{"schema_version":"1.0.0","snapshot":{"edition":"September 2026","release":"2026.09.4","oscal_version":"1.1.2","verified_at":"2026-10-25T23:08:12.459Z","official_metadata":{"title":"Information security manual","published":"2026-09-03T23:10:47.63884244Z","last_modified":"2026-09-03T23:10:47.63884244Z","version":"2026.09.4","oscal_version":"1.1.2"},"source":{"release_url":"https://www.cyber.gov.au/ism/oscal/v2026.09.4","catalogue_url":"https://www.cyber.gov.au/ism/oscal/v2026.09.4/artifacts/ISM_catalog.json","catalogue_sha256":"237ea09362b8449ed5c5ee85de4725a0468ee73d13af7cf61c26d4e6ac47f12d","mapping_repository":"https://github.com/Latticework-Systems/ism-kubernetes-controls","mapping_revision":"07b348a2952bf2d0e78d9e739f367cb0919ab888","mapping_url":"https://github.com/Latticework-Systems/ism-kubernetes-controls/blob/07b348a2952bf2d0e78d9e739f367cb0919ab888/mapping/ism-mapping.yaml","mapping_sha256":"f823681fd71e40e589aae714ef2215dd8dc33722a1ec70b81ded5b2322937470","files":[{"name":"ISM_catalog.json","url":"https://www.cyber.gov.au/ism/oscal/v2026.09.4/artifacts/ISM_catalog.json","sha256":"237ea09362b8449ed5c5ee85de4725a0468ee73d13af7cf61c26d4e6ac47f12d","bytes":2677748},{"name":"oscal_catalog_schema.json","url":"https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_catalog_schema.json","sha256":"5b069afa4f4ecc38d59914dab56098566d4247d3578a2123c030c80d36fc5104","bytes":43204},{"name":"ism-mapping.yaml","url":"https://raw.githubusercontent.com/Latticework-Systems/ism-kubernetes-controls/07b348a2952bf2d0e78d9e739f367cb0919ab888/mapping/ism-mapping.yaml","sha256":"f823681fd71e40e589aae714ef2215dd8dc33722a1ec70b81ded5b2322937470","bytes":33980},{"name":"provenance.lock.yaml","url":"https://raw.githubusercontent.com/Latticework-Systems/ism-kubernetes-controls/07b348a2952bf2d0e78d9e739f367cb0919ab888/mapping/provenance.lock.yaml","sha256":"dc88daab6ccc873e5e0cdb37aad248d0293081672bbc2f4e1dc6b39ec1a16b25","bytes":2695},{"name":"mapping.json","url":null,"sha256":"250ed4b3dff4a85cab6c18af1726a55ba8cbf41fbbf62e7b5a9716a4c7213c13","bytes":50905},{"name":"mapping-LICENSE","url":"https://raw.githubusercontent.com/Latticework-Systems/ism-kubernetes-controls/07b348a2952bf2d0e78d9e739f367cb0919ab888/LICENSE","sha256":"1b2611d91f59eb4032aaf8c702c16e97629124ea4ab7fe2f9f249fc873d95f33","bytes":9109}]},"rights":{"official":{"attribution":"Australian Signals Directorate, © Commonwealth of Australia 2026","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","conditions_url":"https://www.cyber.gov.au/copyright","repository_notice_url":"https://github.com/AustralianCyberSecurityCentre/ism-oscal/blob/main/README.md","changes":"Statements retain the pinned OSCAL prose verbatim. Metadata is reorganised into this interface. Markdown adds headings, links and attribution. Latticework interpretation is separately labelled. The raw OSCAL metadata has no embedded licence fields; licence provenance comes from ASD’s website and official repository notices."},"mapping":{"attribution":"Latticework Systems — ism-kubernetes-controls","license":"Apache-2.0","license_url":"https://github.com/Latticework-Systems/ism-kubernetes-controls/blob/07b348a2952bf2d0e78d9e739f367cb0919ab888/LICENSE","note":"Applies to copied mapping evidence notes, checks and responsibility allocations. It does not apply to ASD’s control wording, which remains CC BY 4.0."},"editorial":{"attribution":"Latticework Systems","license":null,"note":"Original implementation and evidence suggestions are Latticework interpretation. Public retrieval does not assign a new licence to that editorial content.","content_preference":{"search":"yes","ai_input":"yes","ai_train":"no","scope":"Advisory preference for original Latticework editorial material only. It does not restrict ASD CC BY material or third-party mapping licences, assign a new licence, or guarantee enforcement or the absence of provider logs."}}}},"scope_note":"A pinned reference snapshot, not a compliance assessment. All implementation mappings are partial. Null interpretation means no reviewed guide is published; it does not mean compliant, not applicable or no evidence required. No IRAP certification or DISP membership is conferred.","resource_type":"catalogue","control_count":1143,"guide_count":23,"controls":[{"id":"ISM-0009","url":"https://latticeworksystems.com.au/ism/ism-0009/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0009.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0009.md","official":{"statement":"System owners, in consultation with each system’s authorising officer, identify any supplementary security controls required based upon the unique nature of each system, its operating environment and the organisation’s risk tolerances.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","System owners","Protecting systems and their resources"]},"latticework_interpretation":null},{"id":"ISM-0027","url":"https://latticeworksystems.com.au/ism/ism-0027/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0027.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0027.md","official":{"statement":"System owners obtain an authorisation to operate for each non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET system from its authorising officer.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Mar-26","applicability":["NC","OS","P","S"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","System owners","Protecting systems and their resources"]},"latticework_interpretation":null},{"id":"ISM-0039","url":"https://latticeworksystems.com.au/ism/ism-0039/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0039.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0039.md","official":{"statement":"A cyber security strategy is developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security documentation","Development and maintenance of cyber security documentation","Cyber security strategy"]},"latticework_interpretation":null},{"id":"ISM-0041","url":"https://latticeworksystems.com.au/ism/ism-0041/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0041.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0041.md","official":{"statement":"Systems have a system security plan that includes an overview of the system (covering the system’s purpose, the system boundary and how the system is managed) as well as an annex that covers applicable security controls from this document and any additional security controls that have been identified and implemented.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security documentation","System-specific cyber security documentation","System security plan"]},"latticework_interpretation":null},{"id":"ISM-0042","url":"https://latticeworksystems.com.au/ism/ism-0042/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0042.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0042.md","official":{"statement":"System administration processes, and supporting system administration procedures, are developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system management","System administration","System administration processes and procedures"]},"latticework_interpretation":null},{"id":"ISM-0043","url":"https://latticeworksystems.com.au/ism/ism-0043/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0043.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0043.md","official":{"statement":"Systems have a cyber security incident response plan that covers the following:\n\n- guidelines on what constitutes a cyber security incident\n- the types of cyber security incidents likely to be encountered and the expected response to each type\n- how to report cyber security incidents, internally to an organisation and externally to relevant authorities\n- other parties that need to be informed in the event of a cyber security incident\n- the authority, or authorities, responsible for investigating and responding to cyber security incidents\n- the criteria by which an investigation of a cyber security incident would be requested from a law enforcement agency, the Australian Signals Directorate or other relevant authority\n- the steps necessary to ensure the integrity of evidence relating to a cyber security incident\n- system contingency measures or a reference to such details if they are in a separate document.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security documentation","System-specific cyber security documentation","Cyber security incident response plan"]},"latticework_interpretation":null},{"id":"ISM-0047","url":"https://latticeworksystems.com.au/ism/ism-0047/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0047.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0047.md","official":{"statement":"Organisational-level cyber security documentation is approved by the chief information security officer while system-specific cyber security documentation is approved by the system’s authorising officer.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security documentation","Development and maintenance of cyber security documentation","Approval of cyber security documentation"]},"latticework_interpretation":null},{"id":"ISM-0072","url":"https://latticeworksystems.com.au/ism/ism-0072/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0072.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0072.md","official":{"statement":"Security requirements associated with the confidentiality, integrity and availability of data are documented in contractual arrangements with service providers and regularly reviewed to ensure they remain fit for purpose.","statement_format":"OSCAL markup-multiline","revision":"10","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Managed services and cloud services","Contractual security requirements with service providers"]},"latticework_interpretation":null},{"id":"ISM-0078","url":"https://latticeworksystems.com.au/ism/ism-0078/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0078.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0078.md","official":{"statement":"Systems processing, storing or communicating AUSTEO or AGAO data remain at all times under the control of an Australian national working for or on behalf of the Australian Government.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Jun-21","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Control of Australian systems"]},"latticework_interpretation":null},{"id":"ISM-0100","url":"https://latticeworksystems.com.au/ism/ism-0100/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0100.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0100.md","official":{"statement":"Non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET gateways undergo an IRAP assessment, using the latest release of the ISM available prior to the beginning of the IRAP assessment (or a subsequent release), at least every 24 months.","statement_format":"OSCAL markup-multiline","revision":"12","updated":"Mar-25","applicability":["NC","OS","P","S"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Gateways","Assessment of gateways"]},"latticework_interpretation":null},{"id":"ISM-0109","url":"https://latticeworksystems.com.au/ism/ism-0109/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0109.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0109.md","official":{"statement":"Event logs from workstations are analysed in a timely manner to detect cyber security events.","statement_format":"OSCAL markup-multiline","revision":"9","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for security assurance","Security monitoring","Event log monitoring"]},"latticework_interpretation":null},{"id":"ISM-0120","url":"https://latticeworksystems.com.au/ism/ism-0120/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0120.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0120.md","official":{"statement":"Cyber security personnel have access to sufficient tools to facilitate the detection of cyber security events and the identification of cyber security incidents.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for security assurance","Security monitoring","Event log monitoring"]},"latticework_interpretation":null},{"id":"ISM-0123","url":"https://latticeworksystems.com.au/ism/ism-0123/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0123.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0123.md","official":{"statement":"Cyber security incidents are reported to the chief information security officer, or one of their delegates, as soon as possible after they occur or are discovered.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Jun-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for cyber security incidents","Managing cyber security incidents","Reporting cyber security incidents"]},"latticework_interpretation":null},{"id":"ISM-0125","url":"https://latticeworksystems.com.au/ism/ism-0125/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0125.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0125.md","official":{"statement":"A cyber security incident register is developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security incidents","Managing cyber security incidents","Cyber security incident register"]},"latticework_interpretation":null},{"id":"ISM-0133","url":"https://latticeworksystems.com.au/ism/ism-0133/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0133.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0133.md","official":{"statement":"When a data spill occurs, data owners are advised and access to the data is restricted.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Jun-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security incidents","Responding to cyber security incidents","Handling and containing data spills"]},"latticework_interpretation":null},{"id":"ISM-0137","url":"https://latticeworksystems.com.au/ism/ism-0137/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0137.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0137.md","official":{"statement":"Legal advice is sought before allowing intrusion activity to continue on a system for the purpose of collecting further data or evidence.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security incidents","Responding to cyber security incidents","Handling and containing intrusions"]},"latticework_interpretation":null},{"id":"ISM-0138","url":"https://latticeworksystems.com.au/ism/ism-0138/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0138.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0138.md","official":{"statement":"The integrity of evidence gathered during an investigation is maintained by investigators:\n\n- recording all their actions\n- maintaining a proper chain of custody\n- following all instructions provided by relevant law enforcement agencies.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security incidents","Responding to cyber security incidents","Maintaining the integrity of evidence"]},"latticework_interpretation":null},{"id":"ISM-0140","url":"https://latticeworksystems.com.au/ism/ism-0140/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0140.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0140.md","official":{"statement":"Cyber security incidents are reported to ASD as soon as possible after they occur or are discovered.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Sep-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for cyber security incidents","Managing cyber security incidents","Reporting cyber security incidents to ASD"]},"latticework_interpretation":null},{"id":"ISM-0141","url":"https://latticeworksystems.com.au/ism/ism-0141/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0141.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0141.md","official":{"statement":"The requirement for service providers to report cyber security incidents to a designated point of contact as soon as possible after they occur or are discovered is documented in contractual arrangements with service providers.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Managed services and cloud services","Contractual security requirements with service providers"]},"latticework_interpretation":null},{"id":"ISM-0142","url":"https://latticeworksystems.com.au/ism/ism-0142/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0142.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0142.md","official":{"statement":"The compromise or suspected compromise of cryptographic equipment or associated keying material is reported to the chief information security officer, or one of their delegates, as soon as possible after it occurs.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Jun-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic fundamentals","Reporting cryptographic-related cyber security incidents"]},"latticework_interpretation":null},{"id":"ISM-0161","url":"https://latticeworksystems.com.au/ism/ism-0161/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0161.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0161.md","official":{"statement":"IT equipment and media are secured when not in use.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Jun-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for physical security","IT equipment and media","Securing IT equipment and media"]},"latticework_interpretation":null},{"id":"ISM-0164","url":"https://latticeworksystems.com.au/ism/ism-0164/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0164.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0164.md","official":{"statement":"Unauthorised people are prevented from observing systems, in particular workstation displays and keyboards, within facilities.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for physical security","Facilities and systems","Preventing observation by unauthorised people"]},"latticework_interpretation":null},{"id":"ISM-0181","url":"https://latticeworksystems.com.au/ism/ism-0181/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0181.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0181.md","official":{"statement":"Cabling infrastructure is installed in accordance with relevant Australian Standards, as directed by the Australian Communications and Media Authority.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Mar-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Cabling infrastructure standards"]},"latticework_interpretation":null},{"id":"ISM-0187","url":"https://latticeworksystems.com.au/ism/ism-0187/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0187.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0187.md","official":{"statement":"SECRET cables, when bundled together or run in conduit, are run exclusively in their own individual cable bundle or conduit.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Mar-23","applicability":["S"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Common cable bundles and conduits"]},"latticework_interpretation":null},{"id":"ISM-0194","url":"https://latticeworksystems.com.au/ism/ism-0194/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0194.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0194.md","official":{"statement":"In shared facilities, a visible smear of conduit glue is used to seal all plastic conduit joints and TOP SECRET conduits connected by threaded lock nuts.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-21","applicability":["TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Sealing cable reticulation systems and conduits"]},"latticework_interpretation":null},{"id":"ISM-0195","url":"https://latticeworksystems.com.au/ism/ism-0195/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0195.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0195.md","official":{"statement":"In shared facilities, uniquely identifiable SCEC-approved tamper-evident seals are used to seal all removable covers on TOP SECRET cable reticulation systems.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Jun-22","applicability":["TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Sealing cable reticulation systems and conduits"]},"latticework_interpretation":null},{"id":"ISM-0198","url":"https://latticeworksystems.com.au/ism/ism-0198/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0198.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0198.md","official":{"statement":"When penetrating a TOP SECRET audio secure room, the Australian Security Intelligence Organisation is consulted and all directions provided are complied with.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-21","applicability":["TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Audio secure rooms"]},"latticework_interpretation":null},{"id":"ISM-0201","url":"https://latticeworksystems.com.au/ism/ism-0201/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0201.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0201.md","official":{"statement":"Labels for TOP SECRET conduits are a minimum size of 2.5 cm x 1 cm, attached at five-metre intervals and marked as ‘TS RUN’.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Mar-21","applicability":["TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Labelling conduits"]},"latticework_interpretation":null},{"id":"ISM-0206","url":"https://latticeworksystems.com.au/ism/ism-0206/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0206.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0206.md","official":{"statement":"Cable labelling processes, and supporting cable labelling procedures, are developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Cable labelling processes and procedures"]},"latticework_interpretation":null},{"id":"ISM-0208","url":"https://latticeworksystems.com.au/ism/ism-0208/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0208.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0208.md","official":{"statement":"A cable register contains the following for each cable:\n\n- cable identifier\n- cable colour\n- sensitivity/classification\n- source\n- destination\n- location\n- seal numbers (if applicable).","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Jun-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Cable register"]},"latticework_interpretation":null},{"id":"ISM-0211","url":"https://latticeworksystems.com.au/ism/ism-0211/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0211.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0211.md","official":{"statement":"A cable register is developed, implemented, maintained and regularly verified.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Cable register"]},"latticework_interpretation":null},{"id":"ISM-0213","url":"https://latticeworksystems.com.au/ism/ism-0213/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0213.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0213.md","official":{"statement":"SECRET and TOP SECRET cables are terminated on their own individual patch panels.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Mar-23","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Terminating cables on patch panels"]},"latticework_interpretation":null},{"id":"ISM-0216","url":"https://latticeworksystems.com.au/ism/ism-0216/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0216.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0216.md","official":{"statement":"TOP SECRET patch panels are installed in individual TOP SECRET cabinets.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Mar-23","applicability":["TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Physical separation of cabinets and patch panels"]},"latticework_interpretation":null},{"id":"ISM-0217","url":"https://latticeworksystems.com.au/ism/ism-0217/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0217.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0217.md","official":{"statement":"Where spatial constraints demand non-TOP SECRET patch panels be installed in the same cabinet as a TOP SECRET patch panel:\n\n- a physical barrier in the cabinet is provided to separate patch panels\n- only personnel holding a Positive Vetting security clearance have access to the cabinet\n- approval from the TOP SECRET system’s authorising officer is obtained prior to installation.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Mar-23","applicability":["TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Physical separation of cabinets and patch panels"]},"latticework_interpretation":null},{"id":"ISM-0218","url":"https://latticeworksystems.com.au/ism/ism-0218/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0218.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0218.md","official":{"statement":"If TOP SECRET fibre-optic fly leads exceeding five metres in length are used to connect wall outlet boxes to IT equipment, they are run in a protective and easily inspected pathway that is clearly labelled at the IT equipment end with the wall outlet box’s identifier.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Jun-24","applicability":["TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Fly lead installation"]},"latticework_interpretation":null},{"id":"ISM-0225","url":"https://latticeworksystems.com.au/ism/ism-0225/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0225.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0225.md","official":{"statement":"Unauthorised RF and IR devices are not brought into SECRET and TOP SECRET areas.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Sep-21","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for physical security","Facilities and systems","Bringing radio frequency and infrared devices into facilities"]},"latticework_interpretation":null},{"id":"ISM-0229","url":"https://latticeworksystems.com.au/ism/ism-0229/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0229.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0229.md","official":{"statement":"Personnel are advised of the permitted sensitivity or classification of information that can be discussed over internal and external telephone systems.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Jun-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Telephone systems","Personnel awareness"]},"latticework_interpretation":null},{"id":"ISM-0230","url":"https://latticeworksystems.com.au/ism/ism-0230/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0230.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0230.md","official":{"statement":"Personnel are advised of security risks posed by non-secure telephone systems in areas where sensitive or classified conversations can occur.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Sep-18","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Telephone systems","Personnel awareness"]},"latticework_interpretation":null},{"id":"ISM-0231","url":"https://latticeworksystems.com.au/ism/ism-0231/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0231.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0231.md","official":{"statement":"When using cryptographic equipment to permit different levels of conversation for different kinds of connections, telephone systems give a visual indication of what kind of connection has been made.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Telephone systems","Personnel awareness"]},"latticework_interpretation":null},{"id":"ISM-0232","url":"https://latticeworksystems.com.au/ism/ism-0232/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0232.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0232.md","official":{"statement":"Telephone systems used for sensitive or classified conversations encrypt all traffic that passes over external systems.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Sep-18","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Telephone systems","Protecting conversations"]},"latticework_interpretation":null},{"id":"ISM-0233","url":"https://latticeworksystems.com.au/ism/ism-0233/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0233.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0233.md","official":{"statement":"Cordless telephone handsets and headsets are not used for sensitive or classified conversations unless all communications are encrypted using ASD-approved cryptography.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Telephone systems","Cordless telephone systems"]},"latticework_interpretation":null},{"id":"ISM-0235","url":"https://latticeworksystems.com.au/ism/ism-0235/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0235.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0235.md","official":{"statement":"Speakerphones are not used on telephone systems in TOP SECRET areas unless the telephone system is located in an audio secure room, the room is audio secure during conversations and only personnel involved in conversations are present in the room.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Telephone systems","Speakerphones"]},"latticework_interpretation":null},{"id":"ISM-0236","url":"https://latticeworksystems.com.au/ism/ism-0236/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0236.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0236.md","official":{"statement":"Off-hook audio protection features are used on telephone systems in areas where background conversations may exceed the sensitivity or classification that the telephone system is authorised for communicating.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Telephone systems","Off-hook audio protection"]},"latticework_interpretation":null},{"id":"ISM-0240","url":"https://latticeworksystems.com.au/ism/ism-0240/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0240.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0240.md","official":{"statement":"Paging, Multimedia Message Service, Short Message Service and messaging apps are not used to communicate sensitive or classified data.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device usage","Using paging, message services and messaging apps"]},"latticework_interpretation":null},{"id":"ISM-0245","url":"https://latticeworksystems.com.au/ism/ism-0245/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0245.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0245.md","official":{"statement":"MFDs are not connected to digital telephone systems.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Multifunction devices","Connecting multifunction devices to digital telephone systems"]},"latticework_interpretation":null},{"id":"ISM-0246","url":"https://latticeworksystems.com.au/ism/ism-0246/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0246.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0246.md","official":{"statement":"When an emanation security risk assessment is required, it is sought as early as possible in a system’s life cycle.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Mar-26","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Emanation security","Emanation security risk assessments"]},"latticework_interpretation":null},{"id":"ISM-0249","url":"https://latticeworksystems.com.au/ism/ism-0249/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0249.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0249.md","official":{"statement":"System owners deploying SECRET or TOP SECRET systems in mobile platforms, or as a deployable capability, contact ASD for an emanation security risk assessment.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Mar-26","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Emanation security","Emanation security risk assessments"]},"latticework_interpretation":null},{"id":"ISM-0250","url":"https://latticeworksystems.com.au/ism/ism-0250/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0250.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0250.md","official":{"statement":"IT equipment meets industry and government standards relating to electromagnetic interference/electromagnetic compatibility.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Jun-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Emanation security","Electromagnetic interference/electromagnetic compatibility standards"]},"latticework_interpretation":null},{"id":"ISM-0252","url":"https://latticeworksystems.com.au/ism/ism-0252/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0252.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0252.md","official":{"statement":"Cyber security awareness training is undertaken annually by all personnel and covers:\n\n- the purpose of the cyber security awareness training\n- security appointments and contacts\n- authorised use of systems and their resources\n- protection of systems and their resources\n- reporting of cyber security incidents and suspected compromises of systems and their resources.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for personnel security","Cyber security awareness training","Providing cyber security awareness training"]},"latticework_interpretation":null},{"id":"ISM-0258","url":"https://latticeworksystems.com.au/ism/ism-0258/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0258.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0258.md","official":{"statement":"A web usage policy is developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for personnel security","Cyber security awareness training","Web usage policy"]},"latticework_interpretation":null},{"id":"ISM-0260","url":"https://latticeworksystems.com.au/ism/ism-0260/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0260.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0260.md","official":{"statement":"All web access, including that by internal servers, is conducted through web proxies.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Web proxies","Using web proxies"]},"latticework_interpretation":null},{"id":"ISM-0261","url":"https://latticeworksystems.com.au/ism/ism-0261/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0261.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0261.md","official":{"statement":"The following details are centrally logged for websites accessed via web proxies:\n\n- web address\n- date and time\n- user\n- amount of data uploaded and downloaded\n- internal and external IP addresses.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Web proxies","Web proxy event logging"]},"latticework_interpretation":null},{"id":"ISM-0263","url":"https://latticeworksystems.com.au/ism/ism-0263/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0263.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0263.md","official":{"statement":"TLS traffic communicated through gateways is decrypted and inspected.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Web content filters","Transport Layer Security filtering"]},"latticework_interpretation":null},{"id":"ISM-0264","url":"https://latticeworksystems.com.au/ism/ism-0264/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0264.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0264.md","official":{"statement":"An email usage policy is developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for email","Email usage","Email usage policy"]},"latticework_interpretation":null},{"id":"ISM-0267","url":"https://latticeworksystems.com.au/ism/ism-0267/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0267.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0267.md","official":{"statement":"Access to non-approved webmail services is blocked.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Mar-19","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for email","Email usage","Webmail services"]},"latticework_interpretation":null},{"id":"ISM-0269","url":"https://latticeworksystems.com.au/ism/ism-0269/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0269.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0269.md","official":{"statement":"Emails containing Australian Eyes Only, Australian Government Access Only or Releasable To data are not sent to email distribution lists unless the nationality of all members of email distribution lists can be confirmed.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Mar-22","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for email","Email usage","Email distribution lists"]},"latticework_interpretation":null},{"id":"ISM-0270","url":"https://latticeworksystems.com.au/ism/ism-0270/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0270.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0270.md","official":{"statement":"Protective markings are applied to emails and reflect the highest sensitivity or classification of the subject, body and attachments.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Jun-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for email","Email usage","Protective markings for emails"]},"latticework_interpretation":null},{"id":"ISM-0271","url":"https://latticeworksystems.com.au/ism/ism-0271/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0271.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0271.md","official":{"statement":"Protective marking tools do not automatically insert protective markings into emails.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Mar-19","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for email","Email usage","Protective marking tools"]},"latticework_interpretation":null},{"id":"ISM-0272","url":"https://latticeworksystems.com.au/ism/ism-0272/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0272.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0272.md","official":{"statement":"Protective marking tools do not allow the selection of protective markings that a system has not been authorised to process, store or communicate.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for email","Email usage","Protective marking tools"]},"latticework_interpretation":null},{"id":"ISM-0280","url":"https://latticeworksystems.com.au/ism/ism-0280/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0280.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0280.md","official":{"statement":"If procuring an evaluated product, a product that has completed a PP-based evaluation, including against all applicable PP modules (as well as a software bill of materials assessment if applicable), is selected in preference to one that has completed an EAL-based evaluation.","statement_format":"OSCAL markup-multiline","revision":"9","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for evaluated products","Evaluated product procurement","Evaluated product selection"]},"latticework_interpretation":null},{"id":"ISM-0285","url":"https://latticeworksystems.com.au/ism/ism-0285/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0285.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0285.md","official":{"statement":"Evaluated products are delivered in a manner consistent with any delivery procedures defined in associated evaluation documentation.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-18","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for evaluated products","Evaluated product procurement","Delivery of evaluated products"]},"latticework_interpretation":null},{"id":"ISM-0286","url":"https://latticeworksystems.com.au/ism/ism-0286/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0286.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0286.md","official":{"statement":"When procuring high assurance information technology (IT) equipment, ASD is contacted for any equipment-specific delivery procedures.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Jun-24","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for evaluated products","Evaluated product procurement","Delivery of evaluated products"]},"latticework_interpretation":null},{"id":"ISM-0289","url":"https://latticeworksystems.com.au/ism/ism-0289/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0289.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0289.md","official":{"statement":"Evaluated products are installed, configured, administered and operated in an evaluated configuration and in accordance with vendor guidance.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for evaluated products","Evaluated product usage","Using evaluated products"]},"latticework_interpretation":null},{"id":"ISM-0290","url":"https://latticeworksystems.com.au/ism/ism-0290/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0290.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0290.md","official":{"statement":"High assurance IT equipment is installed, configured, administered and operated in an evaluated configuration and in accordance with ASD guidance.","statement_format":"OSCAL markup-multiline","revision":"9","updated":"Jun-24","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for evaluated products","Evaluated product usage","Using evaluated products"]},"latticework_interpretation":null},{"id":"ISM-0293","url":"https://latticeworksystems.com.au/ism/ism-0293/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0293.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0293.md","official":{"statement":"IT equipment is classified based on the highest sensitivity or classification of data that it is approved for processing, storing or communicating.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Jun-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment usage","Classifying IT equipment"]},"latticework_interpretation":null},{"id":"ISM-0294","url":"https://latticeworksystems.com.au/ism/ism-0294/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0294.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0294.md","official":{"statement":"IT equipment, except for high assurance IT equipment, is labelled with protective markings reflecting its sensitivity or classification.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment usage","Labelling IT equipment"]},"latticework_interpretation":null},{"id":"ISM-0296","url":"https://latticeworksystems.com.au/ism/ism-0296/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0296.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0296.md","official":{"statement":"ASD’s approval is sought before applying labels to external surfaces of high assurance IT equipment.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Jun-24","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment usage","Labelling high assurance IT equipment"]},"latticework_interpretation":null},{"id":"ISM-0298","url":"https://latticeworksystems.com.au/ism/ism-0298/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0298.