt
            name: statement
            prose: "Public IP addresses controlled by, or used by, an organisation are signed by valid ROA records."
      - title: Gateway event logging and alerting
        props:
        - name: sort-id
          value: "catalog[1].group[23].group[1].group[6]"
        parts:
        - name: overview
          prose: "Gateway event logs can assist in monitoring the security posture of gateways, detecting malicious behaviour and contributing to investigations following cyber security incidents. To facilitate such activities, gateway event logs should be captured and stored centrally."
        controls:
        - id: ism-0634
          class: ISM-control
          title: "Control: ism-0634"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[1].group[6].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "9"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0634_smt
            name: statement
            prose: |-
              The following events are logged for gateways:

              * data packets and data flows permitted through gateways
              * data packets and data flows attempting to leave gateways
              * real-time alerts for attempted intrusions.
        - id: ism-1775
          class: ISM-control
          title: "Control: ism-1775"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[1].group[6].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1775_smt
            name: statement
            prose: Gateway event logs are stored centrally.
      - title: Assessment of gateways
        props:
        - name: sort-id
          value: "catalog[1].group[23].group[1].group[7]"
        parts:
        - name: overview
          prose: "Testing of gateways following configuration changes, and at regular intervals no more than six months apart, assists with validating that gateways conform to expected security configurations. In addition, gateways will need to undergo regular security assessments by an Infosec Registered Assessor Program (IRAP) assessor to determine their security posture and security risks associated with their use. Following an initial security assessment by an IRAP assessor, subsequent security assessments should focus on any new services that are being offered as well as any security-related changes that have occurred since the previous security assessment."
        controls:
        - id: ism-1037
          class: ISM-control
          title: "Control: ism-1037"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[1].group[7].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1037_smt
            name: statement
            prose: "Gateways undergo testing following configuration changes, and at regular intervals no more than six months apart, to validate they conform to expected security configurations."
        - id: ism-0100
          class: ISM-control
          title: "Control: ism-0100"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[1].group[7].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "11"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Jun-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0100_smt
            name: statement
            prose: Gateways undergo a security assessment by an IRAP assessor at least every 24 months.
    - title: Cross Domain Solutions
      props:
      - name: sort-id
        value: "catalog[1].group[23].group[2]"
      parts:
      - name: overview
        prose: |-
          # Introduction to Cross Domain Solutions

          A Cross Domain Solution (CDS) is a system comprised of security-enforcing functions tailored to mitigate specific security risks associated with accessing or transferring data between different security domains. CDSs may be an integrated appliance or, more commonly, be composed of discrete technologies or sub-systems, with each sub-system consisting of hardware or software components.

          This section describes the controls applicable to CDSs and extends upon the prior gateways section. Additional sections of these guidelines should also be consulted depending on the types of CDSs being deployed.

          Personnel involved in the planning, design, implementation or assessment of CDSs should also refer to the ACSC’s
          [Introduction to Cross Domain Solutions](#86847be4-3a06-4d2f-9952-447158593e0d) and
          [Fundamentals of Cross Domain Solutions](#f32020e9-4cb3-486b-bcbb-6fb6719f58a5) publications.

          # Types of Cross Domain Solutions

          This section defines two types of CDSs, Transfer CDSs and Access CDSs. These definitions are closely aligned with how CDSs are described and sold by vendors. Note, however, vendors may also offer combined Access and Transfer CDSs.

          In defining the functionality of different types of CDSs, Transfer CDSs facilitate the transfer of data in one direction (unidirectional) or multiple directions (bi-directional) between different security domains. In comparison, Access CDSs provide users with access to multiple security domains from a single device. However, while Access CDSs allow interaction with different security domains, they do not allow users to move data between the different security domains.

          # Further information

          Further information on cyber supply chain risk management can be found in the cyber supply chain risk management section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).

          Further information on evaluated products can be found in the evaluated product procurement section of the
          [Guidelines for Evaluated Products](#a699a3aa-828d-479b-b50b-98127bb19437).

          Further information on designing, configuring and managing networks can be found in the network design and configuration section of the
          [Guidelines for Networking](#f145ff5b-d396-4248-8f48-621349d6f0ed).

          Further information on event logging can be found in the event logging and monitoring section of the
          [Guidelines for System Monitoring](#edc24216-f52b-4513-bcda-5fa564661999).

          Further information on cyber security awareness training can be found in the cyber security awareness training section of the
          [Guidelines for Personnel Security](#7d16ae67-87a7-4861-b939-e13ec279b5a2).
      groups:
      - title: Implementing Cross Domain Solutions
        props:
        - name: sort-id
          value: "catalog[1].group[23].group[2].group[1]"
        parts:
        - name: overview
          prose: "As there are significant security risks associated with connecting SECRET or TOP SECRET networks to other networks in different security domains, CDSs will need to be implemented."
        controls:
        - id: ism-0626
          class: ISM-control
          title: "Control: ism-0626"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[2].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0626_smt
            name: statement
            prose: CDSs are implemented between SECRET or TOP SECRET networks and any other networks belonging to different security domains.
      - title: Consultation on Cross Domain Solutions
        props:
        - name: sort-id
          value: "catalog[1].group[23].group[2].group[2]"
        parts:
        - name: overview
          prose: "As CDSs can be complex to implement and manage securely, it is critical that when an organisation is planning, designing, implementing or introducing additional connectivity to CDSs that the ACSC is consulted and any directions provided by the ACSC are complied with."
        controls:
        - id: ism-0597
          class: ISM-control
          title: "Control: ism-0597"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[2].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0597_smt
            name: statement
            prose: "When planning, designing, implementing or introducing additional connectivity to CDSs, the ACSC is consulted and any directions provided by the ACSC are complied with."
      - title: Separation of data flows
        props:
        - name: sort-id
          value: "catalog[1].group[23].group[2].group[3]"
        parts:
        - name: overview
          prose: "To ensure that data flows are appropriately controlled within CDSs, it is important that isolated upward and downward network paths are implemented. This, in turn, should be supported by independent security-enforcing functions and protocol breaks at each network layer."
        controls:
        - id: ism-0635
          class: ISM-control
          title: "Control: ism-0635"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[2].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0635_smt
            name: statement
            prose: CDSs implement isolated upward and downward network paths.
        - id: ism-1522
          class: ISM-control
          title: "Control: ism-1522"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[2].group[3].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1522_smt
            name: statement
            prose: CDSs implement independent security-enforcing functions for upward and downward network paths.
        - id: ism-1521
          class: ISM-control
          title: "Control: ism-1521"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[2].group[3].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1521_smt
            name: statement
            prose: CDSs implement protocol breaks at each network layer.
      - title: Cross Domain Solution event logging
        props:
        - name: sort-id
          value: "catalog[1].group[23].group[2].group[4]"
        parts:
        - name: overview
          prose: |-
            CDSs should have comprehensive event logging capabilities to ensure accountability of users for all activities they undertake. Furthermore, effective event logging and monitoring practices can increase the likelihood that operational failures will be detected.

            In addition, CDS event logs can assist in monitoring the security posture of CDSs, detecting malicious behaviour and contributing to investigations following cyber security incidents. To facilitate such activities, CDS event logs should be captured and stored centrally.
        controls:
        - id: ism-0670
          class: ISM-control
          title: "Control: ism-0670"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[2].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0670_smt
            name: statement
            prose: All security-relevant events generated by CDSs are logged.
        - id: ism-1776
          class: ISM-control
          title: "Control: ism-1776"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[2].group[4].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1776_smt
            name: statement
            prose: CDS event logs are stored centrally.
        - id: ism-1523
          class: ISM-control
          title: "Control: ism-1523"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[2].group[4].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1523_smt
            name: statement
            prose: A sample of security-relevant events relating to data transfer policies are taken at least every three months and assessed against security policies for CDSs to identify any operational failures.
      - title: User training
        props:
        - name: sort-id
          value: "catalog[1].group[23].group[2].group[5]"
        parts:
        - name: overview
          prose: "To assist in preventing cyber security incidents, it is important that users know how to use CDSs securely. This can be achieved by training users on the secure use of CDSs before access is granted."
        controls:
        - id: ism-0610
          class: ISM-control
          title: "Control: ism-0610"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[2].group[5].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "8"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0610_smt
            name: statement
            prose: Users are trained on the secure use of CDSs before access is granted.
    - title: Firewalls
      props:
      - name: sort-id
        value: "catalog[1].group[23].group[3]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on cyber supply chain risk management can be found in the cyber supply chain risk management section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).

