Search

Categories

System Hardening Cryptography Gateways Networking System Management Communications Infrastructure Personnel Security Media Enterprise Mobility Software Development Communications Systems Procurement and Outsourcing Cyber Security Roles Email Information Technology Equipment Cyber Security Incidents Database Systems System Monitoring Data Transfers Physical Security

9 controls

Security Documentation

ISM-0039

A cyber security strategy is developed, implemented and maintained.

ISM-0041

Systems have a system security plan that includes an overview of the system (covering the system’s purpose, the system boundary and how the system is managed) as well as an annex that covers applicable controls from this document and any additional controls that have been identified and implemented.

ISM-0043

Systems have a cyber security incident response plan that covers the following:<br>• guidelines on what constitutes a cyber security incident<br>• the types of cyber security incidents likely to be encountered and the expected response to each type<br>• how to report cyber security incidents, internally to an organisation and externally to relevant authorities<br>• other parties which need to be informed in the event of a cyber security incident<br>• the authority, or authorities, responsible for investigating and responding to cyber security incidents<br>• the criteria by which an investigation of a cyber security incident would be requested from a law enforcement agency, the Australian Signals Directorate or other relevant authority<br>• the steps necessary to ensure the integrity of evidence relating to a cyber security incident<br>• system contingency measures or a reference to such details if they are located in a separate document.

ISM-0047

Organisational-level security documentation is approved by the Chief Information Security Officer while system-specific security documentation is approved by the system’s authorising officer.

ISM-0888

Security documentation is reviewed at least annually and includes a ‘current as at [date]’ or equivalent statement.

ISM-1163

Systems have a continuous monitoring plan that includes:<br>• conducting vulnerability scans for systems at least fortnightly<br>• conducting vulnerability assessments and penetration tests for systems prior to deployment, including prior to deployment of significant changes, and at least annually thereafter<br>• analysing identified vulnerabilities to determine their potential impact<br>• implementing mitigations based on risk, effectiveness and cost.

ISM-1563

At the conclusion of a security assessment for a system, a security assessment report is produced by the assessor and covers:<br>• the scope of the security assessment<br>• the system’s strengths and weaknesses<br>• security risks associated with the operation of the system<br>• the effectiveness of the implementation of controls<br>• any recommended remediation actions."

ISM-1564

At the conclusion of a security assessment for a system, a plan of action and milestones is produced by the system owner.

ISM-1602

Security documentation, including notification of subsequent changes, is communicated to all stakeholders.

Last updated February 1, 2025

The Information Security Manual and its controls are written by the Australian Cyber Security Centre.
Built with Hugo. Theme Stack designed by Jimmy