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0298.md","official":{"statement":"A centralised and managed approach that maintains the integrity of patches or updates, and confirms that they have been applied successfully, is used to patch or update applications, operating systems, drivers and firmware.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system management","System maintenance","Patch management processes and procedures"]},"latticework_interpretation":null},{"id":"ISM-0300","url":"https://latticeworksystems.com.au/ism/ism-0300/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0300.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0300.md","official":{"statement":"Patches, updates or other vendor mitigations for vulnerabilities in high assurance IT equipment are applied only when approved by ASD, and in doing so, using methods and timeframes prescribed by ASD.","statement_format":"OSCAL markup-multiline","revision":"10","updated":"Jun-24","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system management","System maintenance","Mitigating known vulnerabilities"]},"latticework_interpretation":null},{"id":"ISM-0304","url":"https://latticeworksystems.com.au/ism/ism-0304/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0304.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0304.md","official":{"statement":"Applications other than office productivity suites, web browsers and their extensions, email clients, PDF applications, Adobe Flash Player, and security products that are no longer supported by vendors are removed.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system management","System maintenance","Cessation of support"]},"latticework_interpretation":null},{"id":"ISM-0305","url":"https://latticeworksystems.com.au/ism/ism-0305/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0305.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0305.md","official":{"statement":"Maintenance or repairs of IT equipment are carried out on site by an appropriately cleared technician.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment maintenance or repairs","On-site maintenance or repairs"]},"latticework_interpretation":null},{"id":"ISM-0306","url":"https://latticeworksystems.com.au/ism/ism-0306/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0306.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0306.md","official":{"statement":"If an appropriately cleared technician is not used to undertake maintenance or repairs to IT equipment, the technician is escorted by someone who:\n\n- has the authority to direct the technician\n- is appropriately cleared and briefed\n- is sufficiently familiar with the IT equipment to understand the work being undertaken\n- takes all responsible measures to ensure the integrity of the IT equipment\n- takes due care to ensure that data is not disclosed.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment maintenance or repairs","On-site maintenance or repairs"]},"latticework_interpretation":null},{"id":"ISM-0307","url":"https://latticeworksystems.com.au/ism/ism-0307/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0307.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0307.md","official":{"statement":"If an appropriately cleared technician is not used to undertake maintenance or repairs to IT equipment, the IT equipment and associated media are sanitised before maintenance or repairs.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment maintenance or repairs","On-site maintenance or repairs"]},"latticework_interpretation":null},{"id":"ISM-0310","url":"https://latticeworksystems.com.au/ism/ism-0310/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0310.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0310.md","official":{"statement":"IT equipment maintained or repaired off site is handled at facilities approved for handling the sensitivity or classification of the IT equipment.","statement_format":"OSCAL markup-multiline","revision":"9","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment maintenance or repairs","Off-site maintenance or repairs"]},"latticework_interpretation":null},{"id":"ISM-0311","url":"https://latticeworksystems.com.au/ism/ism-0311/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0311.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0311.md","official":{"statement":"IT equipment containing media is sanitised by removing the media from the IT equipment or by sanitising the media in situ.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Jun-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment sanitisation and destruction","Sanitising IT equipment"]},"latticework_interpretation":null},{"id":"ISM-0312","url":"https://latticeworksystems.com.au/ism/ism-0312/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0312.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0312.md","official":{"statement":"IT equipment, including associated media, that is located overseas and has processed, stored or communicated AUSTEO or AGAO data that cannot be sanitised in situ, is returned to Australia for destruction.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Jun-24","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment sanitisation and destruction","Sanitising highly sensitive IT equipment"]},"latticework_interpretation":null},{"id":"ISM-0313","url":"https://latticeworksystems.com.au/ism/ism-0313/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0313.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0313.md","official":{"statement":"IT equipment sanitisation processes, and supporting IT equipment sanitisation procedures, are developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Jun-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment sanitisation and destruction","IT equipment sanitisation processes and procedures"]},"latticework_interpretation":null},{"id":"ISM-0315","url":"https://latticeworksystems.com.au/ism/ism-0315/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0315.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0315.md","official":{"statement":"High assurance IT equipment is destroyed prior to its disposal.","statement_format":"OSCAL markup-multiline","revision":"9","updated":"Jun-24","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment sanitisation and destruction","Destroying high assurance IT equipment"]},"latticework_interpretation":null},{"id":"ISM-0316","url":"https://latticeworksystems.com.au/ism/ism-0316/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0316.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0316.md","official":{"statement":"Following sanitisation, destruction or declassification, a formal administrative decision is made to release IT equipment, or its waste, into the public domain.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Jun-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment disposal","Disposal of IT equipment"]},"latticework_interpretation":null},{"id":"ISM-0317","url":"https://latticeworksystems.com.au/ism/ism-0317/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0317.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0317.md","official":{"statement":"At least three pages of random text with no blank areas are printed on each colour printer cartridge or MFD print drum.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Sep-18","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment sanitisation and destruction","Sanitising printers and multifunction devices"]},"latticework_interpretation":null},{"id":"ISM-0318","url":"https://latticeworksystems.com.au/ism/ism-0318/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0318.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0318.md","official":{"statement":"When unable to sanitise printer cartridges or MFD print drums, they are destroyed as per electrostatic memory devices.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Sep-18","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment sanitisation and destruction","Sanitising printers and multifunction devices"]},"latticework_interpretation":null},{"id":"ISM-0321","url":"https://latticeworksystems.com.au/ism/ism-0321/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0321.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0321.md","official":{"statement":"When disposing of IT equipment that has been designed or modified to meet emanation security standards, ASD is contacted for requirements relating to its disposal.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Jun-24","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment disposal","Disposal of IT equipment"]},"latticework_interpretation":null},{"id":"ISM-0323","url":"https://latticeworksystems.com.au/ism/ism-0323/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0323.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0323.md","official":{"statement":"Media is classified to the highest sensitivity or classification of data it stores, unless the media has been classified to a higher sensitivity or classification.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media usage","Classifying media"]},"latticework_interpretation":null},{"id":"ISM-0325","url":"https://latticeworksystems.com.au/ism/ism-0325/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0325.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0325.md","official":{"statement":"Any media connected to a system with a higher sensitivity or classification than the media is reclassified to the higher sensitivity or classification, unless the media is read-only or the system has a mechanism through which read-only access can be ensured.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Apr-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media usage","Reclassifying media"]},"latticework_interpretation":null},{"id":"ISM-0330","url":"https://latticeworksystems.com.au/ism/ism-0330/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0330.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0330.md","official":{"statement":"Before reclassifying media to a lower sensitivity or classification, the media is sanitised or destroyed, and a formal administrative decision is made to reclassify it.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media usage","Reclassifying media"]},"latticework_interpretation":null},{"id":"ISM-0332","url":"https://latticeworksystems.com.au/ism/ism-0332/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0332.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0332.md","official":{"statement":"Media, except for internally mounted fixed media within information technology equipment, is labelled with protective markings reflecting its sensitivity or classification.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media usage","Labelling media"]},"latticework_interpretation":null},{"id":"ISM-0336","url":"https://latticeworksystems.com.au/ism/ism-0336/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0336.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0336.md","official":{"statement":"A networked IT equipment register is developed, implemented, maintained and regularly verified.","statement_format":"OSCAL markup-multiline","revision":"10","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment usage","IT equipment registers"]},"latticework_interpretation":null},{"id":"ISM-0337","url":"https://latticeworksystems.com.au/ism/ism-0337/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0337.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0337.md","official":{"statement":"Media is only used with systems that are authorised to process, store or communicate its sensitivity or classification.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media usage","Classifying media"]},"latticework_interpretation":null},{"id":"ISM-0341","url":"https://latticeworksystems.com.au/ism/ism-0341/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0341.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0341.md","official":{"statement":"Automatic execution features for removable media are disabled.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Hardening operating system configurations"]},"latticework_interpretation":null},{"id":"ISM-0343","url":"https://latticeworksystems.com.au/ism/ism-0343/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0343.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0343.md","official":{"statement":"If there is no business requirement for writing to removable media and devices, such functionality is disabled via the use of a device access control application or by disabling external communication interfaces.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Device access control"]},"latticework_interpretation":null},{"id":"ISM-0345","url":"https://latticeworksystems.com.au/ism/ism-0345/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0345.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0345.md","official":{"statement":"External communication interfaces that allow DMA are disabled.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Device access control"]},"latticework_interpretation":null},{"id":"ISM-0347","url":"https://latticeworksystems.com.au/ism/ism-0347/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0347.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0347.md","official":{"statement":"When transferring data manually between two systems belonging to different security domains, write-once media is used unless the destination system has a mechanism through which read-only access can be ensured.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Apr-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media usage","Using media for data transfers"]},"latticework_interpretation":null},{"id":"ISM-0348","url":"https://latticeworksystems.com.au/ism/ism-0348/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0348.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0348.md","official":{"statement":"Media sanitisation processes, and supporting media sanitisation procedures, are developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media sanitisation","Media sanitisation processes and procedures"]},"latticework_interpretation":null},{"id":"ISM-0350","url":"https://latticeworksystems.com.au/ism/ism-0350/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0350.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0350.md","official":{"statement":"The following media types are destroyed prior to their disposal:\n\n- microfiche and microfilm\n- optical discs\n- programmable read-only memory\n- read-only memory\n- other types of media that cannot be sanitised.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media destruction","Media that cannot be sanitised"]},"latticework_interpretation":null},{"id":"ISM-0351","url":"https://latticeworksystems.com.au/ism/ism-0351/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0351.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0351.md","official":{"statement":"Volatile media is sanitised by removing its power for at least 10 minutes.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media sanitisation","Volatile media sanitisation"]},"latticework_interpretation":null},{"id":"ISM-0352","url":"https://latticeworksystems.com.au/ism/ism-0352/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0352.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0352.md","official":{"statement":"SECRET and TOP SECRET volatile media is sanitised by overwriting it at least once in its entirety with a random pattern followed by a read back for verification.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-21","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media sanitisation","Volatile media sanitisation"]},"latticework_interpretation":null},{"id":"ISM-0354","url":"https://latticeworksystems.com.au/ism/ism-0354/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0354.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0354.md","official":{"statement":"Non-volatile magnetic media is sanitised by overwriting it at least once (or three times if pre-2001 or under 15 GB) in its entirety with a random pattern followed by a read back for verification.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media sanitisation","Non-volatile magnetic media sanitisation"]},"latticework_interpretation":null},{"id":"ISM-0356","url":"https://latticeworksystems.com.au/ism/ism-0356/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0356.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0356.md","official":{"statement":"Following sanitisation, SECRET and TOP SECRET non-volatile magnetic media retains its classification.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-21","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media sanitisation","Treatment of non-volatile magnetic media following sanitisation"]},"latticework_interpretation":null},{"id":"ISM-0357","url":"https://latticeworksystems.com.au/ism/ism-0357/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0357.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0357.md","official":{"statement":"Non-volatile EPROM media is sanitised by applying three times the manufacturer’s specified ultraviolet erasure time and then overwriting it at least once in its entirety with a random pattern followed by a read back for verification.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media sanitisation","Non-volatile erasable programmable read-only memory media sanitisation"]},"latticework_interpretation":null},{"id":"ISM-0358","url":"https://latticeworksystems.com.au/ism/ism-0358/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0358.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0358.md","official":{"statement":"Following sanitisation, SECRET and TOP SECRET non-volatile EPROM and EEPROM media retains its classification.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-21","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media sanitisation","Treatment of non-volatile erasable and electrically erasable programmable read-only memory media following sanitisation"]},"latticework_interpretation":null},{"id":"ISM-0359","url":"https://latticeworksystems.com.au/ism/ism-0359/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0359.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0359.md","official":{"statement":"Non-volatile flash memory media is sanitised by overwriting it at least twice in its entirety with a random pattern followed by a read back for verification.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media sanitisation","Non-volatile flash memory media sanitisation"]},"latticework_interpretation":null},{"id":"ISM-0360","url":"https://latticeworksystems.com.au/ism/ism-0360/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0360.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0360.md","official":{"statement":"Following sanitisation, SECRET and TOP SECRET non-volatile flash memory media retains its classification.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-21","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media sanitisation","Treatment of non-volatile flash memory media following sanitisation"]},"latticework_interpretation":null},{"id":"ISM-0361","url":"https://latticeworksystems.com.au/ism/ism-0361/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0361.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0361.md","official":{"statement":"Magnetic media is destroyed using a degausser with a suitable magnetic field strength and magnetic orientation.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media destruction","Degaussing magnetic media"]},"latticework_interpretation":null},{"id":"ISM-0362","url":"https://latticeworksystems.com.au/ism/ism-0362/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0362.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0362.md","official":{"statement":"Product-specific directions provided by degausser manufacturers are followed.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media destruction","Degaussing magnetic media"]},"latticework_interpretation":null},{"id":"ISM-0363","url":"https://latticeworksystems.com.au/ism/ism-0363/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0363.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0363.md","official":{"statement":"Media destruction processes, and supporting media destruction procedures, are developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media destruction","Media destruction processes and procedures"]},"latticework_interpretation":null},{"id":"ISM-0368","url":"https://latticeworksystems.com.au/ism/ism-0368/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0368.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0368.md","official":{"statement":"Media destroyed using a hammer mill, disintegrator, grinder/sander or by cutting results in media waste particles no larger than 9 mm.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media destruction","Media destruction methods"]},"latticework_interpretation":null},{"id":"ISM-0370","url":"https://latticeworksystems.com.au/ism/ism-0370/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0370.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0370.md","official":{"statement":"The destruction of media is performed under the supervision of at least one cleared person.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Sep-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media destruction","Supervision of destruction"]},"latticework_interpretation":null},{"id":"ISM-0371","url":"https://latticeworksystems.com.au/ism/ism-0371/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0371.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0371.md","official":{"statement":"Personnel supervising the destruction of media supervise its handling to the point of destruction and ensure that the destruction is completed successfully.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media destruction","Supervision of destruction"]},"latticework_interpretation":null},{"id":"ISM-0372","url":"https://latticeworksystems.com.au/ism/ism-0372/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0372.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0372.md","official":{"statement":"The destruction of media storing accountable material is performed under the supervision of at least two cleared personnel.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Sep-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media destruction","Supervision of accountable material destruction"]},"latticework_interpretation":null},{"id":"ISM-0373","url":"https://latticeworksystems.com.au/ism/ism-0373/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0373.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0373.md","official":{"statement":"Personnel supervising the destruction of media storing accountable material supervise its handling to the point of destruction, ensure that the destruction is completed successfully and sign a destruction certificate afterwards.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media destruction","Supervision of accountable material destruction"]},"latticework_interpretation":null},{"id":"ISM-0374","url":"https://latticeworksystems.com.au/ism/ism-0374/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0374.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0374.md","official":{"statement":"Media disposal processes, and supporting media disposal procedures, are developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media disposal","Media disposal processes and procedures"]},"latticework_interpretation":null},{"id":"ISM-0375","url":"https://latticeworksystems.com.au/ism/ism-0375/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0375.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0375.md","official":{"statement":"Following sanitisation, destruction or declassification, a formal administrative decision is made to release media, or its waste, into the public domain.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media disposal","Disposal of media"]},"latticework_interpretation":null},{"id":"ISM-0378","url":"https://latticeworksystems.com.au/ism/ism-0378/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0378.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0378.md","official":{"statement":"Labels and markings indicating the owner, sensitivity, classification or any other marking that can associate media with its prior use are removed prior to its disposal.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media disposal","Disposal of media"]},"latticework_interpretation":null},{"id":"ISM-0380","url":"https://latticeworksystems.com.au/ism/ism-0380/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0380.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0380.md","official":{"statement":"Unneeded user accounts, components, services and functionality of operating systems are disabled or removed.","statement_format":"OSCAL markup-multiline","revision":"10","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Hardening operating system configurations"]},"latticework_interpretation":null},{"id":"ISM-0382","url":"https://latticeworksystems.com.au/ism/ism-0382/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0382.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0382.md","official":{"statement":"Unprivileged human users do not have the ability to uninstall or disable approved applications.","statement_format":"OSCAL markup-multiline","revision":"9","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Application management"]},"latticework_interpretation":null},{"id":"ISM-0383","url":"https://latticeworksystems.com.au/ism/ism-0383/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0383.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0383.md","official":{"statement":"Default user accounts or credentials for operating systems, including for any pre-configured user accounts, are changed, disabled or removed during initial setup.","statement_format":"OSCAL markup-multiline","revision":"11","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Hardening operating system configurations"]},"latticework_interpretation":null},{"id":"ISM-0385","url":"https://latticeworksystems.com.au/ism/ism-0385/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0385.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0385.md","official":{"statement":"Servers maintain effective functional separation from each other.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Functional separation between servers"]},"latticework_interpretation":null},{"id":"ISM-0393","url":"https://latticeworksystems.com.au/ism/ism-0393/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0393.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0393.md","official":{"statement":"Databases and their contents are classified based on the sensitivity or classification of data that they contain.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Jun-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for database systems","Databases","Protecting database contents"]},"latticework_interpretation":null},{"id":"ISM-0400","url":"https://latticeworksystems.com.au/ism/ism-0400/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0400.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0400.md","official":{"statement":"Development, testing, staging and production environments are segregated.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Mar-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Development, testing, staging and production environments"]},"latticework_interpretation":null},{"id":"ISM-0401","url":"https://latticeworksystems.com.au/ism/ism-0401/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0401.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0401.md","official":{"statement":"Secure by Design principles and practices are followed throughout the software development life cycle.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Secure software development"]},"latticework_interpretation":null},{"id":"ISM-0402","url":"https://latticeworksystems.com.au/ism/ism-0402/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0402.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0402.md","official":{"statement":"Software is comprehensively tested for vulnerabilities using SAST, DAST and SCA prior to its initial release, any subsequent release, and periodically to help identify any previously unidentified vulnerabilities.","statement_format":"OSCAL markup-multiline","revision":"10","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Software security testing"]},"latticework_interpretation":null},{"id":"ISM-0405","url":"https://latticeworksystems.com.au/ism/ism-0405/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0405.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0405.md","official":{"statement":"Requests for unprivileged access to systems and their resources are validated when first requested.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Unprivileged access to systems"]},"latticework_interpretation":null},{"id":"ISM-0407","url":"https://latticeworksystems.com.au/ism/ism-0407/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0407.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0407.md","official":{"statement":"A secure record is maintained for the life of systems and their resources that covers the following for each human user:\n\n- their unique identifier\n- their signed agreement to abide by system usage policies\n- who authorised their access\n- when their access was granted\n- the level of access they were granted\n- when their access, and their level of access, was last reviewed\n- when their level of access was changed, and to what extent (if applicable)\n- when their access was withdrawn (if applicable).","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Recording authorisation for personnel to access systems"]},"latticework_interpretation":null},{"id":"ISM-0408","url":"https://latticeworksystems.com.au/ism/ism-0408/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0408.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0408.md","official":{"statement":"Systems have a logon banner that reminds personnel of their security responsibilities when accessing the system and its resources.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","System access requirements"]},"latticework_interpretation":null},{"id":"ISM-0409","url":"https://latticeworksystems.com.au/ism/ism-0409/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0409.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0409.md","official":{"statement":"Foreign nationals, including seconded foreign nationals, do not have access to systems that process, store or communicate AUSTEO or REL data unless effective security controls are in place to ensure such data is not accessible to them.","statement_format":"OSCAL markup-multiline","revision":"9","updated":"Sep-26","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Unprivileged access to systems by foreign nationals"]},"latticework_interpretation":null},{"id":"ISM-0411","url":"https://latticeworksystems.com.au/ism/ism-0411/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0411.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0411.md","official":{"statement":"Foreign nationals, excluding seconded foreign nationals, do not have access to systems that process, store or communicate AGAO data unless effective security controls are in place to ensure such data is not accessible to them.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Sep-26","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Unprivileged access to systems by foreign nationals"]},"latticework_interpretation":null},{"id":"ISM-0414","url":"https://latticeworksystems.com.au/ism/ism-0414/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0414.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0414.md","official":{"statement":"Users granted access to systems and their resources are uniquely identifiable.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","User identification"]},"latticework_interpretation":null},{"id":"ISM-0415","url":"https://latticeworksystems.com.au/ism/ism-0415/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0415.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0415.md","official":{"statement":"The use of shared user accounts is strictly controlled, and users of such accounts are uniquely identifiable.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","User identification"]},"latticework_interpretation":null},{"id":"ISM-0417","url":"https://latticeworksystems.com.au/ism/ism-0417/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0417.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0417.md","official":{"statement":"When systems cannot support multi-factor authentication, single-factor authentication using passwords is implemented instead.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Single-factor authentication"]},"latticework_interpretation":null},{"id":"ISM-0418","url":"https://latticeworksystems.com.au/ism/ism-0418/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0418.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0418.md","official":{"statement":"Physical credentials are kept separate from systems they are used to authenticate to, except for when performing authentication activities.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Protecting credentials"]},"latticework_interpretation":null},{"id":"ISM-0420","url":"https://latticeworksystems.com.au/ism/ism-0420/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0420.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0420.md","official":{"statement":"Where systems process, store or communicate AUSTEO, AGAO or REL data, personnel who are foreign nationals are identified as such, including by their specific nationality.","statement_format":"OSCAL markup-multiline","revision":"12","updated":"Jun-25","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","User identification"]},"latticework_interpretation":null},{"id":"ISM-0421","url":"https://latticeworksystems.com.au/ism/ism-0421/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0421.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0421.md","official":{"statement":"Passwords used for single-factor authentication on non-classified, OFFICIAL: Sensitive and PROTECTED systems are a minimum of 15 characters.","statement_format":"OSCAL markup-multiline","revision":"11","updated":"Dec-25","applicability":["NC","OS","P"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Password strength"]},"latticework_interpretation":null},{"id":"ISM-0422","url":"https://latticeworksystems.com.au/ism/ism-0422/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0422.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0422.md","official":{"statement":"Passwords used for single-factor authentication on TOP SECRET systems are a minimum of 20 characters.","statement_format":"OSCAL markup-multiline","revision":"9","updated":"Dec-25","applicability":["TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Password strength"]},"latticework_interpretation":null},{"id":"ISM-0428","url":"https://latticeworksystems.com.au/ism/ism-0428/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0428.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0428.md","official":{"statement":"Services are configured with a session lock that:\n\n- activates after a maximum of 15 minutes of human user inactivity, a maximum of 12 hours of overall session time or when manually activated\n- blocks access to all session content\n- requires re-authentication by human users using all authentication factors to unlock the session\n- denies human users the ability to disable the session locking mechanism.","statement_format":"OSCAL markup-multiline","revision":"11","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Session locking"]},"latticework_interpretation":null},{"id":"ISM-0430","url":"https://latticeworksystems.com.au/ism/ism-0430/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0430.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0430.md","official":{"statement":"Access to systems and their resources are removed or suspended the same day users no longer have a legitimate requirement for access.","statement_format":"OSCAL markup-multiline","revision":"9","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Suspension of access to systems"]},"latticework_interpretation":null},{"id":"ISM-0432","url":"https://latticeworksystems.com.au/ism/ism-0432/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0432.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0432.md","official":{"statement":"Access requirements for systems and their resources are documented in their system security plan.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","System access requirements"]},"latticework_interpretation":null},{"id":"ISM-0434","url":"https://latticeworksystems.com.au/ism/ism-0434/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0434.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0434.md","official":{"statement":"Personnel undergo appropriate employment screening and, where necessary, hold an appropriate security clearance before being granted access to systems and their resources.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","System access requirements"]},"latticework_interpretation":null},{"id":"ISM-0435","url":"https://latticeworksystems.com.au/ism/ism-0435/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0435.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0435.md","official":{"statement":"Personnel receive any necessary briefings before being granted access to systems and their resources.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","System access requirements"]},"latticework_interpretation":null},{"id":"ISM-0441","url":"https://latticeworksystems.com.au/ism/ism-0441/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0441.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0441.md","official":{"statement":"When personnel are granted temporary access to systems and their resources, effective security controls are put in place to restrict their access to only data required for them to undertake their duties or functions.","statement_format":"OSCAL markup-multiline","revision":"10","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Temporary access to systems"]},"latticework_interpretation":null},{"id":"ISM-0443","url":"https://latticeworksystems.com.au/ism/ism-0443/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0443.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0443.md","official":{"statement":"Temporary access is not granted to systems that process, store or communicate caveated or sensitive compartmented information.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Sep-18","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Temporary access to systems"]},"latticework_interpretation":null},{"id":"ISM-0445","url":"https://latticeworksystems.com.au/ism/ism-0445/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0445.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0445.md","official":{"statement":"Privileged human users are assigned a dedicated privileged user account to be used solely for duties requiring privileged access.","statement_format":"OSCAL markup-multiline","revision":"9","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system access","Identity and access management","Privileged access to systems"]},"latticework_interpretation":null},{"id":"ISM-0446","url":"https://latticeworksystems.com.au/ism/ism-0446/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0446.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0446.md","official":{"statement":"Foreign nationals, including seconded foreign nationals, do not have privileged access to systems that process, store or communicate AUSTEO or REL data.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Jun-21","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Privileged access to systems by foreign nationals"]},"latticework_interpretation":null},{"id":"ISM-0447","url":"https://latticeworksystems.com.au/ism/ism-0447/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0447.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0447.md","official":{"statement":"Foreign nationals, excluding seconded foreign nationals, do not have privileged access to systems that process, store or communicate AGAO data.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Jun-21","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Privileged access to systems by foreign nationals"]},"latticework_interpretation":null},{"id":"ISM-0455","url":"https://latticeworksystems.com.au/ism/ism-0455/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0455.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0455.md","official":{"statement":"Where practical, cryptographic equipment, applications and libraries provide a means of data recovery to allow for circumstances where the encryption key is unavailable due to loss, damage or failure.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Sep-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic fundamentals","Data recovery"]},"latticework_interpretation":null},{"id":"ISM-0457","url":"https://latticeworksystems.com.au/ism/ism-0457/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0457.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0457.md","official":{"statement":"Cryptographic equipment, applications or libraries that have completed a Common Criteria evaluation against an ASD-endorsed Protection Profile are used when encrypting media that contains OFFICIAL: Sensitive or PROTECTED data.","statement_format":"OSCAL markup-multiline","revision":"11","updated":"Sep-25","applicability":["OS","P"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic fundamentals","Cryptographic implementation assurance"]},"latticework_interpretation":null},{"id":"ISM-0459","url":"https://latticeworksystems.com.au/ism/ism-0459/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0459.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0459.md","official":{"statement":"Full disk encryption, or partial encryption where access controls only allow writing to encrypted partitions or volumes, is implemented when encrypting media.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media usage","Encrypting media"]},"latticework_interpretation":null},{"id":"ISM-0460","url":"https://latticeworksystems.com.au/ism/ism-0460/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0460.