          Further information on evaluated products can be found in the evaluated product procurement section of the
          [Guidelines for Evaluated Products](#a699a3aa-828d-479b-b50b-98127bb19437).
      groups:
      - title: Using firewalls
        props:
        - name: sort-id
          value: "catalog[1].group[23].group[3].group[1]"
        parts:
        - name: overview
          prose: "When implementing gateways between an organisation’s networks and public network infrastructure, an organisation should implement firewalls to protect themselves from intrusions that may originate from the public network infrastructure. In addition, when an organisation’s networks connect to another organisation’s networks, both organisations should implement independent firewalls to protect themselves from intrusions that may originate from each other’s networks. Note, this requirement may not be necessary in cases where shared network infrastructure is used only as a transport medium and encryption is applied to all network traffic."
        controls:
        - id: ism-1528
          class: ISM-control
          title: "Control: ism-1528"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[3].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1528_smt
            name: statement
            prose: Evaluated firewalls are used between an organisation’s networks and public network infrastructure.
        - id: ism-0639
          class: ISM-control
          title: "Control: ism-0639"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[3].group[1].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "9"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0639_smt
            name: statement
            prose: Evaluated firewalls are used between networks belonging to different security domains.
    - title: Diodes
      props:
      - name: sort-id
        value: "catalog[1].group[23].group[4]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on cyber supply chain risk management can be found in the cyber supply chain risk management section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).

          Further information on evaluated products can be found in the evaluated product procurement section of the
          [Guidelines for Evaluated Products](#a699a3aa-828d-479b-b50b-98127bb19437).
      groups:
      - title: Using diodes
        props:
        - name: sort-id
          value: "catalog[1].group[23].group[4].group[1]"
        parts:
        - name: overview
          prose: "Diodes enforce one-way data flows, thereby, making it more difficult for an adversary to use the same network path to both launch an intrusion and exfiltrate data afterwards. As such, diodes should be used for controlling the data flow of unidirectional gateways."
        controls:
        - id: ism-0643
          class: ISM-control
          title: "Control: ism-0643"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[4].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0643_smt
            name: statement
            prose: Evaluated diodes are used for controlling the data flow of unidirectional gateways between an organisation’s networks and public network infrastructure.
        - id: ism-0645
          class: ISM-control
          title: "Control: ism-0645"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[4].group[1].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0645_smt
            name: statement
            prose: Evaluated diodes used for controlling the data flow of unidirectional gateways between SECRET or TOP SECRET networks and public network infrastructure complete a high assurance evaluation.
        - id: ism-1157
          class: ISM-control
          title: "Control: ism-1157"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[4].group[1].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1157_smt
            name: statement
            prose: Evaluated diodes are used for controlling the data flow of unidirectional gateways between networks.
        - id: ism-1158
          class: ISM-control
          title: "Control: ism-1158"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[4].group[1].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1158_smt
            name: statement
            prose: Evaluated diodes used for controlling the data flow of unidirectional gateways between SECRET or TOP SECRET networks and any other networks complete a high assurance evaluation.
    - title: Web proxies
      props:
      - name: sort-id
        value: "catalog[1].group[23].group[5]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on cyber supply chain risk management can be found in the cyber supply chain risk management section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).

          Further information on event logging can be found in the event logging and monitoring section of the
          [Guidelines for System Monitoring](#edc24216-f52b-4513-bcda-5fa564661999).
      groups:
      - title: Web usage policy
        props:
        - name: sort-id
          value: "catalog[1].group[23].group[5].group[1]"
        parts:
        - name: overview
          prose: "As there are many security risks associated with the use of web services, it is important that an organisation develops, implements and maintains a web usage policy governing its use."
        controls:
        - id: ism-0258
          class: ISM-control
          title: "Control: ism-0258"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[5].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0258_smt
            name: statement
            prose: "A web usage policy is developed, implemented and maintained."
      - title: Using web proxies
        props:
        - name: sort-id
          value: "catalog[1].group[23].group[5].group[2]"
        parts:
        - name: overview
          prose: Web proxies are a key component in enforcing web usage policies and preventing cyber security incidents.
        controls:
        - id: ism-0260
          class: ISM-control
          title: "Control: ism-0260"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[5].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0260_smt
            name: statement
            prose: "All web access, including that by internal servers, is conducted through web proxies."
      - title: Web proxy event logging
        props:
        - name: sort-id
          value: "catalog[1].group[23].group[5].group[3]"
        parts:
        - name: overview
          prose: "Web proxy event logs can assist in monitoring the security posture of networks, detecting malicious behaviour and contributing to investigations following cyber security incidents. To facilitate such activities, web proxy event logs should be captured and stored centrally."
        controls:
        - id: ism-0261
          class: ISM-control
          title: "Control: ism-0261"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[5].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0261_smt
            name: statement
            prose: |-
              The following details are logged for websites accessed via web proxies:

              * address
              * date and time
              * user
              * amount of data uploaded and downloaded
              * internal and external IP addresses.
        - id: ism-1777
          class: ISM-control
          title: "Control: ism-1777"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[5].group[3].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "1"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1777_smt
            name: statement
            prose: Web proxy event logs are stored centrally.
    - title: Web content filters
      props:
      - name: sort-id
        value: "catalog[1].group[23].group[6]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on cyber supply chain risk management can be found in the cyber supply chain risk management section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).

          Further information on content filtering techniques can be found in the content filtering section of these guidelines.

          Further information and
          [examples of client-side JavaScript controls](#6b4353e0-7281-49f4-a520-f35a4cceec71) are available from the NoScript project.
      groups:
      - title: Using web content filters
        props:
        - name: sort-id
          value: "catalog[1].group[23].group[6].group[1]"
        parts:
        - name: overview
          prose: "Effective web content filters can greatly reduce the likelihood of malicious code, or other inappropriate content, being accessed by users. Furthermore, web content filters can disrupt or prevent an adversary from communicating with their malicious code if they manage to deploy it on an organisation’s networks."
        controls:
        - id: ism-0963
          class: ISM-control
          title: "Control: ism-0963"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[6].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0963_smt
            name: statement
            prose: Web content filtering is implemented to filter potentially harmful web-based content.
        - id: ism-0961
          class: ISM-control
          title: "Control: ism-0961"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[6].group[1].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "8"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0961_smt
            name: statement
            prose: Client-side active content is restricted by web content filters to an organisation-approved list of domain names.
        - id: ism-1237
          class: ISM-control
          title: "Control: ism-1237"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[6].group[1].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1237_smt
            name: statement
            prose: Web content filtering is applied to outbound web traffic where appropriate.
      - title: Transport Layer Security filtering
        props:
        - name: sort-id
          value: "catalog[1].group[23].group[6].group[2]"
        parts:
        - name: overview
          prose: "As encrypted Hypertext Transfer Protocol Secure connections can bypass traditional web content filtering techniques, an organisation should implement Transport Layer Security (TLS) inspection. Note, an organisation may choose to allow some web traffic, such as that for internet banking, to go uninspected to protect the privacy of users."
        controls:
        - id: ism-0263
          class: ISM-control
          title: "Control: ism-0263"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[6].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "8"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0263_smt
            name: statement
            prose: TLS traffic communicated through gateways is decrypted and inspected.
      - title: Allowing and blocking access to domain names
        props:
        - name: sort-id
          value: "catalog[1].group[23].group[6].group[3]"
        parts:
        - name: overview
          prose: |-
            Defining an organisation-approved list of domain names, and blocking all others, removes one of the most common data exfiltration paths used by an adversary. In doing so, even a relatively permissive list of allowed domain names, such as the entire Australian top-level domain (‘\*.au’) or the top 1,000 websites from the Alexa website ranking, offers better security than relying solely on a list of malicious domain names.

            Furthermore, in cases where an organisation chooses to implement a relatively permissive list of allowed domain names, or list of website categories, security risks can be further mitigated by blocking dynamic domain names, or domain names that can be registered anonymously for free, as these are often used by an adversary due to their lack of attribution. Finally, as users rarely have a requirement to access websites via their IP addresses instead of their domain names, the presence of such activities could indicate malicious code attempting to communicate with an adversary’s command and control infrastructure and should be blocked.
        controls:
        - id: ism-0958
          class: ISM-control
          title: "Control: ism-0958"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[6].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "8"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0958_smt
            name: statement
            prose: "An organisation-approved list of domain names, or list of website categories, is implemented for all Hypertext Transfer Protocol and Hypertext Transfer Protocol Secure traffic communicated through gateways."
        - id: ism-1236
          class: ISM-control
          title: "Control: ism-1236"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[6].group[3].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1236_smt
            name: statement
            prose: "Malicious domain names, dynamic domain names and domain names that can be registered anonymously for free are blocked by web content filters."
        - id: ism-1171
          class: ISM-control
          title: "Control: ism-1171"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[6].group[3].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1171_smt
            name: statement
            prose: Attempts to access websites through their IP addresses instead of their domain names are blocked by web content filters.
    - title: Content filtering
      props:
      - name: sort-id
        value: "catalog[1].group[23].group[7]"
      parts:
      - name: overview
        prose: |-
          # Content filtering techniques

          The following content filtering techniques should be considered as part of an organisation’s content filtering implementation for gateways and CDSs:

          * Antivirus scans: Scans files for viruses and other malicious code.
          * Automated dynamic analysis: Analyses executable files run in a sandbox to detect suspicious behaviour.
          * File extension checks: Checks file extensions to determine purported file types.
          * File format checks: Checks files conform to defined file format specifications.
          * File type checks: Checks file headers to determine actual file types.
          * Keyword checks: Checks files for keywords that could indicate undesirable content.
          * Metadata checks: Checks files for metadata that should be removed.
          * Protective marking checks: Checks files for protective markings that may indicate undesirable content.
          * Manual inspections: Involves the manual inspection of files for suspicious or undesirable content that an automated system may miss, which is particularly important for multimedia and content rich files.

