Search

Categories

System Hardening Cryptography gateways Networking System Management Communications Infrastructure Personnel Security Media software development Enterprise Mobility Communications Systems Procurement and Outsourcing cybersecurity roles Email Information Technology Equipment system monitoring Database Systems Physical Security Cyber Security Incidents Data Transfers

5 controls

Security Documentation

ISM-0041

Systems have a system security plan that includes an overview of the system (covering the system’s purpose, the system boundary and how the system is managed) as well as an annex that covers applicable controls from this document and any additional controls that have been identified and implemented.

ISM-1163

Systems have a continuous monitoring plan that includes:<br>• conducting vulnerability scans for systems at least fortnightly<br>• conducting vulnerability assessments and penetration tests for systems prior to deployment, including prior to deployment of significant changes, and at least annually thereafter<br>• analysing identified vulnerabilities to determine their potential impact<br>• implementing mitigations based on risk, effectiveness and cost.

ISM-1563

At the conclusion of a security assessment for a system, a security assessment report is produced by the assessor and covers:<br>• the scope of the security assessment<br>• the system’s strengths and weaknesses<br>• security risks associated with the operation of the system<br>• the effectiveness of the implementation of controls<br>• any recommended remediation actions."

ISM-1564

At the conclusion of a security assessment for a system, a plan of action and milestones is produced by the system owner.

ISM-1602

Security documentation, including notification of subsequent changes, is communicated to all stakeholders.

Last updated May 21, 2025

The Information Security Manual and its controls are written by the Australian Cyber Security Centre.
Built with Hugo. Theme Stack designed by Jimmy