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0460.md","official":{"statement":"HACE is used when encrypting media that contains SECRET or TOP SECRET data.","statement_format":"OSCAL markup-multiline","revision":"13","updated":"Sep-23","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic fundamentals","Cryptographic implementation assurance"]},"latticework_interpretation":null},{"id":"ISM-0462","url":"https://latticeworksystems.com.au/ism/ism-0462/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0462.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0462.md","official":{"statement":"When a user authenticates to the encryption functionality of IT equipment or media, it is treated in accordance with its original sensitivity or classification until the user deauthenticates from the encryption functionality.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Jun-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic fundamentals","Handling encrypted IT equipment and media"]},"latticework_interpretation":null},{"id":"ISM-0465","url":"https://latticeworksystems.com.au/ism/ism-0465/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0465.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0465.md","official":{"statement":"Cryptographic equipment, applications or libraries that have completed a Common Criteria evaluation against an ASD-endorsed Protection Profile are used to protect OFFICIAL: Sensitive or PROTECTED data when communicated over insufficiently secure networks, outside of appropriately secure areas or via public network infrastructure.","statement_format":"OSCAL markup-multiline","revision":"11","updated":"Sep-25","applicability":["OS","P"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic fundamentals","Cryptographic implementation assurance"]},"latticework_interpretation":null},{"id":"ISM-0467","url":"https://latticeworksystems.com.au/ism/ism-0467/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0467.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0467.md","official":{"statement":"HACE is used to protect SECRET and TOP SECRET data when communicated over insufficiently secure networks, outside of appropriately secure areas or via public network infrastructure.","statement_format":"OSCAL markup-multiline","revision":"12","updated":"Sep-23","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic fundamentals","Cryptographic implementation assurance"]},"latticework_interpretation":null},{"id":"ISM-0469","url":"https://latticeworksystems.com.au/ism/ism-0469/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0469.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0469.md","official":{"statement":"An AACP or high assurance cryptographic protocol is used when encrypting data in transit.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic protocols","Using cryptographic protocols"]},"latticework_interpretation":null},{"id":"ISM-0471","url":"https://latticeworksystems.com.au/ism/ism-0471/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0471.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0471.md","official":{"statement":"Only AACAs or high assurance cryptographic algorithms are used by cryptographic equipment, applications and libraries.","statement_format":"OSCAL markup-multiline","revision":"9","updated":"Sep-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic algorithms","Using cryptographic algorithms"]},"latticework_interpretation":null},{"id":"ISM-0472","url":"https://latticeworksystems.com.au/ism/ism-0472/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0472.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0472.md","official":{"statement":"When using DH for agreeing on encryption session keys, a modulus of at least 2048 bits is used, preferably 3072 bits.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Dec-24","applicability":["NC","OS","P"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic algorithms","Using Diffie-Hellman"]},"latticework_interpretation":null},{"id":"ISM-0474","url":"https://latticeworksystems.com.au/ism/ism-0474/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0474.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0474.md","official":{"statement":"When using ECDH for agreeing on encryption session keys, a base point order and key size of at least 224 bits is used, preferably the NIST P-384 curve.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Dec-24","applicability":["NC","OS","P"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic algorithms","Using Elliptic Curve Diffie-Hellman"]},"latticework_interpretation":null},{"id":"ISM-0475","url":"https://latticeworksystems.com.au/ism/ism-0475/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0475.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0475.md","official":{"statement":"When using ECDSA for digital signatures, a base point order and key size of at least 224 bits is used, preferably the P-384 curve.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Dec-24","applicability":["NC","OS","P"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic algorithms","Using the Elliptic Curve Digital Signature Algorithm"]},"latticework_interpretation":null},{"id":"ISM-0476","url":"https://latticeworksystems.com.au/ism/ism-0476/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0476.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0476.md","official":{"statement":"When using RSA for digital signatures, and transporting encryption session keys (and similar keys), a modulus of at least 2048 bits is used, preferably 3072 bits.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Dec-24","applicability":["NC","OS","P"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic algorithms","Using Rivest-Shamir-Adleman"]},"latticework_interpretation":null},{"id":"ISM-0477","url":"https://latticeworksystems.com.au/ism/ism-0477/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0477.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0477.md","official":{"statement":"When using RSA for digital signatures, and for transporting encryption session keys (and similar keys), a different key pair is used for digital signatures and transporting encryption session keys.","statement_format":"OSCAL markup-multiline","revision":"9","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic algorithms","Using Rivest-Shamir-Adleman"]},"latticework_interpretation":null},{"id":"ISM-0479","url":"https://latticeworksystems.com.au/ism/ism-0479/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0479.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0479.md","official":{"statement":"Symmetric cryptographic algorithms are not used in Electronic Codebook Mode.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic algorithms","Using symmetric cryptographic algorithms"]},"latticework_interpretation":null},{"id":"ISM-0481","url":"https://latticeworksystems.com.au/ism/ism-0481/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0481.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0481.md","official":{"statement":"Only AACPs or high assurance cryptographic protocols are used by cryptographic equipment, applications and libraries.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Sep-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic protocols","Using cryptographic protocols"]},"latticework_interpretation":null},{"id":"ISM-0484","url":"https://latticeworksystems.com.au/ism/ism-0484/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0484.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0484.md","official":{"statement":"The SSH daemon is configured to:\n\n- only listen on the required interfaces (ListenAddress xxx.xxx.xxx.xxx)\n- have a suitable login banner (Banner x)\n- have a login authentication timeout of no more than 60 seconds (LoginGraceTime 60)\n- disable host-based authentication (HostbasedAuthentication no)\n- disable rhosts-based authentication (IgnoreRhosts yes)\n- disable the ability to log in directly as root (PermitRootLogin no)\n- disable empty passwords (PermitEmptyPasswords no)\n- disable connection forwarding (AllowTCPForwarding no)\n- disable gateway ports (GatewayPorts no)\n- disable X11 forwarding (X11Forwarding no).","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Secure Shell","Configuring Secure Shell"]},"latticework_interpretation":null},{"id":"ISM-0485","url":"https://latticeworksystems.com.au/ism/ism-0485/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0485.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0485.md","official":{"statement":"Public key-based authentication is used for SSH connections.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Sep-18","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Secure Shell","Authentication mechanisms"]},"latticework_interpretation":null},{"id":"ISM-0487","url":"https://latticeworksystems.com.au/ism/ism-0487/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0487.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0487.md","official":{"statement":"When using logins without a password for SSH connections, the following are disabled:\n\n- access from IP addresses that do not require access\n- port forwarding\n- agent credential forwarding\n- X11 forwarding\n- console access.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Secure Shell","Automated remote access"]},"latticework_interpretation":null},{"id":"ISM-0488","url":"https://latticeworksystems.com.au/ism/ism-0488/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0488.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0488.md","official":{"statement":"If using remote access without the use of a password for SSH connections, the ‘forced command’ option is used to specify what command is executed and parameter checking is enabled.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Secure Shell","Automated remote access"]},"latticework_interpretation":null},{"id":"ISM-0489","url":"https://latticeworksystems.com.au/ism/ism-0489/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0489.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0489.md","official":{"statement":"When SSH-agent or similar key caching applications are used, cached private keys have a maximum lifetime of four hours and, where applicable, screen locks are used on workstations and servers.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Secure Shell","SSH-agent"]},"latticework_interpretation":null},{"id":"ISM-0490","url":"https://latticeworksystems.com.au/ism/ism-0490/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0490.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0490.md","official":{"statement":"Versions of S/MIME earlier than S/MIME version 3.0 are not used for S/MIME connections.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Secure/Multipurpose Internet Mail Extensions","Configuring Secure/Multipurpose Internet Mail Extensions"]},"latticework_interpretation":null},{"id":"ISM-0494","url":"https://latticeworksystems.com.au/ism/ism-0494/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0494.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0494.md","official":{"statement":"Tunnel mode is used for IPsec connections; however, if using transport mode, an IP tunnel is used.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Sep-18","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Internet Protocol Security","Mode of operation"]},"latticework_interpretation":null},{"id":"ISM-0496","url":"https://latticeworksystems.com.au/ism/ism-0496/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0496.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0496.md","official":{"statement":"The ESP protocol is used for authentication and encryption of IPsec connections.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Internet Protocol Security","Protocol selection"]},"latticework_interpretation":null},{"id":"ISM-0498","url":"https://latticeworksystems.com.au/ism/ism-0498/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0498.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0498.md","official":{"statement":"A security association lifetime of less than four hours (14400 seconds) is used for IPsec connections.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Internet Protocol Security","Security association lifetimes"]},"latticework_interpretation":null},{"id":"ISM-0499","url":"https://latticeworksystems.com.au/ism/ism-0499/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0499.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0499.md","official":{"statement":"Communications security doctrine and policy produced by ASD for the management and operation of HACE is complied with.","statement_format":"OSCAL markup-multiline","revision":"12","updated":"Jun-25","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic fundamentals","Communications security doctrine"]},"latticework_interpretation":null},{"id":"ISM-0501","url":"https://latticeworksystems.com.au/ism/ism-0501/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0501.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0501.md","official":{"statement":"Keyed cryptographic equipment is transported based on the sensitivity or classification of its keying material.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic fundamentals","Transporting cryptographic equipment"]},"latticework_interpretation":null},{"id":"ISM-0507","url":"https://latticeworksystems.com.au/ism/ism-0507/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0507.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0507.md","official":{"statement":"Cryptographic key management processes, and supporting cryptographic key management procedures, are developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic fundamentals","Cryptographic key management processes and procedures"]},"latticework_interpretation":null},{"id":"ISM-0516","url":"https://latticeworksystems.com.au/ism/ism-0516/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0516.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0516.md","official":{"statement":"Network documentation includes high-level network diagrams showing all connections into networks and logical network diagrams showing all critical servers, high-value servers, network devices and network security appliances.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Network documentation"]},"latticework_interpretation":null},{"id":"ISM-0518","url":"https://latticeworksystems.com.au/ism/ism-0518/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0518.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0518.md","official":{"statement":"Network documentation is developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Network documentation"]},"latticework_interpretation":null},{"id":"ISM-0520","url":"https://latticeworksystems.com.au/ism/ism-0520/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0520.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0520.md","official":{"statement":"Network access controls are implemented on networks to prevent the connection of unauthorised network devices and networked IT equipment.","statement_format":"OSCAL markup-multiline","revision":"9","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Network access controls"]},"latticework_interpretation":null},{"id":"ISM-0529","url":"https://latticeworksystems.com.au/ism/ism-0529/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0529.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0529.md","official":{"statement":"VLANs are not used to separate network traffic between networks belonging to different security domains.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Using virtual local area networks"]},"latticework_interpretation":null},{"id":"ISM-0530","url":"https://latticeworksystems.com.au/ism/ism-0530/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0530.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0530.md","official":{"statement":"Network devices managing VLANs are administered from the most trusted security domain.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Using virtual local area networks"]},"latticework_interpretation":null},{"id":"ISM-0534","url":"https://latticeworksystems.com.au/ism/ism-0534/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0534.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0534.md","official":{"statement":"Unused physical ports on network devices are disabled.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-18","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Disabling unused physical ports on network devices"]},"latticework_interpretation":null},{"id":"ISM-0535","url":"https://latticeworksystems.com.au/ism/ism-0535/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0535.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0535.md","official":{"statement":"Network devices managing VLANs belonging to different security domains do not share VLAN trunks.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Using virtual local area networks"]},"latticework_interpretation":null},{"id":"ISM-0536","url":"https://latticeworksystems.com.au/ism/ism-0536/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0536.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0536.md","official":{"statement":"Public wireless networks provided for public use are segregated from all other organisation networks.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Wireless networks","Public wireless networks"]},"latticework_interpretation":null},{"id":"ISM-0546","url":"https://latticeworksystems.com.au/ism/ism-0546/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0546.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0546.md","official":{"statement":"When video conferencing or IP telephony traffic passes through a gateway containing a firewall or proxy, a video-aware or voice-aware firewall or proxy is used.","statement_format":"OSCAL markup-multiline","revision":"9","updated":"Jun-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Video conferencing and Internet Protocol telephony","Video-aware and voice-aware firewalls and proxies"]},"latticework_interpretation":null},{"id":"ISM-0547","url":"https://latticeworksystems.com.au/ism/ism-0547/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0547.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0547.md","official":{"statement":"Video conferencing and IP telephony calls are conducted using a secure real-time transport protocol.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Video conferencing and Internet Protocol telephony","Protecting video conferencing and Internet Protocol telephony traffic"]},"latticework_interpretation":null},{"id":"ISM-0548","url":"https://latticeworksystems.com.au/ism/ism-0548/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0548.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0548.md","official":{"statement":"Video conferencing and IP telephony calls are established using a secure session initiation protocol.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Video conferencing and Internet Protocol telephony","Protecting video conferencing and Internet Protocol telephony traffic"]},"latticework_interpretation":null},{"id":"ISM-0549","url":"https://latticeworksystems.com.au/ism/ism-0549/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0549.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0549.md","official":{"statement":"Video conferencing and IP telephony traffic is physically or logically separated from other data traffic.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Video conferencing and Internet Protocol telephony","Traffic separation"]},"latticework_interpretation":null},{"id":"ISM-0551","url":"https://latticeworksystems.com.au/ism/ism-0551/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0551.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0551.md","official":{"statement":"IP telephony is configured such that:\n\n- IP phones authenticate themselves to the call controller upon registration\n- auto-registration is disabled and only authorised devices are allowed to access the network\n- unauthorised devices are blocked by default\n- all unused and prohibited functionality is disabled.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Jan-20","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Video conferencing and Internet Protocol telephony","Video conferencing unit and Internet Protocol phone authentication"]},"latticework_interpretation":null},{"id":"ISM-0553","url":"https://latticeworksystems.com.au/ism/ism-0553/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0553.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0553.md","official":{"statement":"Authentication and authorisation is used for all actions on a video conferencing network, including call setup and changing settings.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Sep-18","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Video conferencing and Internet Protocol telephony","Video conferencing unit and Internet Protocol phone authentication"]},"latticework_interpretation":null},{"id":"ISM-0554","url":"https://latticeworksystems.com.au/ism/ism-0554/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0554.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0554.md","official":{"statement":"An encrypted and non-replayable two-way authentication scheme is used for call authentication and authorisation.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-18","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Video conferencing and Internet Protocol telephony","Video conferencing unit and Internet Protocol phone authentication"]},"latticework_interpretation":null},{"id":"ISM-0555","url":"https://latticeworksystems.com.au/ism/ism-0555/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0555.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0555.md","official":{"statement":"Authentication and authorisation is used for all actions on an IP telephony network, including registering a new IP phone, changing phone users, changing settings and accessing voicemail.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-19","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Video conferencing and Internet Protocol telephony","Video conferencing unit and Internet Protocol phone authentication"]},"latticework_interpretation":null},{"id":"ISM-0556","url":"https://latticeworksystems.com.au/ism/ism-0556/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0556.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0556.md","official":{"statement":"Workstations are not connected to video conferencing units or IP phones unless the workstation or the device uses virtual local area networks or similar mechanisms to maintain separation between video conferencing, IP telephony and other data traffic.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Oct-19","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Video conferencing and Internet Protocol telephony","Traffic separation"]},"latticework_interpretation":null},{"id":"ISM-0558","url":"https://latticeworksystems.com.au/ism/ism-0558/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0558.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0558.md","official":{"statement":"IP phones used in public areas do not have the ability to access data networks, voicemail and directory services.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Video conferencing and Internet Protocol telephony","Internet Protocol phones in public areas"]},"latticework_interpretation":null},{"id":"ISM-0559","url":"https://latticeworksystems.com.au/ism/ism-0559/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0559.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0559.md","official":{"statement":"Microphones (including headsets and USB handsets) and webcams are not used with non-SECRET workstations in SECRET areas.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-24","applicability":["NC","OS","P"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Video conferencing and Internet Protocol telephony","Microphones and webcams"]},"latticework_interpretation":null},{"id":"ISM-0565","url":"https://latticeworksystems.com.au/ism/ism-0565/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0565.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0565.md","official":{"statement":"Email servers are configured to block, log and report emails with inappropriate protective markings.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Mar-19","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for email","Email usage","Handling emails with inappropriate, invalid or missing protective markings"]},"latticework_interpretation":null},{"id":"ISM-0567","url":"https://latticeworksystems.com.au/ism/ism-0567/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0567.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0567.md","official":{"statement":"Email servers only relay emails destined for or originating from their domains (including subdomains).","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Sep-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for email","Email gateways and servers","Open relay email servers"]},"latticework_interpretation":null},{"id":"ISM-0569","url":"https://latticeworksystems.com.au/ism/ism-0569/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0569.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0569.md","official":{"statement":"Emails are routed via centralised email gateways.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Jun-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for email","Email gateways and servers","Centralised email gateways"]},"latticework_interpretation":null},{"id":"ISM-0570","url":"https://latticeworksystems.com.au/ism/ism-0570/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0570.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0570.md","official":{"statement":"Where backup or alternative email gateways are in place, they are maintained at the same standard as the primary email gateway.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Sep-18","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for email","Email gateways and servers","Email gateway maintenance activities"]},"latticework_interpretation":null},{"id":"ISM-0571","url":"https://latticeworksystems.com.au/ism/ism-0571/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0571.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0571.md","official":{"statement":"When users send or receive emails, an authenticated and encrypted channel is used to route emails via their organisation’s centralised email gateways.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Jun-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for email","Email gateways and servers","Centralised email gateways"]},"latticework_interpretation":null},{"id":"ISM-0572","url":"https://latticeworksystems.com.au/ism/ism-0572/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0572.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0572.md","official":{"statement":"Opportunistic TLS encryption is enabled on email servers that make incoming or outgoing email connections over public network infrastructure.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Sep-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for email","Email gateways and servers","Email server transport encryption"]},"latticework_interpretation":null},{"id":"ISM-0574","url":"https://latticeworksystems.com.au/ism/ism-0574/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0574.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0574.md","official":{"statement":"SPF is used to specify authorised email servers (or lack thereof) for an organisation’s domains (including subdomains).","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Jun-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for email","Email gateways and servers","Sender Policy Framework"]},"latticework_interpretation":null},{"id":"ISM-0576","url":"https://latticeworksystems.com.au/ism/ism-0576/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0576.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0576.md","official":{"statement":"A cyber security incident management policy, and associated cyber security incident response plan, is developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"10","updated":"Sep-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security incidents","Managing cyber security incidents","Cyber security incident management policy"]},"latticework_interpretation":null},{"id":"ISM-0580","url":"https://latticeworksystems.com.au/ism/ism-0580/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0580.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0580.md","official":{"statement":"A security monitoring policy is developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for security assurance","Security monitoring","Security monitoring policy"]},"latticework_interpretation":null},{"id":"ISM-0582","url":"https://latticeworksystems.com.au/ism/ism-0582/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0582.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0582.md","official":{"statement":"Security-relevant events for Microsoft Windows operating systems are centrally logged.","statement_format":"OSCAL markup-multiline","revision":"10","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Operating system event logging"]},"latticework_interpretation":null},{"id":"ISM-0585","url":"https://latticeworksystems.com.au/ism/ism-0585/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0585.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0585.md","official":{"statement":"For each event logged, the date and time of the event, the relevant user or process, the relevant filename, the event description, and the information technology equipment involved are captured.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for security assurance","Security monitoring","Event log details"]},"latticework_interpretation":null},{"id":"ISM-0588","url":"https://latticeworksystems.com.au/ism/ism-0588/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0588.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0588.md","official":{"statement":"An MFD usage policy is developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Multifunction devices","Multifunction device usage policy"]},"latticework_interpretation":null},{"id":"ISM-0589","url":"https://latticeworksystems.com.au/ism/ism-0589/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0589.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0589.md","official":{"statement":"MFDs are not used to scan or copy documents above the sensitivity or classification of networks they are connected to.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Jun-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Multifunction devices","Scanning and copying documents on multifunction devices"]},"latticework_interpretation":null},{"id":"ISM-0590","url":"https://latticeworksystems.com.au/ism/ism-0590/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0590.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0590.md","official":{"statement":"Authentication measures for MFDs are the same strength as those used for workstations on networks they are connected to.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Jun-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Multifunction devices","Authenticating to multifunction devices"]},"latticework_interpretation":null},{"id":"ISM-0591","url":"https://latticeworksystems.com.au/ism/ism-0591/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0591.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0591.md","official":{"statement":"Evaluated peripheral switches are used when sharing peripherals between systems.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Peripheral switches","Using peripheral switches"]},"latticework_interpretation":null},{"id":"ISM-0597","url":"https://latticeworksystems.com.au/ism/ism-0597/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0597.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0597.md","official":{"statement":"When planning, designing, implementing or introducing additional connectivity to CDSs, ASD is consulted and any directions provided by ASD are complied with.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Sep-23","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Cross domain solutions","Consultation on cross domain solutions"]},"latticework_interpretation":null},{"id":"ISM-0610","url":"https://latticeworksystems.com.au/ism/ism-0610/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0610.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0610.md","official":{"statement":"Human users are trained on the secure use of CDSs before access is granted.","statement_format":"OSCAL markup-multiline","revision":"9","updated":"Sep-26","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Cross domain solutions","Cross domain solution use"]},"latticework_interpretation":null},{"id":"ISM-0611","url":"https://latticeworksystems.com.au/ism/ism-0611/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0611.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0611.md","official":{"statement":"System administrators for gateways are assigned the minimum privileges required to perform their duties.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Gateways","System administrators for gateways"]},"latticework_interpretation":null},{"id":"ISM-0612","url":"https://latticeworksystems.com.au/ism/ism-0612/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0612.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0612.md","official":{"statement":"System administrators for gateways are formally trained on the operation and management of gateways.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Gateways","System administrators for gateways"]},"latticework_interpretation":null},{"id":"ISM-0613","url":"https://latticeworksystems.com.au/ism/ism-0613/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0613.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0613.md","official":{"statement":"System administrators for gateways that connect to Australian Eyes Only or Releasable To networks are Australian nationals.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Mar-22","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Gateways","System administrators for gateways"]},"latticework_interpretation":null},{"id":"ISM-0616","url":"https://latticeworksystems.com.au/ism/ism-0616/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0616.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0616.md","official":{"statement":"Separation of duties is implemented in performing administrative activities for gateways.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Gateways","System administrators for gateways"]},"latticework_interpretation":null},{"id":"ISM-0619","url":"https://latticeworksystems.com.au/ism/ism-0619/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0619.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0619.md","official":{"statement":"Users authenticate to other networks accessed via gateways.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Gateways","Authenticating to networks accessed via gateways"]},"latticework_interpretation":null},{"id":"ISM-0622","url":"https://latticeworksystems.com.au/ism/ism-0622/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0622.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0622.md","official":{"statement":"IT equipment authenticates to other networks accessed via gateways.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Jun-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Gateways","Authenticating to networks accessed via gateways"]},"latticework_interpretation":null},{"id":"ISM-0626","url":"https://latticeworksystems.com.au/ism/ism-0626/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0626.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0626.md","official":{"statement":"CDSs are implemented between SECRET or TOP SECRET networks and any other networks belonging to different security domains.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Mar-22","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Cross domain solutions","Implementing cross domain solutions"]},"latticework_interpretation":null},{"id":"ISM-0628","url":"https://latticeworksystems.com.au/ism/ism-0628/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0628.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0628.md","official":{"statement":"Gateways are implemented between networks belonging to different security domains.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Gateways","Implementing gateways"]},"latticework_interpretation":null},{"id":"ISM-0629","url":"https://latticeworksystems.com.au/ism/ism-0629/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0629.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0629.md","official":{"statement":"For gateways between networks belonging to different security domains, any shared components are managed by system administrators for the higher security domain or by system administrators from a mutually agreed upon third party.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Gateways","System administration of gateways"]},"latticework_interpretation":null},{"id":"ISM-0631","url":"https://latticeworksystems.com.au/ism/ism-0631/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0631.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0631.md","official":{"statement":"Gateways only allow explicitly authorised data flows.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Gateways","Implementing gateways"]},"latticework_interpretation":null},{"id":"ISM-0634","url":"https://latticeworksystems.com.au/ism/ism-0634/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0634.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0634.md","official":{"statement":"Security-relevant events for gateways are centrally logged, including:\n\n- data packets and data flows permitted through gateways\n- data packets and data flows attempting to leave gateways\n- real-time alerts for attempted intrusions.","statement_format":"OSCAL markup-multiline","revision":"11","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Gateways","Gateway event logging"]},"latticework_interpretation":null},{"id":"ISM-0635","url":"https://latticeworksystems.com.au/ism/ism-0635/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0635.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0635.md","official":{"statement":"CDSs implement isolated upward and downward network paths.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Mar-22","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Cross domain solutions","Separation of data flows"]},"latticework_interpretation":null},{"id":"ISM-0637","url":"https://latticeworksystems.com.au/ism/ism-0637/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0637.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0637.md","official":{"statement":"Gateways implement a demilitarised zone if external parties require access to an organisation’s services.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Gateways","Implementing gateways"]},"latticework_interpretation":null},{"id":"ISM-0639","url":"https://latticeworksystems.com.au/ism/ism-0639/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0639.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0639.md","official":{"statement":"Evaluated firewalls are used between networks belonging to different security domains.","statement_format":"OSCAL markup-multiline","revision":"9","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Firewalls","Using firewalls"]},"latticework_interpretation":null},{"id":"ISM-0643","url":"https://latticeworksystems.com.au/ism/ism-0643/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0643.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0643.md","official":{"statement":"Evaluated diodes are used for controlling the data flow of unidirectional gateways between an organisation’s networks and public network infrastructure.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Diodes","Using diodes"]},"latticework_interpretation":null},{"id":"ISM-0645","url":"https://latticeworksystems.com.au/ism/ism-0645/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0645.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0645.md","official":{"statement":"Evaluated diodes used for controlling the data flow of unidirectional gateways between SECRET or TOP SECRET networks and public network infrastructure complete a high assurance evaluation.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Mar-22","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Diodes","Using diodes"]},"latticework_interpretation":null},{"id":"ISM-0649","url":"https://latticeworksystems.com.au/ism/ism-0649/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0649.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0649.md","official":{"statement":"Files imported or exported via gateways or CDSs are filtered for allowed file types.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Content filtering","Allowing specific content types"]},"latticework_interpretation":null},{"id":"ISM-0651","url":"https://latticeworksystems.com.au/ism/ism-0651/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0651.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0651.md","official":{"statement":"Files identified by content filtering checks as malicious, or that cannot be inspected, are blocked.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Content filtering","Performing content filtering"]},"latticework_interpretation":null},{"id":"ISM-0652","url":"https://latticeworksystems.com.au/ism/ism-0652/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0652.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0652.md","official":{"statement":"Files identified by content filtering checks as suspicious are quarantined until reviewed and subsequently approved or not approved for release.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Content filtering","Performing content filtering"]},"latticework_interpretation":null},{"id":"ISM-0657","url":"https://latticeworksystems.com.au/ism/ism-0657/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0657.