          # Further information

          Further information on cyber supply chain risk management can be found in the cyber supply chain risk management section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).

          Further information on performing data transfers can be found in the data transfers section of the
          [Guidelines for Data Transfers](#1eefdaf7-3991-4ba2-9439-79565f508c44).
      groups:
      - title: Performing content filtering
        props:
        - name: sort-id
          value: "catalog[1].group[23].group[7].group[01]"
        parts:
        - name: overview
          prose: "Content filters perform an important function within gateways and CDSs by reducing the likelihood of unauthorised content or malicious code from entering or exiting networks. In performing content filtering checks, some content will be readily identifiable as malicious, or cannot be inspected, while other content, such as active content, may be deemed suspicious depending on what is considered normal behaviour for content passing through gateways and CDSs within an organisation. Finally, when content filters are used by CDSs, their assurance requirements necessitate rigorous security testing to ensure they perform as expected and cannot be bypassed."
        controls:
        - id: ism-0659
          class: ISM-control
          title: "Control: ism-0659"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[7].group[01].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0659_smt
            name: statement
            prose: Files imported or exported via gateways or CDSs undergo content filtering checks.
        - id: ism-0651
          class: ISM-control
          title: "Control: ism-0651"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[7].group[01].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0651_smt
            name: statement
            prose: "Files identified by content filtering checks as malicious, or that cannot be inspected, are blocked."
        - id: ism-0652
          class: ISM-control
          title: "Control: ism-0652"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[7].group[01].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0652_smt
            name: statement
            prose: Files identified by content filtering checks as suspicious are quarantined until reviewed and subsequently approved or not approved for release.
        - id: ism-1524
          class: ISM-control
          title: "Control: ism-1524"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[7].group[01].control[4]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1524_smt
            name: statement
            prose: Content filters used by CDSs undergo rigorous security testing to ensure they perform as expected and cannot be bypassed.
      - title: Encrypted files
        props:
        - name: sort-id
          value: "catalog[1].group[23].group[7].group[02]"
        parts:
        - name: overview
          prose: |-
            As encryption can be used to bypass content filtering checks, this poses a security risk in that malicious code could enter networks, or data could be exfiltrated from networks, undetected. In addition, encrypted files could mask data at a higher classification than that authorised to pass through gateways or CDSs, which could result in a data spill. As such, encrypted files should be decrypted in order to undergo content filtering checks.

            Note, where a requirement to preserve the confidentiality of encrypted files exists, an organisation may consider a dedicated system to allow encrypted files to be decrypted in an appropriately secure environment before being subjected to all applicable content filtering checks.
        controls:
        - id: ism-1293
          class: ISM-control
          title: "Control: ism-1293"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[7].group[02].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1293_smt
            name: statement
            prose: Encrypted files imported or exported via gateways or CDSs are decrypted in order to undergo content filtering checks.
      - title: Archive files
        props:
        - name: sort-id
          value: "catalog[1].group[23].group[7].group[03]"
        parts:
        - name: overview
          prose: |-
            Archive files can be used to bypass content filtering checks if content filters do not handle such files correctly. Ensuring content filters recognise archive files will ensure the embedded files they contain are subject to the same content filtering checks as un-archived files.

            Archive files can be constructed in a manner which can result in a denial of service to content filters due to processor, memory or disk space exhaustion. To limit the likelihood of such situations, content filters can specify resource constraints while unpacking archive files. If these constraints are exceeded, content filtering checks should be terminated.
        controls:
        - id: ism-1289
          class: ISM-control
          title: "Control: ism-1289"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[7].group[03].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1289_smt
            name: statement
            prose: Archive files imported or exported via gateways or CDSs are unpacked in order to undergo content filtering checks.
        - id: ism-1290
          class: ISM-control
          title: "Control: ism-1290"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[7].group[03].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1290_smt
            name: statement
            prose: Archive files are unpacked in a controlled manner to ensure content filter performance or availability is not adversely affected.
      - title: Antivirus scanning
        props:
        - name: sort-id
          value: "catalog[1].group[23].group[7].group[04]"
        parts:
        - name: overview
          prose: "Antivirus scanning can be used to detect malicious files. In doing so, multiple different scanning engines should be used to increase the likelihood of identifying any malicious files."
        controls:
        - id: ism-1288
          class: ISM-control
          title: "Control: ism-1288"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[7].group[04].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1288_smt
            name: statement
            prose: Files imported or exported via gateways or CDSs undergo antivirus scanning using multiple different scanning engines.
      - title: Automated dynamic analysis
        props:
        - name: sort-id
          value: "catalog[1].group[23].group[7].group[05]"
        parts:
        - name: overview
          prose: "Analysing executable files in a sandbox can be an effective method to detect suspicious behaviour upon file execution, such as network traffic, creation or modification of files, or system configuration changes."
        controls:
        - id: ism-1389
          class: ISM-control
          title: "Control: ism-1389"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[7].group[05].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1389_smt
            name: statement
            prose: Executable files imported via gateways or CDSs are automatically executed in a sandbox to detect any suspicious behaviour.
      - title: Allowing specific content types
        props:
        - name: sort-id
          value: "catalog[1].group[23].group[7].group[06]"
        parts:
        - name: overview
          prose: "Creating and enforcing an organisation-approved list of allowed file types, can reduce the attack surface of networks. For example, a content filter in an email gateway might only allow Microsoft Office files and Portable Document Format (PDF) files."
        controls:
        - id: ism-0649
          class: ISM-control
          title: "Control: ism-0649"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[7].group[06].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "8"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0649_smt
            name: statement
            prose: Files imported or exported via gateways or CDSs are filtered for allowed file types.
      - title: Content validation
        props:
        - name: sort-id
          value: "catalog[1].group[23].group[7].group[07]"
        parts:
        - name: overview
          prose: "Content validation, such as file format checks, aims to ensure that files conform to defined file format specifications. In performing content validation, any malformed content may indicate the presence of unauthorised content or malicious code, such as that designed to exploit known security vulnerabilities in operating systems or applications."
        controls:
        - id: ism-1284
          class: ISM-control
          title: "Control: ism-1284"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[7].group[07].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1284_smt
            name: statement
            prose: Files imported or exported via gateways or CDSs undergo content validation.
      - title: Content conversion
        props:
        - name: sort-id
          value: "catalog[1].group[23].group[7].group[08]"
        parts:
        - name: overview
          prose: |-
            Content conversion can be an effective method to render malicious code harmless by converting one file type to another file type. Note, however, some file types will not benefit from content conversion. Examples of content conversion include:

            * converting Microsoft Word documents to PDF files
            * converting Microsoft PowerPoint presentations to image files
            * converting Microsoft Excel spreadsheets to comma-separated values files
            * converting PDF documents to plain text files.
        controls:
        - id: ism-1286
          class: ISM-control
          title: "Control: ism-1286"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[7].group[08].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1286_smt
            name: statement
            prose: Files imported or exported via gateways or CDSs undergo content conversion.
      - title: Content sanitisation
        props:
        - name: sort-id
          value: "catalog[1].group[23].group[7].group[09]"
        parts:
        - name: overview
          prose: "Content sanitisation is the process of rendering files safe by removing or altering active content while leaving the original content as intact as possible, such as by removing macros from Microsoft Office files or removing JavaScript sections from PDF files."
        controls:
        - id: ism-1287
          class: ISM-control
          title: "Control: ism-1287"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[7].group[09].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1287_smt
            name: statement
            prose: Files imported or exported via gateways or CDSs undergo content sanitisation.
      - title: Validating file integrity
        props:
        - name: sort-id
          value: "catalog[1].group[23].group[7].group[10]"
        parts:
        - name: overview
          prose: "If files passing through gateways or CDSs contain a form of integrity protection, such as a digital signature or cryptographic checksum, content filters should verify their integrity. In doing so, the failure of any integrity checks may indicate that files have been tampered with."
        controls:
        - id: ism-0677
          class: ISM-control
          title: "Control: ism-0677"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[7].group[10].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-23
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0677_smt
            name: statement
            prose: Files imported or exported via gateways or CDSs that have a digital signature or cryptographic checksum are validated.
    - title: Peripheral switches
      props:
      - name: sort-id
        value: "catalog[1].group[23].group[8]"
      parts:
      - name: overview
        prose: |-
          # Further information

          Further information on cyber supply chain risk management can be found in the cyber supply chain risk management section of the
          [Guidelines for Procurement and Outsourcing](#f37a4848-0791-4870-b316-5536c2681c28).

          Further information on evaluated products can be found in the evaluated product procurement section of the
          [Guidelines for Evaluated Products](#a699a3aa-828d-479b-b50b-98127bb19437).
      groups:
      - title: Using peripheral switches
        props:
        - name: sort-id
          value: "catalog[1].group[23].group[8].group[1]"
        parts:
        - name: overview
          prose: "When accessing different systems through peripheral switches, it is important that sufficient assurance is obtained in their operation to ensure that data does not pass between connected systems. As such, the level of assurance needed in peripheral switches is determined by the difference in sensitivity or classification of systems they are connected to. Note, there is no requirement for evaluated peripheral switches to be used when all connected systems belong to the same security domain."
        controls:
        - id: ism-0591
          class: ISM-control
          title: "Control: ism-0591"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[8].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "8"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0591_smt
            name: statement
            prose: Evaluated peripheral switches are used when sharing peripherals between systems.
        - id: ism-1457
          class: ISM-control
          title: "Control: ism-1457"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[8].group[1].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "4"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1457_smt
            name: statement
            prose: "Evaluated peripheral switches used for sharing peripherals between SECRET and TOP SECRET systems, or between SECRET or TOP SECRET systems belonging to different security domains, preferably complete a high assurance evaluation."
        - id: ism-1480
          class: ISM-control
          title: "Control: ism-1480"
          props:
          - name: sort-id
            value: "catalog[1].group[23].group[8].group[1].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "2"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1480_smt
            name: statement
            prose: Evaluated peripheral switches used for sharing peripherals between SECRET or TOP SECRET systems and any non-SECRET or TOP SECRET systems complete a high assurance evaluation.
  - title: Guidelines for Data Transfers
    props:
    - name: sort-id
      value: "catalog[1].group[24]"
    groups:
    - title: Data transfers
      props:
      - name: sort-id
        value: "catalog[1].group[24].group[1]"
      parts:
      - name: overview
        prose: |-
          # Performing data transfers

          This section describes controls applicable to both manual data transfers and data transfers using gateways or Cross Domain Solutions (CDSs). For data transfers using gateways or CDSs, the content filtering section of the
          [Guidelines for Gateways](#e8bde527-526c-4a6a-b66f-05228f09dd7b) is also applicable.

          # Further information

          Further information on manual data transfers using removable media can be found in the media usage section of the
          [Guidelines for Media](#b594c9c0-b42f-4f06-b643-38023275a5c7).