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0657.md","official":{"statement":"When manually importing data to systems, the data is scanned for malicious and active content.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for data transfers","Data transfers","Manual import of data"]},"latticework_interpretation":null},{"id":"ISM-0659","url":"https://latticeworksystems.com.au/ism/ism-0659/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0659.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0659.md","official":{"statement":"Files imported or exported via gateways or CDSs undergo content filtering checks.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Content filtering","Performing content filtering"]},"latticework_interpretation":null},{"id":"ISM-0660","url":"https://latticeworksystems.com.au/ism/ism-0660/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0660.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0660.md","official":{"statement":"Data transfer logs for SECRET and TOP SECRET systems are fully verified at least monthly.","statement_format":"OSCAL markup-multiline","revision":"9","updated":"Mar-22","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for data transfers","Data transfers","Monitoring data import and export"]},"latticework_interpretation":null},{"id":"ISM-0661","url":"https://latticeworksystems.com.au/ism/ism-0661/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0661.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0661.md","official":{"statement":"Human users transferring data to and from systems are held accountable for data transfers they perform.","statement_format":"OSCAL markup-multiline","revision":"9","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for data transfers","Data transfers","Accountability for data transfers"]},"latticework_interpretation":null},{"id":"ISM-0663","url":"https://latticeworksystems.com.au/ism/ism-0663/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0663.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0663.md","official":{"statement":"Data transfer processes, and supporting data transfer procedures, are developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for data transfers","Data transfers","Data transfer processes and procedures"]},"latticework_interpretation":null},{"id":"ISM-0664","url":"https://latticeworksystems.com.au/ism/ism-0664/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0664.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0664.md","official":{"statement":"Data exported from SECRET and TOP SECRET systems is reviewed and authorised by a trustworthy source beforehand.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Sep-25","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for data transfers","Data transfers","Authorising export of data"]},"latticework_interpretation":null},{"id":"ISM-0665","url":"https://latticeworksystems.com.au/ism/ism-0665/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0665.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0665.md","official":{"statement":"Trustworthy sources for SECRET and TOP SECRET systems are limited to people and systems that have been verified and authorised as such by the chief information security officer.","statement_format":"OSCAL markup-multiline","revision":"9","updated":"Sep-26","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for data transfers","Data transfers","Authorising export of data"]},"latticework_interpretation":null},{"id":"ISM-0669","url":"https://latticeworksystems.com.au/ism/ism-0669/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0669.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0669.md","official":{"statement":"When manually exporting data from SECRET and TOP SECRET systems, digital signatures are validated and keyword checks are performed within all textual data.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-22","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for data transfers","Data transfers","Manual export of data"]},"latticework_interpretation":null},{"id":"ISM-0670","url":"https://latticeworksystems.com.au/ism/ism-0670/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0670.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0670.md","official":{"statement":"Security-relevant events for CDSs are centrally logged.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Sep-24","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Cross domain solutions","Cross domain solution event logging"]},"latticework_interpretation":null},{"id":"ISM-0675","url":"https://latticeworksystems.com.au/ism/ism-0675/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0675.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0675.md","official":{"statement":"Data authorised for export from SECRET and TOP SECRET systems is digitally signed by a trustworthy source.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Sep-25","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for data transfers","Data transfers","Authorising export of data"]},"latticework_interpretation":null},{"id":"ISM-0677","url":"https://latticeworksystems.com.au/ism/ism-0677/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0677.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0677.md","official":{"statement":"Files imported or exported via gateways or CDSs that have a digital signature or cryptographic checksum are validated.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Mar-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Content filtering","Validating file integrity"]},"latticework_interpretation":null},{"id":"ISM-0682","url":"https://latticeworksystems.com.au/ism/ism-0682/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0682.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0682.md","official":{"statement":"Bluetooth functionality is not enabled on SECRET and TOP SECRET mobile devices.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Dec-21","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device usage","Using Bluetooth functionality"]},"latticework_interpretation":null},{"id":"ISM-0687","url":"https://latticeworksystems.com.au/ism/ism-0687/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0687.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0687.md","official":{"statement":"Mobile devices that access SECRET or TOP SECRET systems or data use mobile platforms that have been issued an Approval for Use by ASD and are operated in accordance with the latest version of their associated Australian Communications Security Instruction.","statement_format":"OSCAL markup-multiline","revision":"10","updated":"Sep-23","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device management","Approved mobile platforms"]},"latticework_interpretation":null},{"id":"ISM-0694","url":"https://latticeworksystems.com.au/ism/ism-0694/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0694.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0694.md","official":{"statement":"Privately owned mobile devices and desktop computers do not access SECRET and TOP SECRET systems or data.","statement_format":"OSCAL markup-multiline","revision":"9","updated":"Jun-26","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Enterprise mobility","Privately owned mobile devices and desktop computers"]},"latticework_interpretation":null},{"id":"ISM-0701","url":"https://latticeworksystems.com.au/ism/ism-0701/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0701.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0701.md","official":{"statement":"Mobile device emergency sanitisation processes, and supporting mobile device emergency sanitisation procedures, are developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device usage","Mobile device emergency sanitisation processes and procedures"]},"latticework_interpretation":null},{"id":"ISM-0702","url":"https://latticeworksystems.com.au/ism/ism-0702/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0702.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0702.md","official":{"statement":"If a cryptographic zeroise or sanitise function is provided for cryptographic keys on a SECRET or TOP SECRET mobile device, the function is used as part of mobile device emergency sanitisation processes and procedures.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Dec-21","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device usage","Mobile device emergency sanitisation processes and procedures"]},"latticework_interpretation":null},{"id":"ISM-0705","url":"https://latticeworksystems.com.au/ism/ism-0705/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0705.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0705.md","official":{"statement":"When accessing an organisation’s network via a VPN connection, split tunnelling is disabled.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Enterprise mobility","Mobile devices and desktop computers accessing the internet"]},"latticework_interpretation":null},{"id":"ISM-0714","url":"https://latticeworksystems.com.au/ism/ism-0714/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0714.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0714.md","official":{"statement":"A CISO is appointed to provide cyber security leadership and guidance for their organisation (covering IT and OT).","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Jun-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","Chief information security officer","Providing cyber security leadership and guidance"]},"latticework_interpretation":null},{"id":"ISM-0717","url":"https://latticeworksystems.com.au/ism/ism-0717/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0717.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0717.md","official":{"statement":"The CISO oversees the management of cyber security personnel within their organisation.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Oct-20","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","Chief information security officer","Overseeing cyber security personnel"]},"latticework_interpretation":null},{"id":"ISM-0718","url":"https://latticeworksystems.com.au/ism/ism-0718/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0718.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0718.md","official":{"statement":"The CISO regularly reports directly to their organisation’s board of directors or executive committee on cyber security matters.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","Chief information security officer","Reporting on cyber security"]},"latticework_interpretation":null},{"id":"ISM-0720","url":"https://latticeworksystems.com.au/ism/ism-0720/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0720.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0720.md","official":{"statement":"The CISO oversees the development, implementation and maintenance of a cyber security communications strategy to assist in communicating the cyber security vision and strategy for their organisation.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Sep-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","Chief information security officer","Communicating a cyber security vision and strategy"]},"latticework_interpretation":null},{"id":"ISM-0724","url":"https://latticeworksystems.com.au/ism/ism-0724/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0724.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0724.md","official":{"statement":"The CISO implements cyber security measurement metrics and key performance indicators for their organisation.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Oct-20","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","Chief information security officer","Overseeing the cyber security program"]},"latticework_interpretation":null},{"id":"ISM-0725","url":"https://latticeworksystems.com.au/ism/ism-0725/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0725.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0725.md","official":{"statement":"The CISO coordinates cyber security and business alignment through a cyber security steering committee or advisory board, comprising key cyber security and business executives, which meets formally and regularly.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","Chief information security officer","Coordinating cyber security"]},"latticework_interpretation":null},{"id":"ISM-0726","url":"https://latticeworksystems.com.au/ism/ism-0726/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0726.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0726.md","official":{"statement":"The CISO coordinates security risk management activities between cyber security and business teams.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Oct-20","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","Chief information security officer","Coordinating cyber security"]},"latticework_interpretation":null},{"id":"ISM-0731","url":"https://latticeworksystems.com.au/ism/ism-0731/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0731.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0731.md","official":{"statement":"The CISO oversees cyber supply chain risk management activities for their organisation.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Oct-20","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","Chief information security officer","Working with suppliers"]},"latticework_interpretation":null},{"id":"ISM-0732","url":"https://latticeworksystems.com.au/ism/ism-0732/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0732.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0732.md","official":{"statement":"The CISO receives and manages a dedicated cyber security budget for their organisation.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Oct-20","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","Chief information security officer","Receiving and managing a dedicated cyber security budget"]},"latticework_interpretation":null},{"id":"ISM-0733","url":"https://latticeworksystems.com.au/ism/ism-0733/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0733.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0733.md","official":{"statement":"The CISO is fully aware of all cyber security incidents within their organisation.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Oct-20","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","Chief information security officer","Overseeing cyber security incident response activities"]},"latticework_interpretation":null},{"id":"ISM-0734","url":"https://latticeworksystems.com.au/ism/ism-0734/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0734.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0734.md","official":{"statement":"The CISO contributes to the development, implementation and maintenance of business continuity and disaster recovery plans for their organisation to ensure that business-critical services are supported appropriately in the event of a disaster.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Sep-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","Chief information security officer","Contributing to business continuity and disaster recovery planning"]},"latticework_interpretation":null},{"id":"ISM-0735","url":"https://latticeworksystems.com.au/ism/ism-0735/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0735.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0735.md","official":{"statement":"The CISO oversees the development, implementation and maintenance of their organisation’s cyber security awareness training program.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","Chief information security officer","Overseeing cyber security awareness training"]},"latticework_interpretation":null},{"id":"ISM-0810","url":"https://latticeworksystems.com.au/ism/ism-0810/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0810.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0810.md","official":{"statement":"Classified systems are secured in facilities that meet the requirements for a security zone suitable for their classification.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Dec-24","applicability":["OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for physical security","Facilities and systems","Physical access to systems"]},"latticework_interpretation":null},{"id":"ISM-0813","url":"https://latticeworksystems.com.au/ism/ism-0813/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0813.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0813.md","official":{"statement":"Server rooms, communications rooms and security containers are not left in unsecured states.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for physical security","Facilities and systems","Physical access to servers, network devices and cryptographic equipment"]},"latticework_interpretation":null},{"id":"ISM-0817","url":"https://latticeworksystems.com.au/ism/ism-0817/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0817.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0817.md","official":{"statement":"Personnel are advised of what suspicious contact via online services is and how to report it.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Jan-20","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for personnel security","Cyber security awareness training","Reporting suspicious contact via online services"]},"latticework_interpretation":null},{"id":"ISM-0820","url":"https://latticeworksystems.com.au/ism/ism-0820/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0820.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0820.md","official":{"statement":"Personnel are advised not to post work-related information on unauthorised online services, and to report cases where such information is posted.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for personnel security","Cyber security awareness training","Posting work-related information on online services"]},"latticework_interpretation":null},{"id":"ISM-0821","url":"https://latticeworksystems.com.au/ism/ism-0821/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0821.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0821.md","official":{"statement":"Personnel are advised of security risks associated with posting personal information on online services.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for personnel security","Cyber security awareness training","Posting personal information on online services"]},"latticework_interpretation":null},{"id":"ISM-0824","url":"https://latticeworksystems.com.au/ism/ism-0824/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0824.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0824.md","official":{"statement":"Personnel are advised not to send or receive files via unauthorised online services.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-18","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for personnel security","Cyber security awareness training","Sending and receiving files via online services"]},"latticework_interpretation":null},{"id":"ISM-0829","url":"https://latticeworksystems.com.au/ism/ism-0829/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0829.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0829.md","official":{"statement":"Security measures are used to detect and respond to unauthorised RF devices in SECRET and TOP SECRET areas.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Mar-19","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for physical security","Facilities and systems","Bringing radio frequency and infrared devices into facilities"]},"latticework_interpretation":null},{"id":"ISM-0831","url":"https://latticeworksystems.com.au/ism/ism-0831/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0831.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0831.md","official":{"statement":"Media is handled in a manner suitable for its sensitivity or classification.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Sep-18","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media usage","Handling media"]},"latticework_interpretation":null},{"id":"ISM-0835","url":"https://latticeworksystems.com.au/ism/ism-0835/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0835.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0835.md","official":{"statement":"Following sanitisation, TOP SECRET volatile media retains its classification if it stored static data for an extended period, or had data repeatedly stored on or written to the same memory location for an extended period.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Jun-26","applicability":["TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media sanitisation","Treatment of volatile media following sanitisation"]},"latticework_interpretation":null},{"id":"ISM-0836","url":"https://latticeworksystems.com.au/ism/ism-0836/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0836.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0836.md","official":{"statement":"Non-volatile EEPROM media is sanitised by overwriting it at least once in its entirety with a random pattern followed by a read back for verification.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media sanitisation","Non-volatile electrically erasable programmable read-only memory media sanitisation"]},"latticework_interpretation":null},{"id":"ISM-0839","url":"https://latticeworksystems.com.au/ism/ism-0839/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0839.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0839.md","official":{"statement":"The destruction of media storing accountable material is not outsourced.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-21","applicability":["OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media destruction","Outsourcing media destruction"]},"latticework_interpretation":null},{"id":"ISM-0840","url":"https://latticeworksystems.com.au/ism/ism-0840/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0840.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0840.md","official":{"statement":"When outsourcing the destruction of media storing non-accountable material, a National Association for Information Destruction AAA certified destruction service with endorsements, as specified in ASIO’s Protective Security Circular-167, is used.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Jun-22","applicability":["OS","P","S"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media destruction","Outsourcing media destruction"]},"latticework_interpretation":null},{"id":"ISM-0843","url":"https://latticeworksystems.com.au/ism/ism-0843/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0843.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0843.md","official":{"statement":"Application control is implemented on workstations.","statement_format":"OSCAL markup-multiline","revision":"9","updated":"Sep-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system hardening","Operating system hardening","Application control"]},"latticework_interpretation":null},{"id":"ISM-0846","url":"https://latticeworksystems.com.au/ism/ism-0846/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0846.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0846.md","official":{"statement":"Users cannot disable or bypass application control, and are not exempted from application control, except when using local administrator accounts or break glass accounts.","statement_format":"OSCAL markup-multiline","revision":"10","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Application control"]},"latticework_interpretation":null},{"id":"ISM-0853","url":"https://latticeworksystems.com.au/ism/ism-0853/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0853.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0853.md","official":{"statement":"Interactive user sessions are terminated and workstations are restarted at least daily.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Session termination"]},"latticework_interpretation":null},{"id":"ISM-0854","url":"https://latticeworksystems.com.au/ism/ism-0854/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0854.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0854.md","official":{"statement":"AUSTEO and AGAO data can only be accessed from systems under the sole control of the Australian Government that are located within facilities authorised by the Australian Government.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-21","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Control of Australian systems"]},"latticework_interpretation":null},{"id":"ISM-0861","url":"https://latticeworksystems.com.au/ism/ism-0861/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0861.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0861.md","official":{"statement":"DKIM signing is enabled on emails originating from an organisation’s domains (including subdomains).","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Sep-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for email","Email gateways and servers","DomainKeys Identified Mail"]},"latticework_interpretation":null},{"id":"ISM-0863","url":"https://latticeworksystems.com.au/ism/ism-0863/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0863.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0863.md","official":{"statement":"Mobile devices prevent personnel from installing non-approved applications once provisioned.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device management","Maintaining mobile device security"]},"latticework_interpretation":null},{"id":"ISM-0864","url":"https://latticeworksystems.com.au/ism/ism-0864/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0864.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0864.md","official":{"statement":"Mobile devices prevent personnel from disabling or modifying security functionality once provisioned.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device management","Maintaining mobile device security"]},"latticework_interpretation":null},{"id":"ISM-0866","url":"https://latticeworksystems.com.au/ism/ism-0866/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0866.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0866.md","official":{"statement":"Sensitive or classified data is not viewed on mobile devices in public locations unless care is taken to reduce the chance of the screen of a mobile device being observed.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Mar-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device usage","Using mobile devices in public spaces"]},"latticework_interpretation":null},{"id":"ISM-0869","url":"https://latticeworksystems.com.au/ism/ism-0869/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0869.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0869.md","official":{"statement":"Mobile devices encrypt their internal storage and any removable media using ASD-approved cryptography.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device management","Encrypted storage"]},"latticework_interpretation":null},{"id":"ISM-0870","url":"https://latticeworksystems.com.au/ism/ism-0870/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0870.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0870.md","official":{"statement":"Mobile devices are carried or stored in a secured state when not being actively used.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Apr-19","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device usage","Maintaining control of mobile devices"]},"latticework_interpretation":null},{"id":"ISM-0871","url":"https://latticeworksystems.com.au/ism/ism-0871/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0871.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0871.md","official":{"statement":"Mobile devices are kept under continual direct supervision when being actively used.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Apr-19","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device usage","Maintaining control of mobile devices"]},"latticework_interpretation":null},{"id":"ISM-0874","url":"https://latticeworksystems.com.au/ism/ism-0874/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0874.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0874.md","official":{"statement":"Mobile devices and desktop computers access the internet via an organisation’s internet gateway rather than via a direct connection to the internet.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Mar-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Enterprise mobility","Mobile devices and desktop computers accessing the internet"]},"latticework_interpretation":null},{"id":"ISM-0888","url":"https://latticeworksystems.com.au/ism/ism-0888/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0888.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0888.md","official":{"statement":"Cyber security documentation is reviewed at least annually and includes a ‘current as at \\[date\\]’ or equivalent statement.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security documentation","Development and maintenance of cyber security documentation","Maintenance of cyber security documentation"]},"latticework_interpretation":null},{"id":"ISM-0912","url":"https://latticeworksystems.com.au/ism/ism-0912/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0912.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0912.md","official":{"statement":"Systems have a change and configuration management plan that includes:\n\n- the establishment and maintenance of authorised baseline configurations for systems\n- what constitutes routine and urgent changes to the configuration of systems\n- how changes to the configuration of systems will be requested, tracked and documented\n- who needs to be consulted prior to routine and urgent changes to the configuration of systems\n- who needs to approve routine and urgent changes to the configuration of systems\n- who needs to be notified of routine and urgent changes to the configuration of systems\n- what additional change management and configuration management processes and procedures need to be followed before, during and after routine and urgent changes to the configuration of systems.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security documentation","System-specific cyber security documentation","Change and configuration management plan"]},"latticework_interpretation":null},{"id":"ISM-0917","url":"https://latticeworksystems.com.au/ism/ism-0917/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0917.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0917.md","official":{"statement":"When malicious code is detected, the following steps are taken to handle the infection:\n\n- the infected systems are isolated\n- all previously connected media used in the period leading up to the infection are scanned for signs of infection and isolated if necessary\n- antivirus applications are used to remove the infection from infected systems and media\n- if the infection cannot be reliably removed, systems are restored from a known good backup or rebuilt.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security incidents","Responding to cyber security incidents","Handling and containing malicious code infections"]},"latticework_interpretation":null},{"id":"ISM-0926","url":"https://latticeworksystems.com.au/ism/ism-0926/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0926.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0926.md","official":{"statement":"Non-classified, OFFICIAL: Sensitive and PROTECTED cables are coloured neither salmon pink nor red.","statement_format":"OSCAL markup-multiline","revision":"11","updated":"Dec-24","applicability":["NC","OS","P"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Cable colours"]},"latticework_interpretation":null},{"id":"ISM-0931","url":"https://latticeworksystems.com.au/ism/ism-0931/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0931.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0931.md","official":{"statement":"In SECRET and TOP SECRET areas, push-to-talk handsets or push-to-talk headsets are used to meet any off-hook audio protection requirements.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Telephone systems","Off-hook audio protection"]},"latticework_interpretation":null},{"id":"ISM-0938","url":"https://latticeworksystems.com.au/ism/ism-0938/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0938.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0938.md","official":{"statement":"Vendors that have demonstrated a commitment to Secure by Design and Secure by Default principles and practices, including secure programming practices and either memory-safe programming languages or less preferably memory-safe programming practices, are used for user applications.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Mar-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","User application hardening","User application selection"]},"latticework_interpretation":null},{"id":"ISM-0947","url":"https://latticeworksystems.com.au/ism/ism-0947/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0947.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0947.md","official":{"statement":"When transferring data manually between two systems belonging to different security domains, rewritable media is sanitised after each data transfer.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Apr-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media usage","Using media for data transfers"]},"latticework_interpretation":null},{"id":"ISM-0955","url":"https://latticeworksystems.com.au/ism/ism-0955/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0955.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0955.md","official":{"statement":"Application control is implemented using cryptographic hash rules, publisher certificate rules or path rules.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Apr-20","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Application control"]},"latticework_interpretation":null},{"id":"ISM-0958","url":"https://latticeworksystems.com.au/ism/ism-0958/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0958.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0958.md","official":{"statement":"An organisation-approved list of domain names, or list of website categories, is implemented for all Hypertext Transfer Protocol and Hypertext Transfer Protocol Secure traffic communicated through gateways.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Web content filters","Allowing and blocking access to domain names"]},"latticework_interpretation":null},{"id":"ISM-0961","url":"https://latticeworksystems.com.au/ism/ism-0961/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0961.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0961.md","official":{"statement":"Client-side active content is restricted by web content filters to an organisation-approved list of domain names.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Web content filters","Using web content filters"]},"latticework_interpretation":null},{"id":"ISM-0963","url":"https://latticeworksystems.com.au/ism/ism-0963/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0963.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0963.md","official":{"statement":"Web content filtering is implemented to filter potentially harmful web-based content.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Web content filters","Using web content filters"]},"latticework_interpretation":null},{"id":"ISM-0971","url":"https://latticeworksystems.com.au/ism/ism-0971/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0971.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0971.md","official":{"statement":"The OWASP Application Security Verification Standard is used in the development of web applications.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Mar-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Web application development","Secure web application design and development"]},"latticework_interpretation":null},{"id":"ISM-0974","url":"https://latticeworksystems.com.au/ism/ism-0974/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0974.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0974.md","official":{"statement":"Multi-factor authentication is used to authenticate unprivileged human users of systems.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system access","Identity and access management","Multi-factor authentication"]},"latticework_interpretation":null},{"id":"ISM-0988","url":"https://latticeworksystems.com.au/ism/ism-0988/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0988.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0988.md","official":{"statement":"An accurate and consistent time source is used for event logging.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for security assurance","Security monitoring","Centralised event logging facility"]},"latticework_interpretation":null},{"id":"ISM-0994","url":"https://latticeworksystems.com.au/ism/ism-0994/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0994.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0994.md","official":{"statement":"ECDH is used in preference to DH.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Mar-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic algorithms","Asymmetric cryptographic algorithms"]},"latticework_interpretation":null},{"id":"ISM-0998","url":"https://latticeworksystems.com.au/ism/ism-0998/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0998.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0998.md","official":{"statement":"AUTH_HMAC_SHA2_256_128, AUTH_HMAC_SHA2_384_192, AUTH_HMAC_SHA2_512_256 or NONE (only with AES-GCM) is used for authenticating IPsec connections, preferably NONE.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Internet Protocol Security","Integrity algorithms"]},"latticework_interpretation":null},{"id":"ISM-0999","url":"https://latticeworksystems.com.au/ism/ism-0999/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0999.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-0999.md","official":{"statement":"DH or ECDH is used for key establishment of IPsec connections, preferably 384-bit random ECP group, 3072-bit MODP Group or 4096-bit MODP Group.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Internet Protocol Security","Diffie-Hellman groups"]},"latticework_interpretation":null},{"id":"ISM-1000","url":"https://latticeworksystems.com.au/ism/ism-1000/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1000.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1000.md","official":{"statement":"PFS is used for IPsec connections.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Sep-18","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Internet Protocol Security","Perfect Forward Secrecy"]},"latticework_interpretation":null},{"id":"ISM-1006","url":"https://latticeworksystems.com.au/ism/ism-1006/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1006.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1006.md","official":{"statement":"Security measures are implemented to prevent unauthorised access to network management traffic.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Sep-18","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Network management traffic"]},"latticework_interpretation":null},{"id":"ISM-1013","url":"https://latticeworksystems.com.au/ism/ism-1013/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1013.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1013.md","official":{"statement":"The effective range of wireless communications outside an organisation’s area of control is limited by implementing RF shielding on facilities in which SECRET or TOP SECRET wireless networks are used.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-21","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Wireless networks","Wireless network footprint"]},"latticework_interpretation":null},{"id":"ISM-1014","url":"https://latticeworksystems.com.au/ism/ism-1014/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1014.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1014.md","official":{"statement":"Individual logins are implemented for IP phones used for SECRET or TOP SECRET conversations.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-21","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Video conferencing and Internet Protocol telephony","Video conferencing unit and Internet Protocol phone authentication"]},"latticework_interpretation":null},{"id":"ISM-1019","url":"https://latticeworksystems.com.au/ism/ism-1019/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1019.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1019.md","official":{"statement":"A denial of service response plan for video conferencing and IP telephony services is developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"9","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Video conferencing and Internet Protocol telephony","Denial of service response plan"]},"latticework_interpretation":null},{"id":"ISM-1023","url":"https://latticeworksystems.com.au/ism/ism-1023/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1023.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1023.md","official":{"statement":"The intended recipients of blocked inbound emails, and the senders of blocked outbound emails, are notified.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for email","Email usage","Handling emails with inappropriate, invalid or missing protective markings"]},"latticework_interpretation":null},{"id":"ISM-1024","url":"https://latticeworksystems.com.au/ism/ism-1024/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1024.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1024.md","official":{"statement":"Notifications of undeliverable emails are only sent to senders that can be verified via SPF or other trusted means.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for email","Email gateways and servers","Notifications of undeliverable emails"]},"latticework_interpretation":null},{"id":"ISM-1026","url":"https://latticeworksystems.com.au/ism/ism-1026/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1026.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1026.md","official":{"statement":"DKIM signatures on incoming emails are verified.