          Further information on data transfers using gateways or CDSs can be found in the content filtering section of the
          [Guidelines for Gateways](#e8bde527-526c-4a6a-b66f-05228f09dd7b).
      groups:
      - title: Data transfer processes and procedures
        props:
        - name: sort-id
          value: "catalog[1].group[24].group[1].group[1]"
        parts:
        - name: overview
          prose: "Ensuring that data transfer processes and procedures are developed, implemented and maintained can facilitate consistent data transfers. In addition, in order to reduce the likelihood of Australian Eyes Only (AUSTEO), Australian Government Access Only (AGAO) and Releasable To (REL) data crossing into unsuitable foreign systems, it is important that additional processes and procedures are developed, implemented and maintained to prevent this from occurring. Note, depending on protective markings applied to REL data, it may be suitable for export to some foreign systems but not to others."
        controls:
        - id: ism-0663
          class: ISM-control
          title: "Control: ism-0663"
          props:
          - name: sort-id
            value: "catalog[1].group[24].group[1].group[1].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0663_smt
            name: statement
            prose: "Data transfer processes, and supporting data transfer procedures, are developed, implemented and maintained."
        - id: ism-1535
          class: ISM-control
          title: "Control: ism-1535"
          props:
          - name: sort-id
            value: "catalog[1].group[24].group[1].group[1].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-1535_smt
            name: statement
            prose: "Processes, and supporting procedures, are developed, implemented and maintained to prevent AUSTEO, AGAO and REL data in both textual and non-textual formats from being exported to unsuitable foreign systems."
      - title: User responsibilities
        props:
        - name: sort-id
          value: "catalog[1].group[24].group[1].group[2]"
        parts:
        - name: overview
          prose: "When users transfer data to or from systems, they should understand the potential consequences of their actions. This could include transferring data onto systems not authorised to handle the data, or the unintended introduction of malicious code to systems. As such, users should be held accountable for all data transfers that they perform."
        controls:
        - id: ism-0661
          class: ISM-control
          title: "Control: ism-0661"
          props:
          - name: sort-id
            value: "catalog[1].group[24].group[1].group[2].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "8"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0661_smt
            name: statement
            prose: Users transferring data to and from systems are held accountable for data transfers they perform.
      - title: Manual import of data
        props:
        - name: sort-id
          value: "catalog[1].group[24].group[1].group[3]"
        parts:
        - name: overview
          prose: "When manually importing data to systems, such as via the use of removable media, the data should be scanned for malicious and active content to reduce the likelihood of causing a malicious code infection. In cases where security checks fail, data should be quarantined until it can be reviewed and subsequently approved or not approved for release."
        controls:
        - id: ism-0657
          class: ISM-control
          title: "Control: ism-0657"
          props:
          - name: sort-id
            value: "catalog[1].group[24].group[1].group[3].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-0657_smt
            name: statement
            prose: "When manually importing data to systems, the data is scanned for malicious and active content."
        - id: ism-1778
          class: ISM-control
          title: "Control: ism-1778"
          props:
          - name: sort-id
            value: "catalog[1].group[24].group[1].group[3].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1778_smt
            name: statement
            prose: "When manually importing data to systems, all data that fails security checks is quarantined until reviewed and subsequently approved or not approved for release."
      - title: Authorising export of data
        props:
        - name: sort-id
          value: "catalog[1].group[24].group[1].group[4]"
        parts:
        - name: overview
          prose: "Data exported from SECRET and TOP SECRET systems should be reviewed and authorised by a trusted source beforehand, such as an organisation’s Chief Information Security Officer or one of their delegates. In doing so, all data authorised for export should be digitally signed by the trusted source."
        controls:
        - id: ism-0664
          class: ISM-control
          title: "Control: ism-0664"
          props:
          - name: sort-id
            value: "catalog[1].group[24].group[1].group[4].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "7"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0664_smt
            name: statement
            prose: Data exported from SECRET and TOP SECRET systems is reviewed and authorised by a trusted source beforehand.
        - id: ism-0675
          class: ISM-control
          title: "Control: ism-0675"
          props:
          - name: sort-id
            value: "catalog[1].group[24].group[1].group[4].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0675_smt
            name: statement
            prose: Data authorised for export from SECRET and TOP SECRET systems is digitally signed by a trusted source.
        - id: ism-0665
          class: ISM-control
          title: "Control: ism-0665"
          props:
          - name: sort-id
            value: "catalog[1].group[24].group[1].group[4].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-21
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0665_smt
            name: statement
            prose: Trusted sources for SECRET and TOP SECRET systems are limited to people and services that have been authorised as such by an organisation’s Chief Information Security Officer.
      - title: Manual export of data
        props:
        - name: sort-id
          value: "catalog[1].group[24].group[1].group[5]"
        parts:
        - name: overview
          prose: "When manually exporting data from systems, such as via the use of removable media, the data should be checked for unsuitable protective markings to reduce the likelihood of causing a data spill. In addition, data manually exported from SECRET and TOP SECRET systems will require additional assurances, for example, by validating digital signatures and checking for keywords within all textual data. Finally, in cases where security checks fail, data should be quarantined until it can be reviewed and subsequently approved or not approved for release."
        controls:
        - id: ism-1187
          class: ISM-control
          title: "Control: ism-1187"
          props:
          - name: sort-id
            value: "catalog[1].group[24].group[1].group[5].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "3"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1187_smt
            name: statement
            prose: "When manually exporting data from systems, the data is checked for unsuitable protective markings."
        - id: ism-0669
          class: ISM-control
          title: "Control: ism-0669"
          props:
          - name: sort-id
            value: "catalog[1].group[24].group[1].group[5].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "6"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Dec-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0669_smt
            name: statement
            prose: "When manually exporting data from SECRET and TOP SECRET systems, digital signatures are validated and keyword checks are performed within all textual data."
        - id: ism-1779
          class: ISM-control
          title: "Control: ism-1779"
          props:
          - name: sort-id
            value: "catalog[1].group[24].group[1].group[5].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1779_smt
            name: statement
            prose: "When manually exporting data from systems, all data that fails security checks is quarantined until reviewed and subsequently approved or not approved for release."
      - title: Monitoring data import and export
        props:
        - name: sort-id
          value: "catalog[1].group[24].group[1].group[6]"
        parts:
        - name: overview
          prose: "To ensure the ongoing confidentiality and integrity of systems and data, it is important to log all data transfers. This applies to all forms of data transfers, such as those performed using removable media, gateways or CDSs. Ideally, data transfer logs should contain information on who authorised the data transfer, what data was transferred, where the data was transferred from or to, when the data was transferred, why the data was transferred, and how the data was transferred. Monitoring of such activities, via periodic verification of data transfer logs, can assist in identifying abuse of data transfer privileges and any unusual usage patterns that may indicate attempts by an adversary to surreptitiously import malicious code or exfiltrate data from SECRET and TOP SECRET systems."
        controls:
        - id: ism-1586
          class: ISM-control
          title: "Control: ism-1586"
          props:
          - name: sort-id
            value: "catalog[1].group[24].group[1].group[6].control[1]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "0"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Aug-20
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1586_smt
            name: statement
            prose: Data transfer logs are used to record all data imports and exports from systems.
        - id: ism-1294
          class: ISM-control
          title: "Control: ism-1294"
          props:
          - name: sort-id
            value: "catalog[1].group[24].group[1].group[6].control[2]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "5"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: ALL
          parts:
          - id: ism-1294_smt
            name: statement
            prose: Data transfer logs for systems are partially verified at least monthly.
        - id: ism-0660
          class: ISM-control
          title: "Control: ism-0660"
          props:
          - name: sort-id
            value: "catalog[1].group[24].group[1].group[6].control[3]"
          - name: revision
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: "9"
          - name: updated
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: Mar-22
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: S
          - name: applicability
            ns: https://cyber.gov.au/ns/ism/oscal/1.0
            value: TS
          parts:
          - id: ism-0660_smt
            name: statement
            prose: Data transfer logs for SECRET and TOP SECRET systems are fully verified at least monthly.
  back-matter:
    resources:
    - uuid: 014064b7-5b77-4a79-af6c-79a16f4d0cb2
      title: ICT supply chain resource library
      rlinks:
      - href: https://www.cisa.gov/ict-supply-chain-resource-library
    - uuid: 022fcd70-df8b-45ee-ae19-fb9cfe7b6cb6
      title: Events to monitor
      rlinks:
      - href: https://learn.microsoft.com/en-au/windows-server/identity/ad-ds/plan/appendix-l--events-to-monitor
    - uuid: 02fb4cb5-e4c4-4097-97a2-f1b6aa04131a
      title: Assessing Security Vulnerabilities and Applying Patches
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-administration/assessing-security-vulnerabilities-and-applying-patches
    - uuid: 03f761fa-7014-459c-aa16-02c303d50abb
      title: reporting security vulnerabilities
      rlinks:
      - href: https://www.cyber.gov.au/report-and-recover/report/report-a-cyber-security-vulnerability
    - uuid: 0508be6f-cb97-44da-b212-42416a0048b0
      title: random dice roller
      rlinks:
      - href: https://www.random.org/dice/?num=5
    - uuid: 0b1a477d-b08a-4491-9cfc-c9d435b28dc8
      title: Planning for Post-Quantum Cryptography
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/governance-and-user-education/governance/planning-post-quantum-cryptography
    - uuid: 0c912487-72f0-4532-ba68-705590a63258
      title: Reliably Erasing Data From Flash-Based Solid State Drives
      rlinks:
      - href: https://www.usenix.org/legacy/event/fast11/tech/full_papers/Wei.pdf
    - uuid: 0d7243fc-65f0-4b4e-9358-bf4f6e0e34d7
      title: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations
      rlinks:
      - href: https://csrc.nist.gov/publications/detail/sp/800-161/rev-1/final
    - uuid: 0e982561-93dc-4cf7-9a98-e91411e99ca6
      title: Bring Your Own Device for Executives
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/remote-working-and-secure-mobility/secure-mobility/bring-your-own-device-executives
    - uuid: 131048c7-a2e7-4da3-9257-7a058b06c1f8
      title: Secure Administration
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-administration/secure-administration
    - uuid: 18203e18-2aca-492e-be44-770b2f47242f
      title: AV-TEST
      rlinks:
      - href: https://www.av-test.org/en/
    - uuid: 18274424-7086-419e-9fae-a6ba64870459
      title: OWASP Top Ten Proactive Controls
      rlinks:
      - href: https://owasp.org/www-project-proactive-controls/
    - uuid: 188466f6-be12-49ce-b99a-981e54b1663e
      title: reporting cybercrime incidents
      rlinks:
      - href: https://reportapp.cyber.gov.au/
    - uuid: 195abe87-bb1e-4006-8b42-eaecca4d51f1
      title: Guidelines for Cryptography
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography
    - uuid: 197db872-c6a9-4b29-9888-1552e908252c
      title: "FIPS 140-3 Derived Test Requirements (DTR): CMVP Validation Authority Updates to ISO/IEC 24759"
      rlinks:
      - href: https://csrc.nist.gov/publications/detail/sp/800-140/final
    - uuid: 19947ae5-678c-4dc0-a35e-283e4af1284c
      title: Supply chain security guidance
      rlinks:
      - href: https://www.ncsc.gov.uk/collection/supply-chain-security
    - uuid: 1e4a57a2-2832-441d-8ea4-12a98d2be417
      title: Australian Privacy Principles guidelines
      rlinks:
      - href: https://www.oaic.gov.au/privacy/australian-privacy-principles-guidelines
    - uuid: 1ecfc41e-f6a8-4c96-ac41-1587718ca459
      title: Network Infrastructure Security Guide
      rlinks:
      - href: https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2949885/nsa-details-network-infrastructure-best-practices/
    - uuid: 1eefdaf7-3991-4ba2-9439-79565f508c44
      title: Guidelines for Data Transfers
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-data-transfers
    - uuid: 23d977b2-e64e-4ebc-a59f-cd95212045c5
      title: Implementing Network Segmentation and Segregation
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/network-hardening/implementing-network-segmentation-and-segregation
    - uuid: 24eb9af8-fb43-4772-a461-2c36dd0f6d7e
      title: recommended contents for a ‘security.txt’ file
      rlinks:
      - href: https://securitytxt.org/
    - uuid: 26137381-dc34-485c-8331-3bc9876ed48c
      title: Software Memory Safety
      rlinks:
      - href: https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/3215760/nsa-releases-guidance-on-how-to-protect-against-software-memory-safety-issues/
    - uuid: 28cd91d2-e5cb-4896-bcfc-abb32e05e61d
      title: Cryptographic Module Validation Program
      rlinks:
      - href: https://csrc.nist.gov/projects/cryptographic-module-validation-program
    - uuid: 29b04eaf-5f57-4ea1-a453-8047826dccf5
      title: Certified Products List
      rlinks:
      - href: https://commoncriteriaportal.org/products/
    - uuid: 315744ea-3523-4c93-838d-fe2848ac4181
      title: Guide to Bluetooth Security
      rlinks:
      - href: https://csrc.nist.gov/publications/detail/sp/800-121/rev-2/final
    - uuid: 32c8fa3a-45bb-4f88-baee-73a7696aa2ad
      title: Security Requirements for Cryptographic Modules
      rlinks:
      - href: https://csrc.nist.gov/publications/detail/fips/140/3/final
    - uuid: 33d26cdd-51fc-45d3-a026-0814d51a4c7e
      title: Security Recommendations for Server-based Hypervisor Platforms
      rlinks:
      - href: https://csrc.nist.gov/publications/detail/sp/800-125a/rev-1/final
    - uuid: 347eee88-cb61-44b9-81ce-ab97dd08387c
      title: Cloud Computing Security for Cloud Service Providers
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/cloud-security-guidance/cloud-computing-security-cloud-service-providers
    - uuid: 348be728-4459-4447-990e-1dfb3049c71f
      title: data retention
      rlinks:
      - href: https://www.naa.gov.au/information-management/records-authorities/types-records-authorities/afda-express-version-2-functions
    - uuid: 355b47b5-6253-4be5-ba7c-274833d84b75
      title: ROA records
      rlinks:
      - href: https://www.apnic.net/community/security/resource-certification/#routing
    - uuid: 37f65b5b-ce8c-4137-9c84-41678af1e70e
      title: Cyber Supply Chain Risk Management
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/outsourcing-and-procurement/cyber-supply-chains/cyber-supply-chain-risk-management
    - uuid: 39e186f3-d175-4eed-afe6-2b9a7a936a91
      title: MemtestG80
      rlinks:
      - href: https://github.com/ihaque/memtestG80
    - uuid: 3a1a00f6-2f56-4d04-b99d-6f1682b95a98
      title: detect or prevent various stages of network intrusions
      rlinks:
      - href: https://attackevals.mitre-engenuity.org/
    - uuid: 3a7b903b-ed0d-450d-9123-60f6f8fd5dd2
      title: Guidelines for Communications Systems
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-communications-systems
    - uuid: 3ccea9a8-a728-4f5b-a0a8-43f2f206f76b
      title: Restricting Administrative Privileges
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-administration/restricting-administrative-privileges
    - uuid: 3df21b72-0559-4bbf-a990-5ee509f70747
      title: gateway security guidance package
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/gateway-secuirty-guidance
    - uuid: 3e4cd135-5fa3-4a1e-a192-1793ff42067c
      title: Access to information
      rlinks:
      - href: https://www.protectivesecurity.gov.au/publications-library/policy-9-access-information
    - uuid: 3e5a98e5-9219-46c8-81c2-e3a4d13407ce
      title: AD Forest Recovery - Resetting the krbtgt password
      rlinks:
      - href: https://learn.microsoft.com/en-au/windows-server/identity/ad-ds/manage/ad-forest-recovery-resetting-the-krbtgt-password
    - uuid: 3ec0f0b2-5565-46ad-a1e8-e39cb2219bd2
      title: The Trustworthy Computing Security Development Lifecycle
      rlinks:
      - href: https://learn.microsoft.com/en-au/previous-versions/ms995349(v=msdn.10)
    - uuid: 3f349d16-11a1-459a-a299-c9446aea7597
      title: Guidelines for Database Systems
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-database-systems
    - uuid: 401ed034-e2bd-43b4-9fde-05d07618039a
      title: Center for Memory and Recording Research
      rlinks:
      - href: https://cmrr.ucsd.edu/resources/secure-erase.html
    - uuid: 42e7d99d-9709-4355-a54d-98959c552aa1
      title: Cryptographic Algorithm Validation Program
      rlinks:
      - href: https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program
    - uuid: 436de247-4c95-4449-89a4-fec912605e7d
      title: OWASP Top 10
      rlinks:
      - href: https://owasp.org/www-project-top-ten/
    - uuid: 45899752-c83f-4976-bc99-03f6824a0793
      title: How to Manage Your Security When Engaging a Managed Service Provider
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/outsourcing-and-procurement/managed-services/how-manage-your-security-when-engaging-managed-service-provider
    - uuid: 4a3a265f-7772-433b-9906-7f784052f28b
      title: recommended driver block rules
      rlinks:
      - href: https://learn.microsoft.com/en-au/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules
    - uuid: 4b0f2fa7-f9d6-48d8-b14c-527939808882
      title: Trustworthy Email
      rlinks:
      - href: https://csrc.nist.gov/publications/detail/sp/800-177/rev-1/final
    - uuid: 4deea7ea-18a2-4fd7-8b25-0b3603215df2
      title: Guidelines for Physical Security
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-physical-security
    - uuid: 4defa9a8-c5f5-4b39-8b0a-537f14d9d14d
      title: Guidelines for Communications Infrastructure
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-communications-infastructure
    - uuid: 4eeff329-cea0-4baf-a80b-8b0b76436075
      title: Implementing Application Control
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-hardening/implementing-application-control
    - uuid: 506198a8-7ae8-4c95-8b7b-2a4833cfab4b
      title: Guidelines for Software Development
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-software-development
    - uuid: 53da8dba-961e-4222-94e0-68cb9510384d
      title: digital preservation planning
      rlinks:
      - href: https://www.naa.gov.au/information-management/information-management-legislation/digital-preservation-planning
    - uuid: 5424f156-70cd-4ff9-a80e-ff459706bf55
      title: Entity facilities
      rlinks:
      - href: https://www.protectivesecurity.gov.au/publications-library/policy-16-entity-facilities
    - uuid: 55038d94-7587-4234-a18c-fb459fcdb295
      title: Domain Name System-Based Electronic Mail Security
      rlinks:
      - href: https://csrc.nist.gov/publications/detail/sp/1800-6/final
    - uuid: 578d0434-6b3f-46f3-aad8-c7ac75c2ebcc
      title: Guidelines for Security Documentation
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-security-documentation
    - uuid: 5796c2ee-4dbc-4084-ae80-2febc26d5807
      title: Travelling Overseas With Electronic Devices
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/remote-working-and-secure-mobility/secure-mobility/travelling-overseas-electronic-devices
    - uuid: 57c58870-2ebb-4fce-b995-0c86cb64002f
      title: AISEP
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/assessment-and-evaluation-programs/australian-information-security-evaluation-program
    - uuid: 58282062-5c17-476a-98b1-105a627cd28d
      title: randomly generating passphrases
      rlinks:
      - href: https://www.eff.org/dice
    - uuid: 58c9abfb-58fe-416e-a279-dfbfe123c99f
      title: "Hardening Microsoft 365, Office 2021, Office 2019 and Office 2016"
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-hardening/hardening-microsoft-365-office-2021-office-2019-and-office-2016
    - uuid: 5a2ed3ef-afcc-485e-8014-5107e9ed97e3
      title: recommended block rules
      rlinks:
      - href: https://learn.microsoft.com/en-au/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
    - uuid: 6136b137-0cc9-4d21-94ee-0abfac2b4e18
      title: Malicious Email Mitigation Strategies