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Jun-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for email","Email gateways and servers","DomainKeys Identified Mail"]},"latticework_interpretation":null},{"id":"ISM-1027","url":"https://latticeworksystems.com.au/ism/ism-1027/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1027.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1027.md","official":{"statement":"Email distribution list applications used by external senders is configured such that it does not break the validity of the sender’s DKIM signature.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for email","Email gateways and servers","DomainKeys Identified Mail"]},"latticework_interpretation":null},{"id":"ISM-1028","url":"https://latticeworksystems.com.au/ism/ism-1028/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1028.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1028.md","official":{"statement":"A NIDS or NIPS is deployed in gateways between an organisation’s networks and other networks they do not manage.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Using network-based intrusion detection and prevention systems"]},"latticework_interpretation":null},{"id":"ISM-1030","url":"https://latticeworksystems.com.au/ism/ism-1030/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1030.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1030.md","official":{"statement":"A NIDS or NIPS is located immediately inside the outermost firewall for gateways and configured to generate event logs and alerts for network traffic that contravenes any rule in a firewall ruleset.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Using network-based intrusion detection and prevention systems"]},"latticework_interpretation":null},{"id":"ISM-1034","url":"https://latticeworksystems.com.au/ism/ism-1034/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1034.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1034.md","official":{"statement":"A HIPS or EDR solution is implemented on critical servers and high-value servers.","statement_format":"OSCAL markup-multiline","revision":"8","updated":"Mar-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Host-based intrusion detection and response solution"]},"latticework_interpretation":null},{"id":"ISM-1036","url":"https://latticeworksystems.com.au/ism/ism-1036/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1036.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1036.md","official":{"statement":"MFDs are placed in areas where their use can be observed.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Multifunction devices","Observing multifunction device use"]},"latticework_interpretation":null},{"id":"ISM-1037","url":"https://latticeworksystems.com.au/ism/ism-1037/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1037.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1037.md","official":{"statement":"Gateways undergo testing following configuration changes, and at regular intervals no more than six months apart, to validate that they conform to expected security configurations.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Gateways","Assessment of gateways"]},"latticework_interpretation":null},{"id":"ISM-1053","url":"https://latticeworksystems.com.au/ism/ism-1053/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1053.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1053.md","official":{"statement":"Classified servers, network devices and cryptographic equipment are secured in server rooms or communications rooms that meet the requirements for a security zone suitable for their classification.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Dec-24","applicability":["OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for physical security","Facilities and systems","Physical access to servers, network devices and cryptographic equipment"]},"latticework_interpretation":null},{"id":"ISM-1055","url":"https://latticeworksystems.com.au/ism/ism-1055/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1055.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1055.md","official":{"statement":"LAN Manager and NT LAN Manager authentication methods are disabled.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Oct-20","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Insecure authentication methods"]},"latticework_interpretation":null},{"id":"ISM-1059","url":"https://latticeworksystems.com.au/ism/ism-1059/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1059.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1059.md","official":{"statement":"All data stored on media is encrypted using ASD-approved cryptography.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media usage","Encrypting media"]},"latticework_interpretation":null},{"id":"ISM-1065","url":"https://latticeworksystems.com.au/ism/ism-1065/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1065.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1065.md","official":{"statement":"The host-protected area and device configuration overlay table are reset prior to the sanitisation of non-volatile magnetic hard drives.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media sanitisation","Non-volatile magnetic media sanitisation"]},"latticework_interpretation":null},{"id":"ISM-1067","url":"https://latticeworksystems.com.au/ism/ism-1067/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1067.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1067.md","official":{"statement":"The ATA secure erase command is used, in addition to block overwriting software, to ensure the growth defects table of non-volatile magnetic hard drives is overwritten.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media sanitisation","Non-volatile magnetic media sanitisation"]},"latticework_interpretation":null},{"id":"ISM-1071","url":"https://latticeworksystems.com.au/ism/ism-1071/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1071.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1071.md","official":{"statement":"Each system has a designated system owner.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-18","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","System owners","System ownership and oversight"]},"latticework_interpretation":null},{"id":"ISM-1073","url":"https://latticeworksystems.com.au/ism/ism-1073/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1073.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1073.md","official":{"statement":"An organisation’s systems are not accessed or administered by a service provider unless a contractual arrangement exists between the organisation and the service provider to do so.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Managed services and cloud services","Access to systems by service providers"]},"latticework_interpretation":null},{"id":"ISM-1074","url":"https://latticeworksystems.com.au/ism/ism-1074/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1074.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1074.md","official":{"statement":"Keys or equivalent access mechanisms to server rooms, communications rooms and security containers are appropriately controlled.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for physical security","Facilities and systems","Physical access to servers, network devices and cryptographic equipment"]},"latticework_interpretation":null},{"id":"ISM-1076","url":"https://latticeworksystems.com.au/ism/ism-1076/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1076.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1076.md","official":{"statement":"Televisions and computer monitors with minor burn-in or image persistence are sanitised by displaying a solid white image on the screen for an extended period.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment sanitisation and destruction","Sanitising televisions and computer monitors"]},"latticework_interpretation":null},{"id":"ISM-1078","url":"https://latticeworksystems.com.au/ism/ism-1078/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1078.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1078.md","official":{"statement":"A telephone system usage policy is developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Telephone systems","Telephone system usage policy"]},"latticework_interpretation":null},{"id":"ISM-1079","url":"https://latticeworksystems.com.au/ism/ism-1079/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1079.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1079.md","official":{"statement":"ASD’s approval is sought before undertaking any maintenance or repairs to high assurance IT equipment.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Jun-24","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment maintenance or repairs","Maintenance or repairs of high assurance IT equipment"]},"latticework_interpretation":null},{"id":"ISM-1080","url":"https://latticeworksystems.com.au/ism/ism-1080/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1080.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1080.md","official":{"statement":"An AACA or high assurance cryptographic algorithm is used when encrypting data at rest.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic algorithms","Using cryptographic algorithms"]},"latticework_interpretation":null},{"id":"ISM-1082","url":"https://latticeworksystems.com.au/ism/ism-1082/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1082.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1082.md","official":{"statement":"A mobile device usage policy is developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device usage","Mobile device usage policy"]},"latticework_interpretation":null},{"id":"ISM-1083","url":"https://latticeworksystems.com.au/ism/ism-1083/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1083.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1083.md","official":{"statement":"Personnel are advised of the sensitivity or classification permitted for voice and data communications when using mobile devices.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-18","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device usage","Personnel awareness"]},"latticework_interpretation":null},{"id":"ISM-1084","url":"https://latticeworksystems.com.au/ism/ism-1084/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1084.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1084.md","official":{"statement":"If unable to carry or store mobile devices in a secured state, they are physically transferred in a security briefcase or an approved multi-use satchel, pouch or transit bag.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device usage","Maintaining control of mobile devices"]},"latticework_interpretation":null},{"id":"ISM-1085","url":"https://latticeworksystems.com.au/ism/ism-1085/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1085.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1085.md","official":{"statement":"Mobile devices encrypt all sensitive or classified data communicated over public network infrastructure using ASD-approved cryptography.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device management","Encrypted communications"]},"latticework_interpretation":null},{"id":"ISM-1088","url":"https://latticeworksystems.com.au/ism/ism-1088/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1088.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1088.md","official":{"statement":"Personnel report the potential compromise of mobile devices, removable media or credentials to their organisation as soon as possible, especially if they:\n\n- provide credentials to foreign government officials\n- decrypt mobile devices for foreign government officials\n- have mobile devices taken out of sight by foreign government officials\n- have mobile devices or removable media stolen, including if later returned\n- lose mobile devices or removable media, including if later found\n- observe unusual behaviour of mobile devices.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Sep-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device usage","While travelling overseas with mobile devices"]},"latticework_interpretation":null},{"id":"ISM-1089","url":"https://latticeworksystems.com.au/ism/ism-1089/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1089.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1089.md","official":{"statement":"When replying to or forwarding emails, protective marking tools do not allow the selection of protective markings lower than previously used.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for email","Email usage","Protective marking tools"]},"latticework_interpretation":null},{"id":"ISM-1091","url":"https://latticeworksystems.com.au/ism/ism-1091/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1091.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1091.md","official":{"statement":"Keying material is changed when compromised or suspected of being compromised.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic fundamentals","Reporting cryptographic-related cyber security incidents"]},"latticework_interpretation":null},{"id":"ISM-1095","url":"https://latticeworksystems.com.au/ism/ism-1095/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1095.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1095.md","official":{"statement":"Wall outlet boxes denote the systems, cable identifiers and wall outlet box identifier.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Labelling wall outlet boxes"]},"latticework_interpretation":null},{"id":"ISM-1096","url":"https://latticeworksystems.com.au/ism/ism-1096/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1096.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1096.md","official":{"statement":"Cables are labelled at each end with sufficient source and destination details to enable the physical identification and inspection of the cable.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Oct-19","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Labelling cables"]},"latticework_interpretation":null},{"id":"ISM-1098","url":"https://latticeworksystems.com.au/ism/ism-1098/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1098.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1098.md","official":{"statement":"SECRET cables are terminated in an individual cabinet; or for small systems, a cabinet with a division plate between any SECRET cables and non-SECRET cables.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Mar-23","applicability":["S"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Terminating cables in cabinets"]},"latticework_interpretation":null},{"id":"ISM-1100","url":"https://latticeworksystems.com.au/ism/ism-1100/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1100.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1100.md","official":{"statement":"TOP SECRET cables are terminated in an individual TOP SECRET cabinet.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-18","applicability":["TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Terminating cables in cabinets"]},"latticework_interpretation":null},{"id":"ISM-1101","url":"https://latticeworksystems.com.au/ism/ism-1101/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1101.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1101.md","official":{"statement":"In TOP SECRET areas, cable reticulation systems leading into cabinets in server rooms or communications rooms are terminated as close as possible to the cabinet.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Connecting cable reticulation systems to cabinets"]},"latticework_interpretation":null},{"id":"ISM-1102","url":"https://latticeworksystems.com.au/ism/ism-1102/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1102.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1102.md","official":{"statement":"Cable reticulation systems leading into cabinets are terminated as close as possible to the cabinet.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Connecting cable reticulation systems to cabinets"]},"latticework_interpretation":null},{"id":"ISM-1103","url":"https://latticeworksystems.com.au/ism/ism-1103/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1103.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1103.md","official":{"statement":"In TOP SECRET areas, cable reticulation systems leading into cabinets not in server rooms or communications rooms are terminated at the boundary of the cabinet.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Connecting cable reticulation systems to cabinets"]},"latticework_interpretation":null},{"id":"ISM-1105","url":"https://latticeworksystems.com.au/ism/ism-1105/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1105.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1105.md","official":{"statement":"SECRET and TOP SECRET wall outlet boxes contain exclusively SECRET or TOP SECRET cables.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Mar-23","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Wall outlet boxes"]},"latticework_interpretation":null},{"id":"ISM-1107","url":"https://latticeworksystems.com.au/ism/ism-1107/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1107.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1107.md","official":{"statement":"Non-classified, OFFICIAL: Sensitive and PROTECTED wall outlet boxes are coloured neither salmon pink nor red.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Dec-24","applicability":["NC","OS","P"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Wall outlet box colours"]},"latticework_interpretation":null},{"id":"ISM-1109","url":"https://latticeworksystems.com.au/ism/ism-1109/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1109.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1109.md","official":{"statement":"Wall outlet box covers are clear plastic.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-19","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Wall outlet box covers"]},"latticework_interpretation":null},{"id":"ISM-1111","url":"https://latticeworksystems.com.au/ism/ism-1111/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1111.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1111.md","official":{"statement":"Fibre-optic cables are used for cabling infrastructure instead of copper cables.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Mar-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Use of fibre-optic cables"]},"latticework_interpretation":null},{"id":"ISM-1112","url":"https://latticeworksystems.com.au/ism/ism-1112/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1112.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1112.md","official":{"statement":"Cables in non-TOP SECRET areas are inspectable every five metres or less.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-24","applicability":["NC","OS","P","S"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Cable inspectability"]},"latticework_interpretation":null},{"id":"ISM-1114","url":"https://latticeworksystems.com.au/ism/ism-1114/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1114.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1114.md","official":{"statement":"Cable bundles or conduits sharing a common cable reticulation system have a dividing partition or visible gap between each cable bundle and conduit.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Mar-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Common cable reticulation systems"]},"latticework_interpretation":null},{"id":"ISM-1115","url":"https://latticeworksystems.com.au/ism/ism-1115/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1115.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1115.md","official":{"statement":"Cables from cable trays to wall outlet boxes are run in flexible or plastic conduit.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-19","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Cables in walls"]},"latticework_interpretation":null},{"id":"ISM-1116","url":"https://latticeworksystems.com.au/ism/ism-1116/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1116.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1116.md","official":{"statement":"A visible gap exists between TOP SECRET cabinets and non-TOP SECRET cabinets.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Mar-23","applicability":["TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Physical separation of cabinets and patch panels"]},"latticework_interpretation":null},{"id":"ISM-1119","url":"https://latticeworksystems.com.au/ism/ism-1119/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1119.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1119.md","official":{"statement":"Cables in TOP SECRET areas are fully inspectable for their entire length.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Cable inspectability"]},"latticework_interpretation":null},{"id":"ISM-1122","url":"https://latticeworksystems.com.au/ism/ism-1122/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1122.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1122.md","official":{"statement":"Where wall penetrations exit a TOP SECRET area into a lower classified area, TOP SECRET cables are encased in conduit with all gaps between the TOP SECRET conduit and the wall filled with an appropriate sealing compound.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Dec-21","applicability":["TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Wall penetrations"]},"latticework_interpretation":null},{"id":"ISM-1123","url":"https://latticeworksystems.com.au/ism/ism-1123/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1123.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1123.md","official":{"statement":"A power distribution board with a feed from an Uninterruptible Power Supply is used to power all TOP SECRET IT equipment.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Jun-24","applicability":["TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Power reticulation"]},"latticework_interpretation":null},{"id":"ISM-1130","url":"https://latticeworksystems.com.au/ism/ism-1130/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1130.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1130.md","official":{"statement":"In shared facilities, cables are run in an enclosed cable reticulation system.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Enclosed cable reticulation systems"]},"latticework_interpretation":null},{"id":"ISM-1133","url":"https://latticeworksystems.com.au/ism/ism-1133/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1133.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1133.md","official":{"statement":"In shared facilities, TOP SECRET cables are not run in party walls.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-21","applicability":["TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Cables in party walls"]},"latticework_interpretation":null},{"id":"ISM-1137","url":"https://latticeworksystems.com.au/ism/ism-1137/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1137.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1137.md","official":{"statement":"System owners deploying SECRET or TOP SECRET systems within fixed facilities contact ASD for an emanation security risk assessment.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Mar-26","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Emanation security","Emanation security risk assessments"]},"latticework_interpretation":null},{"id":"ISM-1139","url":"https://latticeworksystems.com.au/ism/ism-1139/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1139.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1139.md","official":{"statement":"Only the latest version of TLS is used for TLS connections.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Transport Layer Security","Configuring Transport Layer Security"]},"latticework_interpretation":null},{"id":"ISM-1143","url":"https://latticeworksystems.com.au/ism/ism-1143/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1143.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1143.md","official":{"statement":"Patch management processes, and supporting patch management procedures, are developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"9","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system management","System maintenance","Patch management processes and procedures"]},"latticework_interpretation":null},{"id":"ISM-1145","url":"https://latticeworksystems.com.au/ism/ism-1145/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1145.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1145.md","official":{"statement":"Privacy filters are applied to the screens of SECRET and TOP SECRET mobile devices.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-21","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device usage","Using mobile devices in public spaces"]},"latticework_interpretation":null},{"id":"ISM-1146","url":"https://latticeworksystems.com.au/ism/ism-1146/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1146.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1146.md","official":{"statement":"Personnel are advised to maintain separate personal user accounts from any work user accounts they use for online services.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for personnel security","Cyber security awareness training","Posting personal information on online services"]},"latticework_interpretation":null},{"id":"ISM-1151","url":"https://latticeworksystems.com.au/ism/ism-1151/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1151.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1151.md","official":{"statement":"SPF is used to verify the authenticity of incoming emails.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Oct-19","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for email","Email gateways and servers","Sender Policy Framework"]},"latticework_interpretation":null},{"id":"ISM-1157","url":"https://latticeworksystems.com.au/ism/ism-1157/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1157.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1157.md","official":{"statement":"Evaluated diodes are used for controlling the data flow of unidirectional gateways between networks.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Diodes","Using diodes"]},"latticework_interpretation":null},{"id":"ISM-1158","url":"https://latticeworksystems.com.au/ism/ism-1158/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1158.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1158.md","official":{"statement":"Evaluated diodes used for controlling the data flow of unidirectional gateways between SECRET or TOP SECRET networks and any other networks complete a high assurance evaluation.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Mar-22","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Diodes","Using diodes"]},"latticework_interpretation":null},{"id":"ISM-1160","url":"https://latticeworksystems.com.au/ism/ism-1160/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1160.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1160.md","official":{"statement":"If using degaussers to destroy media, degaussers evaluated by the United States’ National Security Agency are used.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Aug-20","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media destruction","Media destruction equipment"]},"latticework_interpretation":null},{"id":"ISM-1163","url":"https://latticeworksystems.com.au/ism/ism-1163/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1163.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1163.md","official":{"statement":"Systems have a continuous monitoring plan that includes:\n\n- conducting security assessment activities to identify vulnerabilities\n- analysing identified vulnerabilities to determine their potential impact\n- implementing mitigations based on risk, effectiveness and cost.","statement_format":"OSCAL markup-multiline","revision":"11","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security documentation","System-specific cyber security documentation","Continuous monitoring plan"]},"latticework_interpretation":null},{"id":"ISM-1164","url":"https://latticeworksystems.com.au/ism/ism-1164/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1164.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1164.md","official":{"statement":"In shared facilities, conduits or the front covers of ducts, cable trays in floors and ceilings, and associated fittings are clear plastic.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Covers for enclosed cable reticulation systems"]},"latticework_interpretation":null},{"id":"ISM-1171","url":"https://latticeworksystems.com.au/ism/ism-1171/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1171.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1171.md","official":{"statement":"Attempts to access websites through their IP addresses instead of their domain names are blocked by web content filters.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Web content filters","Allowing and blocking access to domain names"]},"latticework_interpretation":null},{"id":"ISM-1173","url":"https://latticeworksystems.com.au/ism/ism-1173/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1173.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1173.md","official":{"statement":"Multi-factor authentication is used to authenticate privileged human users of systems.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system access","Identity and access management","Multi-factor authentication"]},"latticework_interpretation":null},{"id":"ISM-1175","url":"https://latticeworksystems.com.au/ism/ism-1175/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1175.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1175.md","official":{"statement":"Privileged user accounts (excluding those explicitly authorised to access online services) are prevented from accessing the internet, email and web services.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system access","Identity and access management","Privileged access to systems"]},"latticework_interpretation":null},{"id":"ISM-1178","url":"https://latticeworksystems.com.au/ism/ism-1178/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1178.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1178.md","official":{"statement":"Network documentation provided to a third party, or published in public tender documentation, only contains details necessary for other parties to undertake contractual services.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Sep-18","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Network documentation"]},"latticework_interpretation":null},{"id":"ISM-1181","url":"https://latticeworksystems.com.au/ism/ism-1181/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1181.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1181.md","official":{"statement":"Networks are segregated into multiple network zones according to the criticality of servers, services and data.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Network segmentation and segregation"]},"latticework_interpretation":null},{"id":"ISM-1182","url":"https://latticeworksystems.com.au/ism/ism-1182/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1182.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1182.md","official":{"statement":"Network access controls are implemented to limit the flow of network traffic within and between network segments to only that required for business purposes.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Sep-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Network access controls"]},"latticework_interpretation":{"title":"Restrict workload traffic and test the actual path","implementation_steps":["Agree the required source, destination, port and protocol flows with service owners. Start with a non-production namespace.","Apply ingress and egress NetworkPolicies for those flows. Confirm that the cluster network plugin enforces NetworkPolicy before promoting changes."],"evidence_to_retain":["Keep the reviewed flow matrix, versioned manifests, cluster/plugin version and a dated scan with its namespace exclusions.","Capture successful approved connections and failed prohibited connections from representative workloads. Include node firewall evidence separately where the control requires it."],"responsibility_boundary":"Platform team: network plugin and network baseline. Workload team: required application flows and service tests. Organisation: approved business need and exceptions.","checks":[{"engine":"kubescape","name":"ism-network-policy-coverage"}],"coverage":"partial","limitations":"Findings show whether Kubernetes workloads are selected by ingress and egress NetworkPolicies; they do not prove that allowed flows match business need or that the cluster network plugin enforces the policies.","responsibility_allocation":{"eks":"customer-platform","self-managed":"customer-platform","source":"provisional","notes":"Provisional allocation for the detector evidence only. No provider inheritance or whole-control ownership is established until an authorised CSCM and the engagement boundary are reviewed."},"mapping_source":{"repository":"https://github.com/Latticework-Systems/ism-kubernetes-controls","revision":"07b348a2952bf2d0e78d9e739f367cb0919ab888","url":"https://github.com/Latticework-Systems/ism-kubernetes-controls/blob/07b348a2952bf2d0e78d9e739f367cb0919ab888/mapping/ism-mapping.yaml","sha256":"f823681fd71e40e589aae714ef2215dd8dc33722a1ec70b81ded5b2322937470"}}},{"id":"ISM-1183","url":"https://latticeworksystems.com.au/ism/ism-1183/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1183.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1183.md","official":{"statement":"A hard fail SPF record is used when specifying authorised email servers (or lack thereof) for an organisation’s domains (including subdomains).","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for email","Email gateways and servers","Sender Policy Framework"]},"latticework_interpretation":null},{"id":"ISM-1186","url":"https://latticeworksystems.com.au/ism/ism-1186/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1186.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1186.md","official":{"statement":"IPv6 capable network security appliances are used on IPv6 and dual-stack networks.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Using Internet Protocol version 6"]},"latticework_interpretation":null},{"id":"ISM-1187","url":"https://latticeworksystems.com.au/ism/ism-1187/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1187.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1187.md","official":{"statement":"When manually exporting data from systems, the data is checked for unsuitable protective markings.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for data transfers","Data transfers","Manual export of data"]},"latticework_interpretation":null},{"id":"ISM-1192","url":"https://latticeworksystems.com.au/ism/ism-1192/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1192.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1192.md","official":{"statement":"Gateways inspect and filter data flows at the transport and above network layers.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Gateways","Implementing gateways"]},"latticework_interpretation":null},{"id":"ISM-1195","url":"https://latticeworksystems.com.au/ism/ism-1195/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1195.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1195.md","official":{"statement":"Mobile Device Management solutions that have completed a Common Criteria evaluation against the Protection Profile for Mobile Device Management, version 4.0 or later, are used to enforce mobile device management policy.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device management","Mobile device management policy"]},"latticework_interpretation":null},{"id":"ISM-1196","url":"https://latticeworksystems.com.au/ism/ism-1196/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1196.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1196.md","official":{"statement":"Non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices are configured to remain undiscoverable to other Bluetooth devices except during Bluetooth pairing.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-24","applicability":["NC","OS","P"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device usage","Using Bluetooth functionality"]},"latticework_interpretation":null},{"id":"ISM-1198","url":"https://latticeworksystems.com.au/ism/ism-1198/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1198.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1198.md","official":{"statement":"Bluetooth pairing for non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices is performed in a manner such that connections are only made between intended Bluetooth devices.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-24","applicability":["NC","OS","P"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device usage","Using Bluetooth functionality"]},"latticework_interpretation":null},{"id":"ISM-1199","url":"https://latticeworksystems.com.au/ism/ism-1199/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1199.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1199.md","official":{"statement":"Bluetooth pairings for non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices are removed when there is no longer a requirement for their use.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Dec-24","applicability":["NC","OS","P"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device usage","Using Bluetooth functionality"]},"latticework_interpretation":null},{"id":"ISM-1200","url":"https://latticeworksystems.com.au/ism/ism-1200/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1200.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1200.md","official":{"statement":"Bluetooth pairing for non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices is performed using Secure Connections, preferably with Numeric Comparison if supported.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Dec-24","applicability":["NC","OS","P"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device usage","Using Bluetooth functionality"]},"latticework_interpretation":null},{"id":"ISM-1203","url":"https://latticeworksystems.com.au/ism/ism-1203/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1203.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1203.md","official":{"statement":"System owners, in consultation with each system’s authorising officer, conduct a threat and risk assessment for each system.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","System owners","Protecting systems and their resources"]},"latticework_interpretation":null},{"id":"ISM-1211","url":"https://latticeworksystems.com.au/ism/ism-1211/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1211.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1211.md","official":{"statement":"System administration activities are performed in accordance with the system’s change and configuration management plan.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system management","System administration","System administration processes and procedures"]},"latticework_interpretation":null},{"id":"ISM-1213","url":"https://latticeworksystems.com.au/ism/ism-1213/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1213.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1213.md","official":{"statement":"Following intrusion remediation activities, enhanced monitoring is conducted until there is sufficient evidence-based confidence that malicious actors have been eradicated from a system and have not re-established access.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security incidents","Responding to cyber security incidents","Handling and containing intrusions"]},"latticework_interpretation":null},{"id":"ISM-1216","url":"https://latticeworksystems.com.au/ism/ism-1216/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1216.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1216.md","official":{"statement":"SECRET and TOP SECRET cables with non-conformant cable colouring are banded with the appropriate colour and labelled at inspection points.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Jun-24","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Cable colour non-conformance"]},"latticework_interpretation":null},{"id":"ISM-1217","url":"https://latticeworksystems.com.au/ism/ism-1217/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1217.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1217.md","official":{"statement":"Labels and markings indicating the owner, sensitivity, classification or any other marking that can associate IT equipment with its prior use are removed prior to its disposal.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment disposal","Disposal of IT equipment"]},"latticework_interpretation":null},{"id":"ISM-1218","url":"https://latticeworksystems.com.au/ism/ism-1218/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1218.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1218.md","official":{"statement":"IT equipment, including associated media, that is located overseas and has processed, stored or communicated AUSTEO or AGAO data, is sanitised in situ.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Jun-24","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment sanitisation and destruction","Sanitising highly sensitive IT equipment"]},"latticework_interpretation":null},{"id":"ISM-1219","url":"https://latticeworksystems.com.au/ism/ism-1219/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1219.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1219.md","official":{"statement":"MFD print drums and image transfer rollers are inspected and destroyed if there is remnant toner that cannot be removed or a print is visible on the image transfer roller.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment sanitisation and destruction","Sanitising printers and multifunction devices"]},"latticework_interpretation":null},{"id":"ISM-1220","url":"https://latticeworksystems.com.au/ism/ism-1220/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1220.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1220.md","official":{"statement":"Printer and MFD platens are inspected and destroyed if any text or images are retained on the platen.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment sanitisation and destruction","Sanitising printers and multifunction devices"]},"latticework_interpretation":null},{"id":"ISM-1221","url":"https://latticeworksystems.com.au/ism/ism-1221/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1221.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1221.md","official":{"statement":"Printers and MFDs are checked to ensure no pages are trapped in the paper path due to a paper jam.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-18","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment sanitisation and destruction","Sanitising printers and multifunction devices"]},"latticework_interpretation":null},{"id":"ISM-1222","url":"https://latticeworksystems.com.au/ism/ism-1222/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1222.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1222.md","official":{"statement":"Televisions and computer monitors that cannot be sanitised are destroyed.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-18","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment sanitisation and destruction","Sanitising televisions and computer monitors"]},"latticework_interpretation":null},{"id":"ISM-1223","url":"https://latticeworksystems.com.au/ism/ism-1223/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1223.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1223.md","official":{"statement":"Memory in network devices is sanitised using the following processes, in order of preference:\n\n- following device-specific guidance provided in evaluation documentation\n- following vendor sanitisation guidance\n- loading a dummy configuration file, performing a factory reset and then reinstalling firmware.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment sanitisation and destruction","Sanitising network devices"]},"latticework_interpretation":null},{"id":"ISM-1227","url":"https://latticeworksystems.com.au/ism/ism-1227/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1227.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1227.md","official":{"statement":"Credentials set for user accounts are randomly generated.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Setting credentials for user accounts"]},"latticework_interpretation":null},{"id":"ISM-1228","url":"https://latticeworksystems.com.au/ism/ism-1228/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1228.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1228.md","official":{"statement":"Cyber security events are analysed in a timely manner to identify cyber security incidents.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for security assurance","Security monitoring","Event log monitoring"]},"latticework_interpretation":null},{"id":"ISM-1233","url":"https://latticeworksystems.com.au/ism/ism-1233/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1233.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1233.md","official":{"statement":"IKE version 2 is used for key exchange when establishing IPsec connections.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Internet Protocol Security","Key exchange"]},"latticework_interpretation":null},{"id":"ISM-1234","url":"https://latticeworksystems.com.au/ism/ism-1234/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1234.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1234.md","official":{"statement":"Email content filtering is implemented to filter potentially harmful content in email bodies and attachments.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for email","Email gateways and servers","Email content filtering"]},"latticework_interpretation":null},{"id":"ISM-1235","url":"https://latticeworksystems.com.au/ism/ism-1235/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1235.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1235.md","official":{"statement":"Extensions for user applications are restricted to an organisation-approved set.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","User application hardening","Hardening user application configurations"]},"latticework_interpretation":null},{"id":"ISM-1236","url":"https://latticeworksystems.com.au/ism/ism-1236/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1236.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1236.md","official":{"statement":"Malicious domain names, dynamic domain names and domain names that can be registered anonymously for free are blocked by web content filters.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Web content filters","Allowing and blocking access to domain names"]},"latticework_interpretation":null},{"id":"ISM-1237","url":"https://latticeworksystems.com.au/ism/ism-1237/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1237.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1237.md","official":{"statement":"Web content filtering is applied to outbound web traffic where appropriate.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Web content filters","Using web content filters"]},"latticework_interpretation":null},{"id":"ISM-1238","url":"https://latticeworksystems.com.au/ism/ism-1238/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1238.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1238.md","official":{"statement":"Threat modelling is used in support of the software development life cycle.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Secure software development"]},"latticework_interpretation":null},{"id":"ISM-1239","url":"https://latticeworksystems.com.au/ism/ism-1239/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1239.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1239.md","official":{"statement":"Robust web application frameworks are used in the development of web applications.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Web application development","Secure web application design and development"]},"latticework_interpretation":null},{"id":"ISM-1240","url":"https://latticeworksystems.com.au/ism/ism-1240/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1240.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1240.md","official":{"statement":"Validation and sanitisation are performed on all input received over the internet by software.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Software input handling"]},"latticework_interpretation":null},{"id":"ISM-1241","url":"https://latticeworksystems.com.au/ism/ism-1241/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1241.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1241.md","official":{"statement":"Output encoding is performed on all output produced by web applications.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Web application development","Web application output encoding"]},"latticework_interpretation":null},{"id":"ISM-1243","url":"https://latticeworksystems.com.au/ism/ism-1243/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1243.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1243.md","official":{"statement":"A database register is developed, implemented, maintained and regularly verified.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for database systems","Databases","Database register"]},"latticework_interpretation":null},{"id":"ISM-1245","url":"https://latticeworksystems.com.au/ism/ism-1245/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1245.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1245.md","official":{"statement":"All temporary installation files created during server application installation processes are removed after server applications have been installed.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Hardening server application configurations"]},"latticework_interpretation":null},{"id":"ISM-1246","url":"https://latticeworksystems.com.au/ism/ism-1246/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1246.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1246.md","official":{"statement":"Server applications are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Hardening server application configurations"]},"latticework_interpretation":{"title":"Set and verify workload isolation defaults","implementation_steps":["Review ASD and vendor hardening guidance for the workload and runtime. Record conflicts and approved exceptions before changing production.","Set non-root execution, a read-only root filesystem, no privilege escalation, restricted capabilities and an appropriate seccomp profile. Remove unnecessary host namespace and hostPath access. Test application compatibility and admission enforcement."],"evidence_to_retain":["Keep the guidance review, pinned policy revision, admitted workload manifests and dated scan or PolicyReport with exclusions.","Use failing and passing fixtures to demonstrate the enforced policy. Retain runtime and node configuration evidence separately; manifest settings do not prove runtime isolation."],"responsibility_boundary":"Platform team: admission controls, runtime and node configuration. Workload team: container settings and compatibility. Organisation: hardening standard, exception approval and system boundary.","checks":[{"engine":"kubescape","name":"ism-no-privileged-containers"},{"engine":"kubescape","name":"ism-pod-security-standards"},{"engine":"kubescape","name":"ism-readonly-root-filesystem"},{"engine":"kubescape","name":"ism-non-root-containers"},{"engine":"kubescape","name":"ism-no-privilege-escalation"},{"engine":"kubescape","name":"ism-no-host-access"},{"engine":"kubescape","name":"ism-drop-all-capabilities"},{"engine":"kubescape","name":"ism-seccomp-profile"},{"engine":"kyverno","name":"ism-workload-hardening-security-context"},{"engine":"kyverno","name":"ism-workload-hardening-block-host-namespaces"},{"engine":"kyverno","name":"ism-workload-hardening-block-host-path"},{"engine":"kyverno","name":"ism-workload-hardening-require-read-only-rootfs"}],"coverage":"partial","limitations":"Findings show selected Kubernetes workload hardening settings; they do not prove that all ASD and vendor guidance was identified, reconciled or implemented.","responsibility_allocation":{"eks":"customer-workload","self-managed":"customer-workload","source":"provisional","notes":"Provisional allocation for the detector evidence only. No provider inheritance or whole-control ownership is established until an authorised CSCM and the engagement boundary are reviewed."},"mapping_source":{"repository":"https://github.com/Latticework-Systems/ism-kubernetes-controls","revision":"07b348a2952bf2d0e78d9e739f367cb0919ab888","url":"https://github.com/Latticework-Systems/ism-kubernetes-controls/blob/07b348a2952bf2d0e78d9e739f367cb0919ab888/mapping/ism-mapping.yaml","sha256":"f823681fd71e40e589aae714ef2215dd8dc33722a1ec70b81ded5b2322937470"}}},{"id":"ISM-1247","url":"https://latticeworksystems.com.au/ism/ism-1247/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1247.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1247.md","official":{"statement":"Unneeded user accounts, components, services and functionality of server applications are disabled or removed.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Hardening server application configurations"]},"latticework_interpretation":null},{"id":"ISM-1249","url":"https://latticeworksystems.com.au/ism/ism-1249/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1249.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1249.md","official":{"statement":"Server applications are configured to run as a separate user account with the minimum privileges needed to perform their functions.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Restricting privileges for server applications"]},"latticework_interpretation":null},{"id":"ISM-1250","url":"https://latticeworksystems.com.au/ism/ism-1250/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1250.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1250.md","official":{"statement":"The user accounts under which server applications run have limited access to their underlying server’s file system.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Restricting privileges for server applications"]},"latticework_interpretation":null},{"id":"ISM-1255","url":"https://latticeworksystems.com.au/ism/ism-1255/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1255.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1255.md","official":{"statement":"Database users’ ability to access, insert, modify and remove database contents is restricted based on their duties or functions.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for database systems","Databases","Protecting database contents"]},"latticework_interpretation":null},{"id":"ISM-1256","url":"https://latticeworksystems.com.au/ism/ism-1256/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1256.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1256.md","official":{"statement":"File-based access controls are applied to database files.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Sep-18","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for database systems","Databases","Protecting databases"]},"latticework_interpretation":null},{"id":"ISM-1260","url":"https://latticeworksystems.com.au/ism/ism-1260/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1260.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1260.md","official":{"statement":"Default user accounts or credentials for server applications, including for any pre-configured user accounts, are changed, disabled or removed during initial setup.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Hardening server application configurations"]},"latticework_interpretation":null},{"id":"ISM-1263","url":"https://latticeworksystems.com.au/ism/ism-1263/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1263.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1263.md","official":{"statement":"Unique privileged user accounts are used for administering individual server applications.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Privileged access to systems"]},"latticework_interpretation":null},{"id":"ISM-1268","url":"https://latticeworksystems.com.au/ism/ism-1268/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1268.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1268.md","official":{"statement":"The need-to-know principle is enforced for database contents through the application of minimum privileges, database views, database roles and data tokenisation.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for database systems","Databases","Protecting database contents"]},"latticework_interpretation":null},{"id":"ISM-1269","url":"https://latticeworksystems.com.au/ism/ism-1269/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1269.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1269.md","official":{"statement":"Database servers and web servers are functionally separated.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for database systems","Database servers","Functional separation between database servers and web servers"]},"latticework_interpretation":null},{"id":"ISM-1270","url":"https://latticeworksystems.com.au/ism/ism-1270/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1270.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1270.md","official":{"statement":"Database servers are placed on a different network segment to workstations.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for database systems","Database servers","Network environment"]},"latticework_interpretation":null},{"id":"ISM-1271","url":"https://latticeworksystems.com.au/ism/ism-1271/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1271.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1271.md","official":{"statement":"Network access controls are implemented to restrict database server communications to strictly defined network resources that require access to the database server.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Mar-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for database systems","Database servers","Network environment"]},"latticework_interpretation":null},{"id":"ISM-1272","url":"https://latticeworksystems.com.au/ism/ism-1272/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1272.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1272.md","official":{"statement":"If only local access to a database is required, networking functionality of database management system applications is disabled or directed to listen solely to the localhost interface.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for database systems","Database servers","Network environment"]},"latticework_interpretation":null},{"id":"ISM-1273","url":"https://latticeworksystems.com.au/ism/ism-1273/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1273.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1273.md","official":{"statement":"Database servers for development, testing, staging and production environments are segregated.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Mar-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for database systems","Database servers","Segregation of development, testing, staging and production database servers"]},"latticework_interpretation":null},{"id":"ISM-1274","url":"https://latticeworksystems.com.au/ism/ism-1274/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1274.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1274.md","official":{"statement":"Database contents from production environments are not used in non-production environments unless the non-production environment is secured to at least the same level as the production environment.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Mar-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for database systems","Databases","Segregation of development, testing, staging and production databases"]},"latticework_interpretation":null},{"id":"ISM-1275","url":"https://latticeworksystems.com.au/ism/ism-1275/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1275.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1275.md","official":{"statement":"All queries to databases from software are filtered for legitimate content and correct syntax.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Mar-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Software interaction with databases"]},"latticework_interpretation":null},{"id":"ISM-1276","url":"https://latticeworksystems.com.au/ism/ism-1276/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1276.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1276.md","official":{"statement":"Parameterised queries or stored procedures, instead of dynamically generated queries, are used by software for database interactions.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Mar-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Software interaction with databases"]},"latticework_interpretation":null},{"id":"ISM-1277","url":"https://latticeworksystems.com.au/ism/ism-1277/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1277.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1277.md","official":{"statement":"Data communicated between database servers and web servers is encrypted using Australian Signals Directorate-approved cryptography.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for database systems","Database servers","Communications between database servers and web servers"]},"latticework_interpretation":null},{"id":"ISM-1278","url":"https://latticeworksystems.com.au/ism/ism-1278/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1278.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1278.md","official":{"statement":"Software is designed or configured to provide as little error information as possible about the structure of databases.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Mar-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Software interaction with databases"]},"latticework_interpretation":null},{"id":"ISM-1284","url":"https://latticeworksystems.com.au/ism/ism-1284/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1284.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1284.md","official":{"statement":"Files imported or exported via gateways or CDSs undergo content validation.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Content filtering","Content validation"]},"latticework_interpretation":null},{"id":"ISM-1286","url":"https://latticeworksystems.com.au/ism/ism-1286/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1286.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1286.md","official":{"statement":"Files imported or exported via gateways or CDSs undergo content conversion.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Content filtering","Content conversion"]},"latticework_interpretation":null},{"id":"ISM-1287","url":"https://latticeworksystems.com.au/ism/ism-1287/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1287.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1287.md","official":{"statement":"Files imported or exported via gateways or CDSs undergo content sanitisation.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Content filtering","Content sanitisation"]},"latticework_interpretation":null},{"id":"ISM-1288","url":"https://latticeworksystems.com.au/ism/ism-1288/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1288.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1288.md","official":{"statement":"Files imported or exported via gateways or CDSs undergo antivirus scanning using multiple different scanning engines.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Content filtering","Antivirus scanning"]},"latticework_interpretation":null},{"id":"ISM-1289","url":"https://latticeworksystems.com.au/ism/ism-1289/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1289.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1289.md","official":{"statement":"Archive files imported or exported via gateways or CDSs are unpacked to undergo content filtering checks.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Content filtering","Archive files"]},"latticework_interpretation":null},{"id":"ISM-1290","url":"https://latticeworksystems.com.au/ism/ism-1290/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1290.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1290.md","official":{"statement":"Archive files are unpacked in a controlled manner to ensure content filter performance or availability is not adversely affected.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Content filtering","Archive files"]},"latticework_interpretation":null},{"id":"ISM-1293","url":"https://latticeworksystems.com.au/ism/ism-1293/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1293.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1293.md","official":{"statement":"Encrypted files imported or exported via gateways or CDSs are decrypted to undergo content filtering checks.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Content filtering","Encrypted files"]},"latticework_interpretation":null},{"id":"ISM-1294","url":"https://latticeworksystems.com.au/ism/ism-1294/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1294.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1294.md","official":{"statement":"Data transfer logs for systems are partially verified at least monthly.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for data transfers","Data transfers","Monitoring data import and export"]},"latticework_interpretation":null},{"id":"ISM-1296","url":"https://latticeworksystems.com.au/ism/ism-1296/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1296.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1296.md","official":{"statement":"Physical security is implemented to protect network devices in public areas from physical damage or unauthorised access.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Jun-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for physical security","Facilities and systems","Physical access to network devices in public areas"]},"latticework_interpretation":null},{"id":"ISM-1297","url":"https://latticeworksystems.com.au/ism/ism-1297/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1297.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1297.md","official":{"statement":"Legal advice is sought prior to allowing privately owned mobile devices and desktop computers to access systems or data.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Enterprise mobility","Privately owned mobile devices and desktop computers"]},"latticework_interpretation":null},{"id":"ISM-1298","url":"https://latticeworksystems.com.au/ism/ism-1298/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1298.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1298.md","official":{"statement":"Personnel are advised of privacy and security risks when travelling overseas with mobile devices.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Oct-19","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device usage","Before travelling overseas with mobile devices"]},"latticework_interpretation":null},{"id":"ISM-1299","url":"https://latticeworksystems.com.au/ism/ism-1299/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1299.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1299.md","official":{"statement":"Personnel are advised to take the following precautions when using mobile devices:\n\n- never leave mobile devices or removable media unattended, including by placing them in checked-in luggage or leaving them in hotel safes\n- never store credentials with mobile devices that they grant access to, such as in laptop computer bags\n- never lend mobile devices or removable media to untrusted people, even if briefly\n- never allow untrusted people to connect their mobile devices or removable media to your mobile devices, including for charging\n- never connect mobile devices to designated charging stations or wall outlet charging ports\n- never use gifted or unauthorised peripherals, chargers or removable media with mobile devices\n- never use removable media for data transfers or backups that have not been checked for malicious code beforehand\n- avoid reuse of removable media once used with other parties’ systems or mobile devices\n- avoid connecting mobile devices to open or untrusted Wi-Fi networks\n- consider disabling any communications capabilities of mobile devices when not in use, such as Wi-Fi, Bluetooth, Near Field Communication and ultra-wideband\n- consider periodically rebooting mobile devices\n- consider using a VPN connection to encrypt all cellular and wireless communications\n- consider using encrypted email or messaging apps for all communications.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Sep-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device usage","Personnel awareness"]},"latticework_interpretation":null},{"id":"ISM-1300","url":"https://latticeworksystems.com.au/ism/ism-1300/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1300.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1300.md","official":{"statement":"Upon returning from travelling overseas with mobile devices, personnel take the following actions:\n\n- sanitise and reset mobile devices, including all removable media\n- decommission any credentials that left their possession during their travel\n- report if significant doubt exists as to the integrity of any mobile devices or removable media.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device usage","After travelling overseas with mobile devices"]},"latticework_interpretation":null},{"id":"ISM-1304","url":"https://latticeworksystems.com.au/ism/ism-1304/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1304.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1304.md","official":{"statement":"Default user accounts or credentials for network devices, including for any pre-configured user accounts, are changed, disabled or removed during initial setup.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Network device hardening"]},"latticework_interpretation":null},{"id":"ISM-1311","url":"https://latticeworksystems.com.au/ism/ism-1311/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1311.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1311.md","official":{"statement":"SNMP version 1 and SNMP version 2 are not used on networks.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Using the Simple Network Management Protocol"]},"latticework_interpretation":null},{"id":"ISM-1312","url":"https://latticeworksystems.com.au/ism/ism-1312/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1312.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1312.md","official":{"statement":"All default SNMP community strings on network devices are changed and write access is disabled.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Using the Simple Network Management Protocol"]},"latticework_interpretation":null},{"id":"ISM-1314","url":"https://latticeworksystems.com.au/ism/ism-1314/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1314.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1314.md","official":{"statement":"All wireless devices are Wi-Fi Alliance certified.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Wireless networks","Choosing wireless devices"]},"latticework_interpretation":null},{"id":"ISM-1315","url":"https://latticeworksystems.com.au/ism/ism-1315/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1315.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1315.md","official":{"statement":"The administrative interface on wireless access points is disabled for wireless network connections.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-18","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Wireless networks","Administrative interfaces for wireless access points"]},"latticework_interpretation":null},{"id":"ISM-1316","url":"https://latticeworksystems.com.au/ism/ism-1316/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1316.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1316.md","official":{"statement":"Default SSIDs of wireless access points are changed.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Wireless networks","Default settings"]},"latticework_interpretation":null},{"id":"ISM-1317","url":"https://latticeworksystems.com.au/ism/ism-1317/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1317.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1317.md","official":{"statement":"SSIDs of non-public wireless networks are not readily associated with an organisation, the location of their premises or the functionality of wireless networks.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Wireless networks","Default settings"]},"latticework_interpretation":null},{"id":"ISM-1318","url":"https://latticeworksystems.com.au/ism/ism-1318/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1318.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1318.md","official":{"statement":"SSID broadcasting is not disabled on wireless access points.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Wireless networks","Default settings"]},"latticework_interpretation":null},{"id":"ISM-1319","url":"https://latticeworksystems.com.au/ism/ism-1319/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1319.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1319.md","official":{"statement":"Static addressing is not used for assigning IP addresses on wireless networks.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-18","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Wireless networks","Static addressing"]},"latticework_interpretation":null},{"id":"ISM-1320","url":"https://latticeworksystems.com.au/ism/ism-1320/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1320.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1320.md","official":{"statement":"MAC address filtering is not used to restrict which devices can connect to wireless networks.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-18","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Wireless networks","Media Access Control address filtering"]},"latticework_interpretation":null},{"id":"ISM-1321","url":"https://latticeworksystems.com.au/ism/ism-1321/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1321.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1321.md","official":{"statement":"802.1X with EAP-TLS is used for mutual authentication and key exchange; with all other EAP methods disabled on supplicants and authentication servers.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","802.1X authentication and key exchange"]},"latticework_interpretation":null},{"id":"ISM-1322","url":"https://latticeworksystems.com.au/ism/ism-1322/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1322.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1322.md","official":{"statement":"Evaluated supplicants, authenticators and authentication servers are used for 802.1X authentication implementations.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Evaluation of 802.1X implementations"]},"latticework_interpretation":null},{"id":"ISM-1323","url":"https://latticeworksystems.com.au/ism/ism-1323/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1323.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1323.md","official":{"statement":"X.509 certificates are required for devices and human users authenticating to networks using 802.1X.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Generating and issuing X.509 certificates for authentication"]},"latticework_interpretation":null},{"id":"ISM-1324","url":"https://latticeworksystems.com.au/ism/ism-1324/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1324.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1324.md","official":{"statement":"X.509 certificates are generated using an evaluated certificate authority or hardware security module.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Generating and issuing X.509 certificates for authentication"]},"latticework_interpretation":null},{"id":"ISM-1327","url":"https://latticeworksystems.com.au/ism/ism-1327/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1327.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1327.md","official":{"statement":"X.509 certificates are protected by logical and physical access controls and encryption, with those issued to human users requiring authentication before use.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Generating and issuing X.509 certificates for authentication"]},"latticework_interpretation":null},{"id":"ISM-1330","url":"https://latticeworksystems.com.au/ism/ism-1330/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1330.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1330.md","official":{"statement":"The PMK caching period is not set to greater than 1440 minutes (24 hours).","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-18","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Wireless networks","Caching 802.1X authentication outcomes"]},"latticework_interpretation":null},{"id":"ISM-1332","url":"https://latticeworksystems.com.au/ism/ism-1332/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1332.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1332.md","official":{"statement":"WPA3-Enterprise 192-bit mode is used to protect the confidentiality and integrity of all wireless network traffic.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Sep-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Wireless networks","Confidentiality and integrity of wireless network traffic"]},"latticework_interpretation":null},{"id":"ISM-1334","url":"https://latticeworksystems.com.au/ism/ism-1334/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1334.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1334.md","official":{"statement":"Wireless networks implement sufficient frequency separation from other wireless networks.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-18","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Wireless networks","Interference between wireless networks"]},"latticework_interpretation":null},{"id":"ISM-1335","url":"https://latticeworksystems.com.au/ism/ism-1335/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1335.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1335.md","official":{"statement":"Wireless access points enable the use of the 802.11w amendment to protect management frames.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-18","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Wireless networks","Protecting management frames on wireless networks"]},"latticework_interpretation":null},{"id":"ISM-1338","url":"https://latticeworksystems.com.au/ism/ism-1338/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1338.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1338.md","official":{"statement":"Instead of deploying a small number of wireless access points that broadcast on high power, a greater number of wireless access points that use less broadcast power are deployed to achieve the desired footprint for wireless networks.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Wireless networks","Wireless network footprint"]},"latticework_interpretation":null},{"id":"ISM-1341","url":"https://latticeworksystems.com.au/ism/ism-1341/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1341.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1341.md","official":{"statement":"A HIPS or EDR solution is implemented on workstations.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Mar-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Host-based intrusion detection and response solution"]},"latticework_interpretation":null},{"id":"ISM-1359","url":"https://latticeworksystems.com.au/ism/ism-1359/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1359.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1359.md","official":{"statement":"A removable media usage policy is developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media usage","Removable media usage policy"]},"latticework_interpretation":null},{"id":"ISM-1361","url":"https://latticeworksystems.com.au/ism/ism-1361/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1361.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1361.md","official":{"statement":"Security Construction and Equipment Committee-approved equipment or ASIO-approved equipment is used when destroying media.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media destruction","Media destruction equipment"]},"latticework_interpretation":null},{"id":"ISM-1364","url":"https://latticeworksystems.com.au/ism/ism-1364/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1364.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1364.md","official":{"statement":"Network devices managing VLANs terminate VLANs belonging to different security domains on separate physical network interfaces.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Using virtual local area networks"]},"latticework_interpretation":null},{"id":"ISM-1366","url":"https://latticeworksystems.com.au/ism/ism-1366/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1366.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1366.md","official":{"statement":"Security updates are applied to mobile devices as soon as they become available.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device management","Maintaining mobile device security"]},"latticework_interpretation":null},{"id":"ISM-1369","url":"https://latticeworksystems.com.au/ism/ism-1369/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1369.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1369.md","official":{"statement":"AES-GCM is used for encryption of TLS connections.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Transport Layer Security","Configuring Transport Layer Security"]},"latticework_interpretation":null},{"id":"ISM-1370","url":"https://latticeworksystems.com.au/ism/ism-1370/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1370.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1370.md","official":{"statement":"Only server-initiated secure renegotiation is used for TLS connections.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Transport Layer Security","Configuring Transport Layer Security"]},"latticework_interpretation":null},{"id":"ISM-1372","url":"https://latticeworksystems.com.au/ism/ism-1372/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1372.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1372.md","official":{"statement":"The ephemeral variant of DH or ECDH is used for key establishment of TLS connections.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Transport Layer Security","Configuring Transport Layer Security"]},"latticework_interpretation":null},{"id":"ISM-1373","url":"https://latticeworksystems.com.au/ism/ism-1373/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1373.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1373.md","official":{"statement":"Anonymous DH is not used for TLS connections.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Transport Layer Security","Configuring Transport Layer Security"]},"latticework_interpretation":null},{"id":"ISM-1374","url":"https://latticeworksystems.com.au/ism/ism-1374/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1374.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1374.md","official":{"statement":"SHA-2-based certificates are used for TLS connections.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Transport Layer Security","Configuring Transport Layer Security"]},"latticework_interpretation":null},{"id":"ISM-1375","url":"https://latticeworksystems.com.au/ism/ism-1375/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1375.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1375.md","official":{"statement":"SHA-2 is used for the Hash-based Message Authentication Code (HMAC) and pseudorandom function (PRF) for TLS connections.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Transport Layer Security","Configuring Transport Layer Security"]},"latticework_interpretation":null},{"id":"ISM-1380","url":"https://latticeworksystems.com.au/ism/ism-1380/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1380.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1380.md","official":{"statement":"Privileged human users use separate privileged and unprivileged operating environments.