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/email-hardening/malicious-email-mitigation-strategies
    - uuid: 616fce77-495b-472a-a552-7593ab64f188
      title: "Security Configuration Guide – Samsung Galaxy S10, S20 and Note 20 Devices"
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/remote-working-and-secure-mobility/secure-mobility/security-configuration-guide-samsung-galaxy-s10-s20-and-note-20-devices
    - uuid: 626d3582-3caf-49d6-89d5-4b8fdbbf1f31
      title: reporting cyber security incidents
      rlinks:
      - href: https://www.cyber.gov.au/report-and-recover/report/report-a-cyber-security-incident
    - uuid: 626dab35-81ab-45fe-8c12-0faff1c23c07
      title: Guidelines for Cyber Security Roles
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cyber-security-roles
    - uuid: 629818d8-430c-4125-8fd2-5e3f988fce21
      title: MemTest86
      rlinks:
      - href: https://www.memtest86.com/
    - uuid: 63b0d043-b6b3-4e2b-bca8-99b42cfd9904
      title: Selecting a Protective DNS Service
      rlinks:
      - href: https://www.cisa.gov/uscert/ncas/current-activity/2021/03/04/joint-nsa-and-cisa-guidance-strengthening-cyber-defense-through
    - uuid: 672e85cc-2d40-46ba-9e94-c604b9731c75
      title: secure programming practices
      rlinks:
      - href: https://www.sei.cmu.edu/our-work/secure-development/index.cfm
    - uuid: 6b4353e0-7281-49f4-a520-f35a4cceec71
      title: examples of client-side JavaScript controls
      rlinks:
      - href: https://noscript.net/
    - uuid: 6ba86dff-e078-4896-8884-344e491a9cc4
      title: Secure Cloud Strategy
      rlinks:
      - href: https://www.dta.gov.au/our-projects/secure-cloud-strategy
    - uuid: 6e456a92-f405-4151-88ca-5621aa23519b
      title: Physical security for entity resources
      rlinks:
      - href: https://www.protectivesecurity.gov.au/publications-library/policy-15-physical-security-entity-resources
    - uuid: 6e801c68-61f6-4c28-bf72-df91f7e232cc
      title: Hardening Microsoft Windows 10 version 21H1 Workstations
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-hardening/hardening-microsoft-windows-10-version-21h1-workstations
    - uuid: 6f1f2f2b-abe6-46e4-9c9d-8339f1d9dab7
      title: "Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities"
      rlinks:
      - href: https://csrc.nist.gov/publications/detail/sp/800-218/final
    - uuid: 6fac5a84-b86e-405f-b2b3-8c13ecee4a02
      title: Privacy Act 1988
      rlinks:
      - href: https://www.legislation.gov.au/Series/C2004A03712
    - uuid: 7000d51a-6cca-40a0-95d9-f1f15048ea68
      title: Australian cabling standards and regulations
      rlinks:
      - href: https://www.acma.gov.au/cabling-standards-and-regulations
    - uuid: 70371e26-f3fb-4b05-85ea-7f6e1f2ee184
      title: The Minimum Elements For a Software Bill of Materials (SBOM)
      rlinks:
      - href: https://www.ntia.doc.gov/report/2021/minimum-elements-software-bill-materials-sbom
    - uuid: 76068c96-8d89-4c37-9eef-03488d5e1b1d
      title: Questions to Ask Managed Service Providers
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/outsourcing-and-procurement/managed-services/questions-ask-managed-service-providers
    - uuid: 76087ab6-88d4-4610-9a98-6ddc5f7bd7e6
      title: OWASP API Security Top 10
      rlinks:
      - href: https://owasp.org/www-project-api-security/
    - uuid: 78a48231-9963-4f78-962a-861c96c58ead
      title: Starting a Vulnerability Disclosure Program
      rlinks:
      - href: https://developers.google.com/android/play-protect/starting-a-vdp
    - uuid: 7d16ae67-87a7-4861-b939-e13ec279b5a2
      title: Guidelines for Personnel Security
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-personnel-security
    - uuid: 7d22400c-ddef-4cbb-90f1-7502dc569e5b
      title: the use of PowerShell by blue teams
      rlinks:
      - href: https://devblogs.microsoft.com/powershell/powershell-the-blue-team/
    - uuid: 7da35efd-7196-4aba-bd79-30c19e8ef48b
      title: RPKI
      rlinks:
      - href: https://www.apnic.net/community/security/resource-certification/#resource-certification
    - uuid: 7ffd20ed-4f40-43be-a37b-97e7a1b31e2f
      title: The CERT Guide to Coordinated Vulnerability Disclosure
      rlinks:
      - href: https://resources.sei.cmu.edu/library/asset-view.cfm?assetid=503330
    - uuid: 8132c47e-a2dc-4dd9-81d6-38db96e5cec6
      title: Hardening Linux Workstations and Servers
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-hardening/hardening-linux-workstations-and-servers
    - uuid: 824e4353-a9ae-4869-88fb-cb0675dc5d1c
      title: Mitigating the Use of Stolen Credentials
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-hardening/mitigating-use-stolen-credentials
    - uuid: 83e3a9b1-5057-4531-91dd-03c8d92634b0
      title: Implementing Multi-Factor Authentication
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-hardening/implementing-multi-factor-authentication
    - uuid: 84d3cbab-ab84-4981-a4f7-2bd469c8deaf
      title: the purpose of IRAP
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/assessment-and-evaluation-programs/infosec-registered-assessors-program
    - uuid: 85ee803a-b711-443b-98bf-b279de8fbed0
      title: Identifying Cyber Supply Chain Risks
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/outsourcing-and-procurement/cyber-supply-chains/identifying-cyber-supply-chain-risks
    - uuid: 86847be4-3a06-4d2f-9952-447158593e0d
      title: Introduction to Cross Domain Solutions
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/cross-domain-solutions/introduction-cross-domain-solutions
    - uuid: 86b273d9-e9d7-4919-9a41-631a5ae5bf88
      title: certification programs
      rlinks:
      - href: https://www.wi-fi.org/certification/programs
    - uuid: 887c65c3-c853-41c6-89d5-3f297108889e
      title: Application Container Security Guide
      rlinks:
      - href: https://csrc.nist.gov/publications/detail/sp/800-190/final
    - uuid: 8a0daed2-8840-443f-a83e-68252d2dcdc5
      title: "Supply Chain Cyber Security: In Safe Hands"
      rlinks:
      - href: https://www.ncsc.govt.nz/resources/cyber-resilience-guidance/supply-chain/
    - uuid: 8a965432-7e2e-4020-86e4-b38837f9be60
      title: Using the Information Security Manual
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/using-information-security-manual
    - uuid: 8bb7bf2c-a933-4a80-8ad7-ca4426839c5d
      title: Security governance for contracted goods and service providers
      rlinks:
      - href: https://www.protectivesecurity.gov.au/publications-library/policy-6-security-governance-contracted-goods-and-service-providers
    - uuid: 8f1965a9-a6a1-4342-bfb8-797ea358db30
      title: Information technology – Security techniques – Vulnerability disclosure
      rlinks:
      - href: https://www.iso.org/standard/72311.html
    - uuid: 8ffea524-0974-4b53-a8f5-41166073ede5
      title: Securing PowerShell in the Enterprise
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-administration/securing-powershell-enterprise
    - uuid: 91b92563-d991-40fa-9adc-548df9f6c496
      title: group Managed Service Accounts
      rlinks:
      - href: https://learn.microsoft.com/en-au/azure/active-directory/fundamentals/service-accounts-group-managed
    - uuid: 92679127-f61d-486a-a93e-df2a26dfb07a
      title: Protective Security Policy Framework
      rlinks:
      - href: https://www.protectivesecurity.gov.au/
    - uuid: 971c6452-6e97-4b4f-b5e4-64e457cb8320
      title: "Cyber supply chain: An approach to assessing risk"
      rlinks:
      - href: https://cyber.gc.ca/en/guidance/cyber-supply-chain-approach-assessing-risk-itsap10070
    - uuid: 98951624-a06e-4d9a-96a3-f89ac944bcaa
      title: Protecting Against Business Email Compromise
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/email-hardening/protecting-against-business-email-compromise
    - uuid: 99c117f0-78e0-4196-adc8-705405d996bc
      title: Information technology – Security techniques – Vulnerability handling processes
      rlinks:
      - href: https://www.iso.org/standard/69725.html
    - uuid: 9a69d597-080f-4d03-b32b-d926f0b87e33
      title: Good Practice Guide on Vulnerability Disclosure
      rlinks:
      - href: https://www.enisa.europa.eu/publications/vulnerability-disclosure
    - uuid: 9a8f5a63-bcd5-45a8-9f9c-974fc796ac95
      title: Guidelines for Enterprise Mobility
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-enterprise-mobility
    - uuid: 9d38f42d-eeff-4124-93db-4b29abaafb67
      title: MemtestCL
      rlinks:
      - href: https://github.com/ihaque/memtestCL
    - uuid: a07c439d-b2f4-4ee2-b56e-f17000f3722f
      title: Information technology – Security techniques – Security requirements for cryptographic modules
      rlinks:
      - href: https://www.iso.org/standard/52906.html
    - uuid: a699a3aa-828d-479b-b50b-98127bb19437
      title: Guidelines for Evaluated Products
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-evaluated-products
    - uuid: a9b6660b-fc4c-4a08-8db6-1130370b6b09
      title: Wi-Fi technologies
      rlinks:
      - href: https://www.wi-fi.org/discover-wi-fi
    - uuid: aab0523a-513e-48c9-978e-32d5b9adeea6
      title: developing a vulnerability disclosure policy
      rlinks:
      - href: https://policymaker.disclose.io/policymaker/introduction
    - uuid: aaf83df2-02e3-4f9f-bdf5-33fbff42842d
      title: Information technology – Security techniques – Test requirements for cryptographic modules
      rlinks:
      - href: https://www.iso.org/standard/72515.html
    - uuid: ab73fa95-f213-4041-915e-a8ccbdf74331
      title: Guidelines for Email
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-email
    - uuid: ae426d0a-adb6-43b8-a463-faa33e83b679
      title: Active Directory accounts
      rlinks:
      - href: https://learn.microsoft.com/en-au/windows-server/identity/ad-ds/manage/understand-default-user-accounts
    - uuid: af0810aa-3486-4ca6-a48a-fad8ce9ac193
      title: greater visibility through PowerShell logging
      rlinks:
      - href: https://www.mandiant.com/resources/blog/greater-visibility
    - uuid: b0a56885-8484-42d6-af79-4c87237ede30
      title: NSA/CSS Evaluated Products List for Magnetic Degaussers
      rlinks:
      - href: https://www.nsa.gov/Resources/Media-Destruction-Guidance/NSA-Evaluated-Products-Lists-EPLs/
    - uuid: b13cb68a-a94a-4a69-b094-b1b68d10239e
      title: Domain Name System Security for Domain Resolvers
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/network-hardening/domain-name-system-security-domain-resolvers
    - uuid: b151e338-c42f-41ef-9f99-2cb98f368637
      title: Best Practices for Securing Active Directory
      rlinks:
      - href: https://learn.microsoft.com/en-au/windows-server/identity/ad-ds/plan/security-best-practices/best-practices-for-securing-active-directory
    - uuid: b383a647-7627-4450-99b6-640ae554c2f1
      title: Guidelines on Electronic Mail Security
      rlinks:
      - href: https://csrc.nist.gov/publications/detail/sp/800-45/version-2/final
    - uuid: b3fa2724-3a61-4d68-843a-61cab9e28750
      title: Protecting Web Applications and Users
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/web-hardening/protecting-web-applications-and-users
    - uuid: b43b0377-c2e4-4cdc-acec-a9ece7371e36
      title: Baseline Security Requirements for Network Security Zones (Version 2.0)
      rlinks:
      - href: https://cyber.gc.ca/en/guidance/baseline-security-requirements-network-security-zones-version-20-itsp80022
    - uuid: b594c9c0-b42f-4f06-b643-38023275a5c7