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system management","System administration","Separate privileged operating environments"]},"latticework_interpretation":null},{"id":"ISM-1385","url":"https://latticeworksystems.com.au/ism/ism-1385/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1385.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1385.md","official":{"statement":"Administrative infrastructure is segregated from the wider network and the internet.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Jun-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system management","System administration","Administrative infrastructure"]},"latticework_interpretation":null},{"id":"ISM-1386","url":"https://latticeworksystems.com.au/ism/ism-1386/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1386.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1386.md","official":{"statement":"Network management traffic can only originate from administrative infrastructure.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system management","System administration","Administrative infrastructure"]},"latticework_interpretation":null},{"id":"ISM-1387","url":"https://latticeworksystems.com.au/ism/ism-1387/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1387.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1387.md","official":{"statement":"Administrative activities are conducted through jump servers.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system management","System administration","Administrative infrastructure"]},"latticework_interpretation":null},{"id":"ISM-1389","url":"https://latticeworksystems.com.au/ism/ism-1389/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1389.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1389.md","official":{"statement":"Executable files imported via gateways or CDSs are automatically executed in a sandbox to detect any suspicious behaviour.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Content filtering","Automated dynamic analysis"]},"latticework_interpretation":null},{"id":"ISM-1392","url":"https://latticeworksystems.com.au/ism/ism-1392/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1392.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1392.md","official":{"statement":"When implementing application control using path rules, only approved users can modify approved files and write to approved folders.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Mar-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Application control"]},"latticework_interpretation":null},{"id":"ISM-1395","url":"https://latticeworksystems.com.au/ism/ism-1395/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1395.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1395.md","official":{"statement":"Service providers, including any subcontractors, provide an appropriate level of protection for any data entrusted to them or their services.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Managed services and cloud services","Contractual security requirements with service providers"]},"latticework_interpretation":null},{"id":"ISM-1400","url":"https://latticeworksystems.com.au/ism/ism-1400/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1400.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1400.md","official":{"statement":"Personnel using privately owned mobile devices or desktop computers to access OFFICIAL: Sensitive or PROTECTED systems or data have enforced separation of classified data and personal data.","statement_format":"OSCAL markup-multiline","revision":"11","updated":"Jun-26","applicability":["OS","P"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Enterprise mobility","Privately owned mobile devices and desktop computers"]},"latticework_interpretation":null},{"id":"ISM-1401","url":"https://latticeworksystems.com.au/ism/ism-1401/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1401.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1401.md","official":{"statement":"Multi-factor authentication uses either: something people have and something people know, or something people have that is unlocked by something people know or are.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system access","Identity and access management","Multi-factor authentication"]},"latticework_interpretation":null},{"id":"ISM-1402","url":"https://latticeworksystems.com.au/ism/ism-1402/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1402.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1402.md","official":{"statement":"Credentials stored on systems are protected by a password manager; a hardware security module; or by salting, hashing and stretching them before storage within a database.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Protecting credentials"]},"latticework_interpretation":null},{"id":"ISM-1403","url":"https://latticeworksystems.com.au/ism/ism-1403/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1403.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1403.md","official":{"statement":"User accounts, except for break glass accounts, are protected by fixed or risk-based lockout mechanisms aligned to a maximum of five failed logon attempts, with either indefinite or automated lockout durations.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","User account lockouts"]},"latticework_interpretation":null},{"id":"ISM-1404","url":"https://latticeworksystems.com.au/ism/ism-1404/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1404.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1404.md","official":{"statement":"Unprivileged access to systems and their resources are disabled after 45 days of inactivity.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Suspension of access to systems"]},"latticework_interpretation":null},{"id":"ISM-1405","url":"https://latticeworksystems.com.au/ism/ism-1405/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1405.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1405.md","official":{"statement":"A centralised event logging facility is implemented.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for security assurance","Security monitoring","Centralised event logging facility"]},"latticework_interpretation":null},{"id":"ISM-1406","url":"https://latticeworksystems.com.au/ism/ism-1406/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1406.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1406.md","official":{"statement":"SOEs are used for workstations and servers.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Aug-20","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Standard operating environments"]},"latticework_interpretation":null},{"id":"ISM-1407","url":"https://latticeworksystems.com.au/ism/ism-1407/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1407.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1407.md","official":{"statement":"The latest release, or the previous release, of operating systems are used.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system hardening","Operating system hardening","Operating system releases and versions"]},"latticework_interpretation":null},{"id":"ISM-1408","url":"https://latticeworksystems.com.au/ism/ism-1408/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1408.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1408.md","official":{"statement":"64-bit versions of operating systems are used.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Operating system releases and versions"]},"latticework_interpretation":null},{"id":"ISM-1409","url":"https://latticeworksystems.com.au/ism/ism-1409/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1409.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1409.md","official":{"statement":"Operating systems are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Hardening operating system configurations"]},"latticework_interpretation":null},{"id":"ISM-1412","url":"https://latticeworksystems.com.au/ism/ism-1412/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1412.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1412.md","official":{"statement":"Web browsers are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system hardening","User application hardening","Web browsers"]},"latticework_interpretation":null},{"id":"ISM-1416","url":"https://latticeworksystems.com.au/ism/ism-1416/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1416.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1416.md","official":{"statement":"A software firewall is implemented on workstations and servers to restrict inbound and outbound network connections to an organisation-approved set of applications and services.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Software firewall"]},"latticework_interpretation":{"title":"Restrict workload traffic and test the actual path","implementation_steps":["Agree the required source, destination, port and protocol flows with service owners. Start with a non-production namespace.","Apply ingress and egress NetworkPolicies for those flows. Confirm that the cluster network plugin enforces NetworkPolicy before promoting changes."],"evidence_to_retain":["Keep the reviewed flow matrix, versioned manifests, cluster/plugin version and a dated scan with its namespace exclusions.","Capture successful approved connections and failed prohibited connections from representative workloads. Include node firewall evidence separately where the control requires it."],"responsibility_boundary":"Platform team: network plugin and network baseline. Workload team: required application flows and service tests. Organisation: approved business need and exceptions.","checks":[{"engine":"kubescape","name":"ism-network-policy-coverage"}],"coverage":"partial","limitations":"NetworkPolicy coverage is evidence of workload-level traffic restriction only; it does not prove host firewall coverage, approved application and service lists, or effective enforcement by the cluster network plugin.","responsibility_allocation":{"eks":"customer-workload","self-managed":"customer-workload","source":"provisional","notes":"Provisional allocation for the detector evidence only. No provider inheritance or whole-control ownership is established until an authorised CSCM and the engagement boundary are reviewed."},"mapping_source":{"repository":"https://github.com/Latticework-Systems/ism-kubernetes-controls","revision":"07b348a2952bf2d0e78d9e739f367cb0919ab888","url":"https://github.com/Latticework-Systems/ism-kubernetes-controls/blob/07b348a2952bf2d0e78d9e739f367cb0919ab888/mapping/ism-mapping.yaml","sha256":"f823681fd71e40e589aae714ef2215dd8dc33722a1ec70b81ded5b2322937470"}}},{"id":"ISM-1417","url":"https://latticeworksystems.com.au/ism/ism-1417/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1417.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1417.md","official":{"statement":"An antivirus application is implemented on workstations and servers with:\n\n- signature-based detection functionality enabled and set to a high level\n- heuristic-based detection functionality enabled and set to a high level\n- reputation rating functionality enabled\n- ransomware protection functionality enabled\n- detection signatures configured to update at least daily\n- regular scanning configured for all fixed disks and removable media.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Antivirus application"]},"latticework_interpretation":null},{"id":"ISM-1418","url":"https://latticeworksystems.com.au/ism/ism-1418/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1418.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1418.md","official":{"statement":"If there is no business requirement for reading from removable media and devices, such functionality is disabled via the use of a device access control application or by disabling external communication interfaces.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Device access control"]},"latticework_interpretation":null},{"id":"ISM-1419","url":"https://latticeworksystems.com.au/ism/ism-1419/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1419.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1419.md","official":{"statement":"Development and modification of software only take place in development environments.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Development, testing, staging and production environments"]},"latticework_interpretation":null},{"id":"ISM-1420","url":"https://latticeworksystems.com.au/ism/ism-1420/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1420.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1420.md","official":{"statement":"Data from production environments is not used in non-production environments unless the non-production environment is secured to at least the same level as the production environment.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Mar-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Development, testing, staging and production environments"]},"latticework_interpretation":null},{"id":"ISM-1422","url":"https://latticeworksystems.com.au/ism/ism-1422/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1422.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1422.md","official":{"statement":"Unauthorised access to the authoritative source for software is prevented.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Sep-18","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Authoritative source for software"]},"latticework_interpretation":null},{"id":"ISM-1424","url":"https://latticeworksystems.com.au/ism/ism-1424/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1424.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1424.md","official":{"statement":"Content-Security-Policy, Hypertext Transfer Protocol Strict Transport Security and X-Frame-Options are specified by web server software via security policy in response headers.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Mar-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Web application development","Web security policy response headers"]},"latticework_interpretation":null},{"id":"ISM-1427","url":"https://latticeworksystems.com.au/ism/ism-1427/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1427.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1427.md","official":{"statement":"Gateways perform ingress traffic filtering to detect and prevent IP source address spoofing.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Gateways","Implementing gateways"]},"latticework_interpretation":null},{"id":"ISM-1428","url":"https://latticeworksystems.com.au/ism/ism-1428/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1428.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1428.md","official":{"statement":"Unless explicitly required, IPv6 tunnelling is disabled on all network devices.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Using Internet Protocol version 6"]},"latticework_interpretation":null},{"id":"ISM-1429","url":"https://latticeworksystems.com.au/ism/ism-1429/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1429.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1429.md","official":{"statement":"IPv6 tunnelling is blocked by network security appliances at externally connected network boundaries.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Using Internet Protocol version 6"]},"latticework_interpretation":null},{"id":"ISM-1430","url":"https://latticeworksystems.com.au/ism/ism-1430/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1430.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1430.md","official":{"statement":"Dynamically assigned IPv6 addresses are configured with Dynamic Host Configuration Protocol version 6 in a stateful manner with lease data stored in a centralised event logging facility.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Using Internet Protocol version 6"]},"latticework_interpretation":null},{"id":"ISM-1431","url":"https://latticeworksystems.com.au/ism/ism-1431/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1431.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1431.md","official":{"statement":"Denial-of-service attack mitigation strategies are discussed with cloud service providers, specifically:\n\n- their capacity to withstand denial-of-service attacks\n- costs likely to be incurred as a result of denial-of-service attacks\n- availability monitoring and thresholds for notification of denial-of-service attacks\n- thresholds for turning off any online services or functionality during denial-of-service attacks\n- pre-approved actions that can be undertaken during denial-of-service attacks\n- any arrangements with upstream service providers to block malicious network traffic as far upstream as possible.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Jun-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Service continuity for online services","Denial-of-service attack mitigation strategies"]},"latticework_interpretation":null},{"id":"ISM-1432","url":"https://latticeworksystems.com.au/ism/ism-1432/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1432.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1432.md","official":{"statement":"Domain names for online services are protected via registrar locking and confirming that domain registration details are correct.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Service continuity for online services","Denial-of-service attack mitigation strategies"]},"latticework_interpretation":null},{"id":"ISM-1436","url":"https://latticeworksystems.com.au/ism/ism-1436/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1436.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1436.md","official":{"statement":"Critical online services are segregated from other online services that are more likely to be targeted as part of denial-of-service attacks.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Service continuity for online services","Denial-of-service attack mitigation strategies"]},"latticework_interpretation":null},{"id":"ISM-1437","url":"https://latticeworksystems.com.au/ism/ism-1437/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1437.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1437.md","official":{"statement":"Cloud service providers are used for hosting online services.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Service continuity for online services","Cloud-based hosting of online services"]},"latticework_interpretation":null},{"id":"ISM-1438","url":"https://latticeworksystems.com.au/ism/ism-1438/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1438.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1438.md","official":{"statement":"Where a high availability requirement exists for website hosting, CDNs that cache websites are used.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Service continuity for online services","Using content delivery networks"]},"latticework_interpretation":null},{"id":"ISM-1439","url":"https://latticeworksystems.com.au/ism/ism-1439/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1439.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1439.md","official":{"statement":"If using CDNs, disclosing the IP addresses of web servers under an organisation’s control (referred to as origin servers) is avoided and access to the origin servers is restricted to the CDNs and authorised management networks.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Service continuity for online services","Using content delivery networks"]},"latticework_interpretation":null},{"id":"ISM-1446","url":"https://latticeworksystems.com.au/ism/ism-1446/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1446.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1446.md","official":{"statement":"When using elliptic curve cryptography, a suitable curve from NIST SP 800-186 is used.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Mar-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic algorithms","Using Elliptic Curve Cryptography"]},"latticework_interpretation":null},{"id":"ISM-1449","url":"https://latticeworksystems.com.au/ism/ism-1449/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1449.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1449.md","official":{"statement":"SSH private keys are protected with a password or a key encryption key.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Secure Shell","Authentication mechanisms"]},"latticework_interpretation":null},{"id":"ISM-1450","url":"https://latticeworksystems.com.au/ism/ism-1450/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1450.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1450.md","official":{"statement":"Microphones (including headsets and USB handsets) and webcams are not used with non-TOP SECRET workstations in TOP SECRET areas.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-24","applicability":["NC","OS","P","S"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Video conferencing and Internet Protocol telephony","Microphones and webcams"]},"latticework_interpretation":null},{"id":"ISM-1451","url":"https://latticeworksystems.com.au/ism/ism-1451/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1451.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1451.md","official":{"statement":"Types of data and its ownership is documented in contractual arrangements with service providers.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Managed services and cloud services","Contractual security requirements with service providers"]},"latticework_interpretation":null},{"id":"ISM-1452","url":"https://latticeworksystems.com.au/ism/ism-1452/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1452.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1452.md","official":{"statement":"A supply chain risk assessment is performed for suppliers of operating systems, applications, IT equipment, OT equipment and services to assess the impact to a system’s security risk profile.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Cyber supply chain risk management","Cyber supply chain risk management activities"]},"latticework_interpretation":null},{"id":"ISM-1453","url":"https://latticeworksystems.com.au/ism/ism-1453/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1453.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1453.md","official":{"statement":"Perfect Forward Secrecy (PFS) is used for TLS connections.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-18","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Transport Layer Security","Configuring Transport Layer Security"]},"latticework_interpretation":null},{"id":"ISM-1454","url":"https://latticeworksystems.com.au/ism/ism-1454/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1454.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1454.md","official":{"statement":"Communications between authenticators and a RADIUS server are encapsulated with an additional layer of encryption using RADIUS over Internet Protocol Security or RADIUS over Transport Layer Security.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Remote Authentication Dial-In User Service authentication"]},"latticework_interpretation":null},{"id":"ISM-1457","url":"https://latticeworksystems.com.au/ism/ism-1457/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1457.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1457.md","official":{"statement":"Evaluated peripheral switches used for sharing peripherals between SECRET and TOP SECRET systems, or between SECRET or TOP SECRET systems belonging to different security domains, preferably complete a high assurance evaluation.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Mar-22","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Peripheral switches","Using peripheral switches"]},"latticework_interpretation":null},{"id":"ISM-1460","url":"https://latticeworksystems.com.au/ism/ism-1460/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1460.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1460.md","official":{"statement":"When using a software-based isolation mechanism that consumes shared physical computing resources, the isolation mechanism is from a vendor that has demonstrated a commitment to Secure by Design and Secure by Default principles and practices, including secure programming practices and either memory-safe programming languages or less preferably memory-safe programming practices.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Virtualisation hardening","Functional separation between operating environments"]},"latticework_interpretation":null},{"id":"ISM-1461","url":"https://latticeworksystems.com.au/ism/ism-1461/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1461.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1461.md","official":{"statement":"When using a software-based isolation mechanism that consumes shared physical computing resources for SECRET or TOP SECRET operating environments, the physical server and all operating environments are of the same classification and belong to the same security domain.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Jun-26","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Virtualisation hardening","Functional separation between operating environments"]},"latticework_interpretation":null},{"id":"ISM-1467","url":"https://latticeworksystems.com.au/ism/ism-1467/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1467.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1467.md","official":{"statement":"The latest release of email clients, office productivity suites, PDF applications, security products and web browsers, including their extensions, are used.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","User application hardening","User application releases"]},"latticework_interpretation":null},{"id":"ISM-1470","url":"https://latticeworksystems.com.au/ism/ism-1470/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1470.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1470.md","official":{"statement":"Unneeded user accounts, components, services and functionality of user applications are disabled or removed.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","User application hardening","Hardening user application configurations"]},"latticework_interpretation":null},{"id":"ISM-1471","url":"https://latticeworksystems.com.au/ism/ism-1471/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1471.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1471.md","official":{"statement":"When implementing application control using publisher certificate rules, publisher names and product names are used.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Application control"]},"latticework_interpretation":null},{"id":"ISM-1478","url":"https://latticeworksystems.com.au/ism/ism-1478/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1478.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1478.md","official":{"statement":"The CISO oversees their organisation’s cyber security program and ensures their organisation’s compliance with cyber security policy, standards, regulations and legislation.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Oct-20","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","Chief information security officer","Overseeing the cyber security program"]},"latticework_interpretation":null},{"id":"ISM-1479","url":"https://latticeworksystems.com.au/ism/ism-1479/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1479.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1479.md","official":{"statement":"Servers minimise communications with other servers at the network and file system level.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Functional separation between servers"]},"latticework_interpretation":null},{"id":"ISM-1480","url":"https://latticeworksystems.com.au/ism/ism-1480/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1480.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1480.md","official":{"statement":"Evaluated peripheral switches used for sharing peripherals between SECRET or TOP SECRET systems and any non-SECRET or TOP SECRET systems complete a high assurance evaluation.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Mar-22","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Peripheral switches","Using peripheral switches"]},"latticework_interpretation":null},{"id":"ISM-1482","url":"https://latticeworksystems.com.au/ism/ism-1482/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1482.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1482.md","official":{"statement":"Personnel using organisation-owned mobile devices or desktop computers to access classified systems or data have enforced separation of classified data and personal data.","statement_format":"OSCAL markup-multiline","revision":"9","updated":"Mar-26","applicability":["OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Enterprise mobility","Organisation-owned mobile devices and desktop computers"]},"latticework_interpretation":null},{"id":"ISM-1483","url":"https://latticeworksystems.com.au/ism/ism-1483/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1483.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1483.md","official":{"statement":"The latest release of internet-facing server applications is used.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Server application releases"]},"latticework_interpretation":null},{"id":"ISM-1485","url":"https://latticeworksystems.com.au/ism/ism-1485/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1485.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1485.md","official":{"statement":"Web browsers do not process web advertisements from the internet.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system hardening","User application hardening","Web browsers"]},"latticework_interpretation":null},{"id":"ISM-1486","url":"https://latticeworksystems.com.au/ism/ism-1486/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1486.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1486.md","official":{"statement":"Web browsers do not process Java from the internet.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system hardening","User application hardening","Web browsers"]},"latticework_interpretation":null},{"id":"ISM-1487","url":"https://latticeworksystems.com.au/ism/ism-1487/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1487.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1487.md","official":{"statement":"Only privileged human users responsible for checking that Microsoft Office macros are free of malicious code can write to and modify content within Trusted Locations.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system hardening","User application hardening","Office productivity suites"]},"latticework_interpretation":null},{"id":"ISM-1488","url":"https://latticeworksystems.com.au/ism/ism-1488/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1488.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1488.md","official":{"statement":"Microsoft Office macros in files originating from the internet are blocked.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system hardening","User application hardening","Office productivity suites"]},"latticework_interpretation":null},{"id":"ISM-1489","url":"https://latticeworksystems.com.au/ism/ism-1489/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1489.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1489.md","official":{"statement":"Microsoft Office macro security settings cannot be changed by human users.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system hardening","User application hardening","Office productivity suites"]},"latticework_interpretation":null},{"id":"ISM-1490","url":"https://latticeworksystems.com.au/ism/ism-1490/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1490.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1490.md","official":{"statement":"Application control is implemented on internet-facing servers.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Sep-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system hardening","Operating system hardening","Application control"]},"latticework_interpretation":{"title":"Review approved images and execution paths","implementation_steps":["Maintain an approved image registry policy with an owner and an exception process. Pin the policy revision and test regular and init containers.","Evaluate approved registries, privileged execution and Pod Security settings. Separately review the binaries, scripts and execution locations inside images and on hosts."],"evidence_to_retain":["Keep registry approvals, workload inventory, policy configuration, failing/passing fixtures and dated scan or admission results.","Link image contents and host application-control evidence to the same system boundary. Record namespaces and workload types omitted from the scan."],"responsibility_boundary":"Platform team: registry and admission guardrails. Workload team: image contents and required execution. Organisation: approved software set and exceptions.","checks":[{"engine":"kubescape","name":"ism-allowed-registries"},{"engine":"kubescape","name":"ism-no-privileged-containers"},{"engine":"kubescape","name":"ism-pod-security-standards"},{"engine":"kyverno","name":"ism-application-control-approved-registry"},{"engine":"kyverno","name":"ism-application-control-no-latest-tag"},{"engine":"kyverno","name":"ism-application-control-no-privileged"}],"coverage":"partial","limitations":"Scan and PolicyReport results show workload image and execution guardrails on Kubernetes servers; they do not prove host or endpoint application control.","responsibility_allocation":{"eks":"customer-workload","self-managed":"customer-workload","source":"provisional","notes":"Provisional allocation for the detector evidence only. No provider inheritance or whole-control ownership is established until an authorised CSCM and the engagement boundary are reviewed."},"mapping_source":{"repository":"https://github.com/Latticework-Systems/ism-kubernetes-controls","revision":"07b348a2952bf2d0e78d9e739f367cb0919ab888","url":"https://github.com/Latticework-Systems/ism-kubernetes-controls/blob/07b348a2952bf2d0e78d9e739f367cb0919ab888/mapping/ism-mapping.yaml","sha256":"f823681fd71e40e589aae714ef2215dd8dc33722a1ec70b81ded5b2322937470"}}},{"id":"ISM-1491","url":"https://latticeworksystems.com.au/ism/ism-1491/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1491.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1491.md","official":{"statement":"Unprivileged human users are prevented from running script execution engines, including:\n\n- Windows Script Host (cscript.exe and wscript.exe)\n- PowerShell (powershell.exe, powershell_ise.exe and pwsh.exe)\n- Command Prompt (cmd.exe)\n- Windows Management Instrumentation (wmic.exe)\n- Microsoft Hypertext Markup Language (HTML) Application Host (mshta.exe).","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Hardening operating system configurations"]},"latticework_interpretation":null},{"id":"ISM-1492","url":"https://latticeworksystems.com.au/ism/ism-1492/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1492.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1492.md","official":{"statement":"Operating system exploit protection functionality is enabled.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Hardening operating system configurations"]},"latticework_interpretation":null},{"id":"ISM-1493","url":"https://latticeworksystems.com.au/ism/ism-1493/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1493.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1493.md","official":{"statement":"Software registers for workstations, servers, network devices and networked IT equipment are developed, implemented, maintained and regularly verified.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system management","System administration","Software registers"]},"latticework_interpretation":null},{"id":"ISM-1501","url":"https://latticeworksystems.com.au/ism/ism-1501/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1501.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1501.md","official":{"statement":"Operating systems that are no longer supported by vendors are replaced.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system management","System maintenance","Cessation of support"]},"latticework_interpretation":{"title":"Track support and patch evidence for every operating-system layer","implementation_steps":["Inventory container base images, node operating systems and internet-facing network devices separately. Assign owners and record vendor support dates.","Use the mapped policies to review declared base-image metadata. Drive patch decisions from actual vendor advisories and vulnerability findings, then rebuild, deploy and verify the affected components within the applicable control deadline."],"evidence_to_retain":["Keep the component inventory, vendor advisory and release date, severity/exploit assessment, patch decision and deployment verification timestamps.","Retain image labels and PolicyReports as supporting metadata. Add node and device patch records; labels do not verify installed patches or support state."],"responsibility_boundary":"Platform team: node and device lifecycle. Workload/pipeline team: supported base images and rebuilt artefacts. Organisation: patch policy, deadlines and approved exceptions.","checks":[{"engine":"kyverno","name":"ism-patch-operating-systems-block-eol-base-images"},{"engine":"kyverno","name":"ism-patch-operating-systems-require-base-image-label"}],"coverage":"partial","limitations":"PolicyReports show declared container base-image support state; they do not prove Kubernetes node operating systems are supported or patched.","responsibility_allocation":{"eks":"customer-platform","self-managed":"customer-platform","source":"provisional","notes":"Provisional allocation for the detector evidence only. No provider inheritance or whole-control ownership is established until an authorised CSCM and the engagement boundary are reviewed."},"mapping_source":{"repository":"https://github.com/Latticework-Systems/ism-kubernetes-controls","revision":"07b348a2952bf2d0e78d9e739f367cb0919ab888","url":"https://github.com/Latticework-Systems/ism-kubernetes-controls/blob/07b348a2952bf2d0e78d9e739f367cb0919ab888/mapping/ism-mapping.yaml","sha256":"f823681fd71e40e589aae714ef2215dd8dc33722a1ec70b81ded5b2322937470"}}},{"id":"ISM-1502","url":"https://latticeworksystems.com.au/ism/ism-1502/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1502.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1502.md","official":{"statement":"Emails arriving via an external connection where the email source address uses an internal domain, or internal subdomain, are blocked at the email gateway.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for email","Email gateways and servers","Blocking suspicious emails"]},"latticework_interpretation":null},{"id":"ISM-1504","url":"https://latticeworksystems.com.au/ism/ism-1504/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1504.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1504.md","official":{"statement":"Multi-factor authentication is used to authenticate human users to their organisation’s online services that process, store or communicate their organisation’s sensitive data.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system access","Identity and access management","Multi-factor authentication"]},"latticework_interpretation":null},{"id":"ISM-1505","url":"https://latticeworksystems.com.au/ism/ism-1505/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1505.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1505.md","official":{"statement":"Multi-factor authentication is used to authenticate human users of data repositories.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system access","Identity and access management","Multi-factor authentication"]},"latticework_interpretation":null},{"id":"ISM-1506","url":"https://latticeworksystems.com.au/ism/ism-1506/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1506.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1506.md","official":{"statement":"The use of SSH version 1 is disabled for SSH connections.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Secure Shell","Configuring Secure Shell"]},"latticework_interpretation":null},{"id":"ISM-1507","url":"https://latticeworksystems.com.au/ism/ism-1507/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1507.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1507.md","official":{"statement":"Requests for privileged access to systems and their resources are validated when first requested.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system access","Identity and access management","Privileged access to systems"]},"latticework_interpretation":null},{"id":"ISM-1508","url":"https://latticeworksystems.com.au/ism/ism-1508/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1508.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1508.md","official":{"statement":"Privileged access to systems and their resources is limited to only what is required for users to undertake their duties or functions.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system access","Identity and access management","Privileged access to systems"]},"latticework_interpretation":null},{"id":"ISM-1509","url":"https://latticeworksystems.com.au/ism/ism-1509/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1509.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1509.md","official":{"statement":"Privileged access events are centrally logged.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system access","Identity and access management","Privileged access to systems"]},"latticework_interpretation":null},{"id":"ISM-1510","url":"https://latticeworksystems.com.au/ism/ism-1510/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1510.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1510.md","official":{"statement":"A digital preservation policy is developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system management","Data backup and restoration","Digital preservation policy"]},"latticework_interpretation":null},{"id":"ISM-1511","url":"https://latticeworksystems.com.au/ism/ism-1511/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1511.