      title: Guidelines for Media
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-media
    - uuid: b6479d9a-43c9-41f2-9dbc-2bb689c8e6d8
      title: Anatomy of a Cloud Assessment and Authorisation
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/cloud-security-guidance/anatomy-cloud-assessment-and-authorisation
    - uuid: b66f8d23-4209-4775-a1fd-bd4dc299a027
      title: Domain Name System Security for Domain Owners
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/network-hardening/domain-name-system-security-domain-owners
    - uuid: b8cdbf18-31cb-4e10-bb43-e8488ee8c2f6
      title: "Implementing Certificates, TLS, HTTPS and Opportunistic TLS"
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/web-hardening/implementing-certificates-tls-https-and-opportunistic-tls
    - uuid: b959caf4-8b60-4b82-9552-963754841bb7
      title: Cloud Computing Security for Tenants
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/cloud-security-guidance/cloud-computing-security-tenants
    - uuid: bac2c6f2-9356-46d2-b7c4-9af7393008df
      title: Australian Privacy Principles
      rlinks:
      - href: https://www.oaic.gov.au/privacy/australian-privacy-principles
    - uuid: baf3f7d2-750f-43c8-b805-8fc10228a6fd
      title: Securing Content Management Systems
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/web-hardening/securing-content-management-systems
    - uuid: bdd11ace-cb4e-470a-92ad-556c79b6c14a
      title: a list of current IRAP assessors
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/assessment-and-evaluation-programs/infosec-registered-assessors-program/irap-assessors
    - uuid: c17600e6-8b13-4d6e-a380-035b51a71b73
      title: The NIST Definition of Cloud Computing
      rlinks:
      - href: https://csrc.nist.gov/publications/detail/sp/800-145/final
    - uuid: c3e69683-1e95-40df-bd1f-f86a3fa3a9c1
      title: An Examination of the Redaction Functionality of Adobe Acrobat Pro DC 2017
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/miscellaneous-guidance/an-examination-redaction-functionality-adobe-acrobat-pro-dc-2017
    - uuid: c54cc4db-22f4-4d10-8977-2ce62b647bd2
      title: Preparing for and Responding to Denial-of-Service Attacks
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/governance-and-user-education/governance/preparing-and-responding-denial-of-service-attacks
    - uuid: c6ca6620-ccd5-4c5d-b97c-9d92f1162948
      title: Guidelines for System Management
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-system-management
    - uuid: c78caaed-9931-4197-b21e-bc4e9979a51a
      title: Security Tips for Social Media and Messaging Apps
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/governance-and-user-education/user-education/security-tips-social-media-and-messaging-apps
    - uuid: c852e735-4920-4616-8e34-2fddfb49eea8
      title: AV-Comparatives
      rlinks:
      - href: https://www.av-comparatives.org/
    - uuid: cad720b4-e47a-437d-b272-6958e738131d
      title: Common Sense Guide to Mitigating Insider Threats
      rlinks:
      - href: https://resources.sei.cmu.edu/library/asset-view.cfm?assetid=540644
    - uuid: d0ace151-3c21-49af-bde7-eda58ab18a82
      title: cyber supply chain transparency
      rlinks:
      - href: https://ntia.gov/page/software-bill-materials
    - uuid: d0df96bb-7236-4784-8f54-2cb6335ad228
      title: exploit protection functionality
      rlinks:
      - href: https://learn.microsoft.com/en-au/microsoft-365/security/defender-endpoint/exploit-protection?view=o365-worldwide
    - uuid: d2910e61-da88-4d29-b860-83c25161fd18
      title: Security Configuration Guide – Apple iOS 14 Devices
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/remote-working-and-secure-mobility/secure-mobility/security-configuration-guide-apple-ios-14-devices
    - uuid: d2f005c5-2ad3-4b5e-9eb1-d0642f3560f4
      title: OWASP Application Security Verification Standard
      rlinks:
      - href: https://owasp.org/www-project-application-security-verification-standard/
    - uuid: d3572f80-d9d6-4023-b6e6-23720bb0d618
      title: How to Combat Fake Emails
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/email-hardening/how-combat-fake-emails
    - uuid: d36ce452-ec21-4b05-89c1-f29a444a3dca
      title: End of Support for Microsoft Windows and Microsoft Windows Server
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-hardening/end-support-microsoft-windows-and-microsoft-windows-server
    - uuid: d7e72166-b127-4249-bf93-3a7467c53f1d
      title: Cloud Computing Security Considerations
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/cloud-security-guidance/cloud-computing-security-considerations
    - uuid: daae37ef-262f-4b20-bfb7-a27901f3c2db
      title: Security Configuration Guide – Viasat Mobile Dynamic Defense
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/remote-working-and-secure-mobility/secure-mobility/security-configuration-guide-viasat-mobile-dynamic-defense
    - uuid: db2e237c-2dbc-4a1f-bae7-9cb63a1f1dc3
      title: Guidelines for ICT Equipment
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-ict-equipment
    - uuid: dbd0372b-b758-46b1-bf05-d9676689d5b0
      title: "Coordinated Vulnerability Disclosure: The Guideline"
      rlinks:
      - href: https://english.ncsc.nl/publications/publications/2019/juni/01/coordinated-vulnerability-disclosure-the-guideline
    - uuid: dda788b6-183b-4e89-8254-8c4b5d0540a0
      title: Cloud Assessment and Authorisation – Frequently Asked Questions
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/cloud-security-guidance/cloud-assessment-and-authorisation-frequently-asked-questions
    - uuid: de239dae-d1e8-4969-9680-ef3444d32a83
      title: Windows Event Logging and Forwarding
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-monitoring/windows-event-logging-and-forwarding
    - uuid: de7525f3-a466-40a5-abdd-3ae24a6d1b44
      title: Guidelines for System Hardening
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-system-hardening
    - uuid: ded13757-3c76-40cb-b46e-f84e46a1c1c7
      title: Defending Against the Malicious Use of the Tor Network
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/network-hardening/defending-against-malicious-use-tor-network
    - uuid: df17ad0f-58d3-4bb8-814a-b60f34c5f841
      title: Emanation Security Program
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/assessment-and-evaluation-programs/emanation-security-program
    - uuid: dfb52998-0e7e-420d-97e1-d1313c8f919a
      title: Microsoft Office Macro Security
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-hardening/microsoft-office-macro-security
    - uuid: e0d3b5ea-6a5a-400c-8daa-8a8059816a06
      title: Archives Act 1983
      rlinks:
      - href: https://www.legislation.gov.au/Series/C2004A02796
    - uuid: e19a0c40-0a68-4fba-aea1-142fdd57dc75
      title: Web Conferencing Security
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/remote-working-and-secure-mobility/remote-working/web-conferencing-security
    - uuid: e1ebbfe4-ac16-4286-884e-907b2eada22b
      title: Sensitive and classified information
      rlinks:
      - href: https://www.protectivesecurity.gov.au/publications-library/policy-8-sensitive-and-classified-information
    - uuid: e4c07309-9ca8-40b7-9571-4f6c032180a1
      title: Telecommunications (Interception and Access) Act 1979
      rlinks:
      - href: https://www.legislation.gov.au/Series/C2004A02124
    - uuid: e4eee462-f6e5-4921-a8fe-26f3de6c6f45
      title: Marketing and Filtering Email Service Providers
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/email-hardening/marketing-and-filtering-email-service-providers
    - uuid: e4ef23da-2683-4356-93c4-a2412c9d52ee
      title: High Assurance Evaluation Program
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/assessment-and-evaluation-programs/high-assurance-evaluation-program
    - uuid: e7ce6e23-4bbb-45c1-a657-7e563c0837ed
      title: Information Security Manual
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism
    - uuid: e8a28fa5-4ea1-4ef5-a870-4d59e40fab37
      title: Commercial National Security Algorithm Suite
      rlinks:
      - href: https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/3148990/nsa-releases-future-quantum-resistant-qr-algorithm-requirements-for-national-se/
    - uuid: e8bde527-526c-4a6a-b66f-05228f09dd7b
      title: Guidelines for Gateways
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-gateways
    - uuid: e8ec7a1f-775d-4b79-a164-0752278177fa
      title: Risk Management of Enterprise Mobility Including Bring Your Own Device (BYOD)
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/remote-working-and-secure-mobility/secure-mobility/risk-management-enterprise-mobility-including-bring-your-own-device
    - uuid: eb0009ec-5481-41cd-91e3-aee354042712
      title: Data Remanence in Semiconductor Devices
      rlinks:
      - href: https://www.usenix.org/legacy/events/sec01/full_papers/gutmann/gutmann.pdf
    - uuid: edc24216-f52b-4513-bcda-5fa564661999
      title: Guidelines for System Monitoring
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-system-monitoring
    - uuid: edd67903-94ef-4edd-9789-73e0141cd77c
      title: General requirements for the competence of testing and calibration laboratories
      rlinks:
      - href: https://www.iso.org/standard/66912.html
    - uuid: efddc783-51dc-48ac-a53e-a5dd56c17fd0
      title: Detecting Socially Engineered Messages
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/email-hardening/detecting-socially-engineered-messages
    - uuid: f145ff5b-d396-4248-8f48-621349d6f0ed
      title: Guidelines for Networking
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-networking
    - uuid: f32020e9-4cb3-486b-bcbb-6fb6719f58a5
      title: Fundamentals of Cross Domain Solutions
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/cross-domain-solutions/fundamentals-cross-domain-solutions
    - uuid: f37a4848-0791-4870-b316-5536c2681c28
      title: Guidelines for Procurement and Outsourcing
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-procurement-and-outsourcing
    - uuid: f48c0d05-5173-4c8e-8748-e5591518c1fb
      title: Computer Security Incident Handling Guide
      rlinks:
      - href: https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final
    - uuid: f74ba095-a7f7-4b8c-9e60-5fe84f2a2d0b
      title: changing credentials for this service account
      rlinks:
      - href: https://www.microsoft.com/en-us/security/blog/2015/02/11/krbtgt-account-password-reset-scripts-now-available-for-customers/
    - uuid: f7e13f7b-eb48-4294-bd01-9c22c756d96b
      title: Security Equipment Evaluated Products List
      rlinks:
      - href: https://www.scec.gov.au/catalogue
    - uuid: f832363c-d81e-4908-afd9-cf45047dd19c
      title: configuring OpenSSH
      rlinks:
      - href: https://man.openbsd.org/sshd_config
    - uuid: f9fb4c57-8c12-4edf-9e34-cb422664aae9
      title: "Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft Techniques, Version 1 and 2"
      rlinks:
      - href: https://www.microsoft.com/en-au/download/confirmation.aspx?id=36036
    - uuid: fe0138db-e83b-4a23-85d3-d84e1c22816f
      title: Guidelines for Cyber Security Incidents
      rlinks:
      - href: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cyber-security-incidents
    - uuid: ffc8a1f6-f4e3-4ff5-a7f9-f41f766274eb
      title: "Recommendation for Key Management: Part 1 – General"
      rlinks:
      - href: https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final