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1511.md","official":{"statement":"Backups of data, applications and settings are performed and retained in accordance with business criticality and business continuity requirements.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system management","Data backup and restoration","Performing and retaining backups"]},"latticework_interpretation":{"title":"Connect declared backup coverage to a tested recovery","implementation_steps":["Identify application data, configuration and settings, including state outside PersistentVolumeClaims. Agree recovery and retention requirements with business owners.","Declare production PVC backup coverage and configure the backup service. Perform a representative restore and verify application recovery before relying on the backup."],"evidence_to_retain":["Keep the data inventory, approved retention/recovery requirements, backup configuration and dated completion records.","Record restore-test steps, recovered data checks and recovery time. Add backup isolation and access evidence separately; a PVC label proves none of these."],"responsibility_boundary":"Platform team: backup service and protected storage. Workload team: data consistency and restore validation. Organisation: continuity requirements, retention and test acceptance.","checks":[{"engine":"kyverno","name":"ism-backups-require-pvc-backup-label"}],"coverage":"partial","limitations":"PolicyReports show whether production PVCs declare backup coverage; they do not prove backup completion, retention, resilience or restorability.","responsibility_allocation":{"eks":"customer-workload","self-managed":"customer-workload","source":"provisional","notes":"Provisional allocation for the detector evidence only. No provider inheritance or whole-control ownership is established until an authorised CSCM and the engagement boundary are reviewed."},"mapping_source":{"repository":"https://github.com/Latticework-Systems/ism-kubernetes-controls","revision":"07b348a2952bf2d0e78d9e739f367cb0919ab888","url":"https://github.com/Latticework-Systems/ism-kubernetes-controls/blob/07b348a2952bf2d0e78d9e739f367cb0919ab888/mapping/ism-mapping.yaml","sha256":"f823681fd71e40e589aae714ef2215dd8dc33722a1ec70b81ded5b2322937470"}}},{"id":"ISM-1515","url":"https://latticeworksystems.com.au/ism/ism-1515/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1515.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1515.md","official":{"statement":"Restoration of data, applications and settings from backups to a common point in time is tested as part of disaster recovery exercises.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system management","Data backup and restoration","Testing restoration of backups"]},"latticework_interpretation":null},{"id":"ISM-1517","url":"https://latticeworksystems.com.au/ism/ism-1517/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1517.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1517.md","official":{"statement":"Equipment that is capable of reducing microform to a fine powder, with resultant particles not showing more than five consecutive characters per particle upon microscopic inspection, is used to destroy microfiche and microfilm.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-18","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media destruction","Media destruction methods"]},"latticework_interpretation":null},{"id":"ISM-1520","url":"https://latticeworksystems.com.au/ism/ism-1520/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1520.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1520.md","official":{"statement":"System administrators for gateways undergo appropriate employment screening, and where necessary hold an appropriate security clearance, based on the sensitivity or classification of gateways.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Sep-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Gateways","System administrators for gateways"]},"latticework_interpretation":null},{"id":"ISM-1521","url":"https://latticeworksystems.com.au/ism/ism-1521/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1521.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1521.md","official":{"statement":"CDSs implement protocol breaks at each network layer.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Mar-22","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Cross domain solutions","Separation of data flows"]},"latticework_interpretation":null},{"id":"ISM-1522","url":"https://latticeworksystems.com.au/ism/ism-1522/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1522.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1522.md","official":{"statement":"CDSs implement independent security-enforcing functions for upward and downward network paths.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Mar-22","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Cross domain solutions","Separation of data flows"]},"latticework_interpretation":null},{"id":"ISM-1523","url":"https://latticeworksystems.com.au/ism/ism-1523/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1523.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1523.md","official":{"statement":"A sample of security-relevant events relating to data transfer policies are taken at least every three months and assessed against security policies for CDSs to identify any operational failures.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Mar-22","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Cross domain solutions","Cross domain solution event logging"]},"latticework_interpretation":null},{"id":"ISM-1524","url":"https://latticeworksystems.com.au/ism/ism-1524/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1524.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1524.md","official":{"statement":"Content filters used by CDSs undergo rigorous security testing to ensure they perform as expected and cannot be bypassed.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Mar-22","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Content filtering","Performing content filtering"]},"latticework_interpretation":null},{"id":"ISM-1525","url":"https://latticeworksystems.com.au/ism/ism-1525/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1525.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1525.md","official":{"statement":"System owners register each system with its authorising officer.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jan-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","System owners","System ownership and oversight"]},"latticework_interpretation":null},{"id":"ISM-1526","url":"https://latticeworksystems.com.au/ism/ism-1526/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1526.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1526.md","official":{"statement":"System owners continuously monitor the security of each system, and manage associated cyber threats, security risks and security controls.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","System owners","Protecting systems and their resources"]},"latticework_interpretation":null},{"id":"ISM-1528","url":"https://latticeworksystems.com.au/ism/ism-1528/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1528.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1528.md","official":{"statement":"Evaluated firewalls are used between an organisation’s networks and public network infrastructure.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Firewalls","Using firewalls"]},"latticework_interpretation":null},{"id":"ISM-1529","url":"https://latticeworksystems.com.au/ism/ism-1529/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1529.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1529.md","official":{"statement":"Only community or private clouds are used for outsourced SECRET and TOP SECRET cloud services.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Dec-21","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Managed services and cloud services","Outsourced cloud services"]},"latticework_interpretation":null},{"id":"ISM-1530","url":"https://latticeworksystems.com.au/ism/ism-1530/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1530.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1530.md","official":{"statement":"Classified servers, network devices and cryptographic equipment are secured in security containers suitable for their classification taking into account the combination of security zones they reside in.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-24","applicability":["OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for physical security","Facilities and systems","Physical access to servers, network devices and cryptographic equipment"]},"latticework_interpretation":null},{"id":"ISM-1532","url":"https://latticeworksystems.com.au/ism/ism-1532/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1532.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1532.md","official":{"statement":"VLANs are not used to separate network traffic between an organisation’s networks and public network infrastructure.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Using virtual local area networks"]},"latticework_interpretation":null},{"id":"ISM-1533","url":"https://latticeworksystems.com.au/ism/ism-1533/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1533.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1533.md","official":{"statement":"A mobile device management policy is developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device management","Mobile device management policy"]},"latticework_interpretation":null},{"id":"ISM-1534","url":"https://latticeworksystems.com.au/ism/ism-1534/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1534.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1534.md","official":{"statement":"Printer ribbons in printers and MFDs are removed and destroyed.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-18","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment sanitisation and destruction","Sanitising printers and multifunction devices"]},"latticework_interpretation":null},{"id":"ISM-1535","url":"https://latticeworksystems.com.au/ism/ism-1535/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1535.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1535.md","official":{"statement":"Processes, and supporting procedures, are developed, implemented and maintained to prevent AUSTEO, AGAO and REL data in textual and non-textual formats from being exported to unsuitable foreign systems.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Jun-24","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for data transfers","Data transfers","Data transfer processes and procedures"]},"latticework_interpretation":null},{"id":"ISM-1536","url":"https://latticeworksystems.com.au/ism/ism-1536/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1536.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1536.md","official":{"statement":"All queries to databases from software, and any resulting crash or error messages, are centrally logged.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Software interaction with databases"]},"latticework_interpretation":null},{"id":"ISM-1537","url":"https://latticeworksystems.com.au/ism/ism-1537/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1537.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1537.md","official":{"statement":"Security-relevant events for databases are centrally logged, including:\n\n- access or modification of particularly important content\n- addition of new users, especially privileged users\n- changes to user roles or privileges\n- attempts to elevate user privileges\n- queries containing comments\n- queries containing multiple embedded queries\n- database and query alerts or failures\n- database structure changes\n- database administrator actions\n- use of executable commands\n- database logons and logoffs.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for database systems","Databases","Database event logging"]},"latticework_interpretation":null},{"id":"ISM-1540","url":"https://latticeworksystems.com.au/ism/ism-1540/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1540.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1540.md","official":{"statement":"DMARC records are configured for an organisation’s domains (including subdomains) such that emails are rejected if they do not pass DMARC checks.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for email","Email gateways and servers","Domain-based Message Authentication, Reporting and Conformance"]},"latticework_interpretation":null},{"id":"ISM-1542","url":"https://latticeworksystems.com.au/ism/ism-1542/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1542.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1542.md","official":{"statement":"Microsoft Office is configured to prevent activation of Object Linking and Embedding packages.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jan-19","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system hardening","User application hardening","Office productivity suites"]},"latticework_interpretation":null},{"id":"ISM-1543","url":"https://latticeworksystems.com.au/ism/ism-1543/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1543.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1543.md","official":{"statement":"An authorised RF and IR device register for SECRET and TOP SECRET areas is developed, implemented, maintained and regularly verified.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Jun-26","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for physical security","Facilities and systems","Bringing radio frequency and infrared devices into facilities"]},"latticework_interpretation":null},{"id":"ISM-1544","url":"https://latticeworksystems.com.au/ism/ism-1544/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1544.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1544.md","official":{"statement":"Microsoft’s recommended application blocklist is implemented.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system hardening","Operating system hardening","Application control"]},"latticework_interpretation":null},{"id":"ISM-1546","url":"https://latticeworksystems.com.au/ism/ism-1546/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1546.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1546.md","official":{"statement":"Users are authenticated before they are granted access to a system and its resources.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Aug-19","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Authenticating to systems"]},"latticework_interpretation":null},{"id":"ISM-1547","url":"https://latticeworksystems.com.au/ism/ism-1547/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1547.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1547.md","official":{"statement":"Data backup processes, and supporting data backup procedures, are developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system management","Data backup and restoration","Data backup and restoration processes and procedures"]},"latticework_interpretation":null},{"id":"ISM-1548","url":"https://latticeworksystems.com.au/ism/ism-1548/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1548.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1548.md","official":{"statement":"Data restoration processes, and supporting data restoration procedures, are developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system management","Data backup and restoration","Data backup and restoration processes and procedures"]},"latticework_interpretation":null},{"id":"ISM-1549","url":"https://latticeworksystems.com.au/ism/ism-1549/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1549.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1549.md","official":{"statement":"A media management policy is developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media usage","Media management policy"]},"latticework_interpretation":null},{"id":"ISM-1550","url":"https://latticeworksystems.com.au/ism/ism-1550/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1550.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1550.md","official":{"statement":"IT equipment disposal processes, and supporting IT equipment disposal procedures, are developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment disposal","IT equipment disposal processes and procedures"]},"latticework_interpretation":null},{"id":"ISM-1551","url":"https://latticeworksystems.com.au/ism/ism-1551/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1551.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1551.md","official":{"statement":"An IT equipment management policy is developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Jun-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment usage","IT equipment management policy"]},"latticework_interpretation":null},{"id":"ISM-1552","url":"https://latticeworksystems.com.au/ism/ism-1552/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1552.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1552.md","official":{"statement":"All web application content is offered exclusively using HTTPS.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Oct-19","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Web application development","Web application interactions"]},"latticework_interpretation":null},{"id":"ISM-1553","url":"https://latticeworksystems.com.au/ism/ism-1553/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1553.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1553.md","official":{"statement":"TLS compression is disabled for TLS connections.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Transport Layer Security","Configuring Transport Layer Security"]},"latticework_interpretation":null},{"id":"ISM-1554","url":"https://latticeworksystems.com.au/ism/ism-1554/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1554.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1554.md","official":{"statement":"If travelling overseas with mobile devices to high or extreme risk countries, personnel are:\n\n- issued with newly provisioned user accounts, mobile devices and removable media from a pool of dedicated travel devices which are used solely for work-related activities\n- advised on how to apply and inspect tamper seals to key areas of mobile devices\n- advised to avoid taking any personal mobile devices, especially if rooted or jailbroken.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device usage","Before travelling overseas with mobile devices"]},"latticework_interpretation":null},{"id":"ISM-1555","url":"https://latticeworksystems.com.au/ism/ism-1555/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1555.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1555.md","official":{"statement":"Before travelling overseas with mobile devices, personnel take the following actions:\n\n- record all details of the mobile devices being taken, such as product types, serial numbers and International Mobile Equipment Identity numbers\n- update all operating systems and applications\n- remove all non-essential data, applications and user accounts\n- backup all remaining data, applications and settings.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device usage","Before travelling overseas with mobile devices"]},"latticework_interpretation":null},{"id":"ISM-1556","url":"https://latticeworksystems.com.au/ism/ism-1556/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1556.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1556.md","official":{"statement":"If returning from travelling overseas with mobile devices to high or extreme risk countries, personnel take the following additional actions:\n\n- reset credentials used with mobile devices, including those used for remote access to their organisation’s systems\n- monitor user accounts for any indicators of compromise, such as failed logon attempts.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device usage","After travelling overseas with mobile devices"]},"latticework_interpretation":null},{"id":"ISM-1557","url":"https://latticeworksystems.com.au/ism/ism-1557/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1557.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1557.md","official":{"statement":"Passwords used for single-factor authentication on SECRET systems are a minimum of 17 characters.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-25","applicability":["S"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Password strength"]},"latticework_interpretation":null},{"id":"ISM-1558","url":"https://latticeworksystems.com.au/ism/ism-1558/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1558.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1558.md","official":{"statement":"Passwords using a sequence of words for single-factor authentication are not constructed using:\n\n- a list of categorised words\n- a real sentence in a natural language\n- song lyrics, movie or television show quotes, literature, or any other publicly available material\n- less than 4 random words for non-classified, OFFICIAL: Sensitive and PROTECTED systems; 5 random words for SECRET systems; or 6 random words for TOP SECRET systems.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Password strength"]},"latticework_interpretation":null},{"id":"ISM-1559","url":"https://latticeworksystems.com.au/ism/ism-1559/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1559.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1559.md","official":{"statement":"Passwords used for multi-factor authentication on non-classified, OFFICIAL: Sensitive and PROTECTED systems are a minimum of 6 characters.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Dec-25","applicability":["NC","OS","P"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Password strength"]},"latticework_interpretation":null},{"id":"ISM-1560","url":"https://latticeworksystems.com.au/ism/ism-1560/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1560.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1560.md","official":{"statement":"Passwords used for multi-factor authentication on SECRET systems are a minimum of 8 characters.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-25","applicability":["S"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Password strength"]},"latticework_interpretation":null},{"id":"ISM-1561","url":"https://latticeworksystems.com.au/ism/ism-1561/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1561.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1561.md","official":{"statement":"Passwords used for multi-factor authentication on TOP SECRET systems are a minimum of 10 characters.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-25","applicability":["TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Password strength"]},"latticework_interpretation":null},{"id":"ISM-1562","url":"https://latticeworksystems.com.au/ism/ism-1562/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1562.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1562.md","official":{"statement":"Video conferencing and IP telephony infrastructure is hardened.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-19","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Video conferencing and Internet Protocol telephony","Video conferencing and Internet Protocol telephony infrastructure hardening"]},"latticework_interpretation":null},{"id":"ISM-1563","url":"https://latticeworksystems.com.au/ism/ism-1563/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1563.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1563.md","official":{"statement":"At the conclusion of a security control assessment for a system, a security assessment report is produced by the assessor and covers:\n\n- the scope of the security control assessment\n- the system’s strengths and weaknesses\n- security risks associated with the operation of the system\n- the effectiveness of the implementation of security controls\n- any recommended remediation actions.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security documentation","System-specific cyber security documentation","Security assessment report"]},"latticework_interpretation":null},{"id":"ISM-1564","url":"https://latticeworksystems.com.au/ism/ism-1564/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1564.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1564.md","official":{"statement":"At the conclusion of a security control assessment for a system, a plan of action and milestones is produced by the system owner.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security documentation","System-specific cyber security documentation","Plan of action and milestones"]},"latticework_interpretation":null},{"id":"ISM-1565","url":"https://latticeworksystems.com.au/ism/ism-1565/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1565.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1565.md","official":{"statement":"Tailored privileged user training is undertaken annually by all personnel with privileged access to systems and their resources.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for personnel security","Cyber security awareness training","Providing cyber security awareness training"]},"latticework_interpretation":null},{"id":"ISM-1566","url":"https://latticeworksystems.com.au/ism/ism-1566/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1566.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1566.md","official":{"statement":"Use of unprivileged access is centrally logged.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Unprivileged access to systems"]},"latticework_interpretation":null},{"id":"ISM-1567","url":"https://latticeworksystems.com.au/ism/ism-1567/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1567.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1567.md","official":{"statement":"Suppliers identified as high risk by a cyber supply chain risk assessment are not used.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Cyber supply chain risk management","Cyber supply chain risk management activities"]},"latticework_interpretation":null},{"id":"ISM-1568","url":"https://latticeworksystems.com.au/ism/ism-1568/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1568.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1568.md","official":{"statement":"Operating systems, applications, IT equipment, OT equipment and services are procured from suppliers that have demonstrated a commitment to the security of their products and services.","statement_format":"OSCAL markup-multiline","revision":"7","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Cyber supply chain risk management","Cyber supply chain risk management activities"]},"latticework_interpretation":null},{"id":"ISM-1569","url":"https://latticeworksystems.com.au/ism/ism-1569/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1569.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1569.md","official":{"statement":"A shared responsibility model is created, documented and shared between suppliers and their customers to articulate the security responsibilities of each party.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Cyber supply chain risk management","Cyber supply chain risk management activities"]},"latticework_interpretation":null},{"id":"ISM-1570","url":"https://latticeworksystems.com.au/ism/ism-1570/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1570.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1570.md","official":{"statement":"Outsourced cloud service providers and their non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET cloud services undergo an IRAP assessment, using the latest release of the ISM available prior to the beginning of the IRAP assessment (or a subsequent release), at least every 24 months.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Dec-24","applicability":["NC","OS","P","S"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Managed services and cloud services","Assessment of outsourced cloud service providers"]},"latticework_interpretation":null},{"id":"ISM-1571","url":"https://latticeworksystems.com.au/ism/ism-1571/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1571.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1571.md","official":{"statement":"The right to verify compliance with security requirements is documented in contractual arrangements with service providers.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Managed services and cloud services","Contractual security requirements with service providers"]},"latticework_interpretation":null},{"id":"ISM-1572","url":"https://latticeworksystems.com.au/ism/ism-1572/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1572.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1572.md","official":{"statement":"The regions or availability zones where data will be processed, stored and communicated, as well as a minimum notification period for any configuration changes, is documented in contractual arrangements with service providers.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Managed services and cloud services","Contractual security requirements with service providers"]},"latticework_interpretation":null},{"id":"ISM-1573","url":"https://latticeworksystems.com.au/ism/ism-1573/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1573.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1573.md","official":{"statement":"Access to all logs relating to an organisation’s data and services is documented in contractual arrangements with service providers.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Managed services and cloud services","Contractual security requirements with service providers"]},"latticework_interpretation":null},{"id":"ISM-1574","url":"https://latticeworksystems.com.au/ism/ism-1574/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1574.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1574.md","official":{"statement":"The storage of data in a portable manner that enables backups, service migration and service decommissioning without any loss of data is documented in contractual arrangements with service providers.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Managed services and cloud services","Contractual security requirements with service providers"]},"latticework_interpretation":null},{"id":"ISM-1575","url":"https://latticeworksystems.com.au/ism/ism-1575/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1575.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1575.md","official":{"statement":"A minimum notification period of one month for the cessation of any services by a service provider is documented in contractual arrangements with service providers.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Managed services and cloud services","Contractual security requirements with service providers"]},"latticework_interpretation":null},{"id":"ISM-1576","url":"https://latticeworksystems.com.au/ism/ism-1576/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1576.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1576.md","official":{"statement":"If an organisation’s systems are accessed or administered by a service provider in an unauthorised manner, it is treated as a cyber security incident and the organisation is immediately notified.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Managed services and cloud services","Access to systems by service providers"]},"latticework_interpretation":null},{"id":"ISM-1577","url":"https://latticeworksystems.com.au/ism/ism-1577/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1577.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1577.md","official":{"statement":"An organisation’s networks are segregated from their service providers’ networks.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Network segmentation and segregation"]},"latticework_interpretation":null},{"id":"ISM-1579","url":"https://latticeworksystems.com.au/ism/ism-1579/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1579.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1579.md","official":{"statement":"Cloud service providers’ ability to scale resources dynamically in response to genuine spikes in demand is discussed and verified as part of capacity and availability planning for online services.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Service continuity for online services","Capacity and availability planning and monitoring for online services"]},"latticework_interpretation":null},{"id":"ISM-1580","url":"https://latticeworksystems.com.au/ism/ism-1580/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1580.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1580.md","official":{"statement":"Where a high availability requirement exists for online services, the services are architected to automatically transition between availability zones.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Service continuity for online services","Capacity and availability planning and monitoring for online services"]},"latticework_interpretation":null},{"id":"ISM-1581","url":"https://latticeworksystems.com.au/ism/ism-1581/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1581.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1581.md","official":{"statement":"Continuous real-time monitoring of the capacity and availability of online services is performed.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Service continuity for online services","Capacity and availability planning and monitoring for online services"]},"latticework_interpretation":null},{"id":"ISM-1582","url":"https://latticeworksystems.com.au/ism/ism-1582/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1582.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1582.md","official":{"statement":"Application control rulesets are validated at least annually.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system hardening","Operating system hardening","Application control"]},"latticework_interpretation":null},{"id":"ISM-1583","url":"https://latticeworksystems.com.au/ism/ism-1583/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1583.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1583.md","official":{"statement":"Personnel who are contractors are identified as such.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Aug-20","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","User identification"]},"latticework_interpretation":null},{"id":"ISM-1584","url":"https://latticeworksystems.com.au/ism/ism-1584/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1584.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1584.md","official":{"statement":"Unprivileged users are prevented from bypassing, disabling or modifying security functionality of operating systems.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Hardening operating system configurations"]},"latticework_interpretation":null},{"id":"ISM-1585","url":"https://latticeworksystems.com.au/ism/ism-1585/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1585.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1585.md","official":{"statement":"Web browser security settings cannot be changed by human users.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system hardening","User application hardening","Web browsers"]},"latticework_interpretation":null},{"id":"ISM-1586","url":"https://latticeworksystems.com.au/ism/ism-1586/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1586.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1586.md","official":{"statement":"Data transfer logs are used to record all data imports and exports from systems.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Aug-20","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for data transfers","Data transfers","Monitoring data import and export"]},"latticework_interpretation":null},{"id":"ISM-1587","url":"https://latticeworksystems.com.au/ism/ism-1587/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1587.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1587.md","official":{"statement":"System owners report the security status of each system to its authorising officer at least annually.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Aug-20","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","System owners","Annual reporting of system security status"]},"latticework_interpretation":null},{"id":"ISM-1588","url":"https://latticeworksystems.com.au/ism/ism-1588/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1588.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1588.md","official":{"statement":"SOEs are reviewed and updated at least annually.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Aug-20","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Standard operating environments"]},"latticework_interpretation":null},{"id":"ISM-1589","url":"https://latticeworksystems.com.au/ism/ism-1589/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1589.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1589.md","official":{"statement":"MTA-STS is enabled to prevent the unencrypted transfer of emails between email servers.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for email","Email gateways and servers","Email server transport encryption"]},"latticework_interpretation":null},{"id":"ISM-1590","url":"https://latticeworksystems.com.au/ism/ism-1590/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1590.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1590.md","official":{"statement":"Credentials for user accounts are changed if:\n\n- they are compromised or suspected of being compromised\n- they are discovered stored on systems in the clear\n- they are discovered being transferred across networks in the clear\n- membership of a shared user account changes.","statement_format":"OSCAL markup-multiline","revision":"5","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Changing credentials"]},"latticework_interpretation":null},{"id":"ISM-1591","url":"https://latticeworksystems.com.au/ism/ism-1591/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1591.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1591.md","official":{"statement":"Access to systems and their resources are removed or suspended as soon as practicable when users are detected undertaking malicious activities.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Suspension of access to systems"]},"latticework_interpretation":null},{"id":"ISM-1592","url":"https://latticeworksystems.com.au/ism/ism-1592/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1592.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1592.md","official":{"statement":"Unprivileged human users do not have the ability to install unapproved applications.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Application management"]},"latticework_interpretation":null},{"id":"ISM-1593","url":"https://latticeworksystems.com.au/ism/ism-1593/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1593.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1593.md","official":{"statement":"Human users provide sufficient evidence to verify their identity when first requesting credentials, when requesting the reset of any credentials, when requesting the temporary disabling of any credentials, and when requesting the enrolment or re-enrolment of any credentials.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Setting credentials for user accounts"]},"latticework_interpretation":null},{"id":"ISM-1594","url":"https://latticeworksystems.com.au/ism/ism-1594/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1594.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1594.md","official":{"statement":"Credentials for human users are provided via a secure communications channel or, if not possible, split into two parts with one part provided to the human user and the other part provided to their supervisor.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Setting credentials for user accounts"]},"latticework_interpretation":null},{"id":"ISM-1595","url":"https://latticeworksystems.com.au/ism/ism-1595/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1595.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1595.md","official":{"statement":"Credentials provided to human users are changed on first use.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Setting credentials for user accounts"]},"latticework_interpretation":null},{"id":"ISM-1596","url":"https://latticeworksystems.com.au/ism/ism-1596/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1596.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1596.md","official":{"statement":"Credentials are not reused by users across different systems.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Setting credentials for user accounts"]},"latticework_interpretation":null},{"id":"ISM-1597","url":"https://latticeworksystems.com.au/ism/ism-1597/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1597.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1597.md","official":{"statement":"Credentials are obscured as they are entered into systems.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Aug-20","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Protecting credentials"]},"latticework_interpretation":null},{"id":"ISM-1598","url":"https://latticeworksystems.com.au/ism/ism-1598/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1598.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1598.md","official":{"statement":"Following maintenance or repairs to IT equipment, it is inspected to confirm that it retains its approved configuration and that no unauthorised modifications have been made.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment maintenance or repairs","Inspection of IT equipment following maintenance or repairs"]},"latticework_interpretation":null},{"id":"ISM-1599","url":"https://latticeworksystems.com.au/ism/ism-1599/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1599.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1599.md","official":{"statement":"IT equipment is handled in a manner suitable for its sensitivity or classification.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment usage","Handling IT equipment"]},"latticework_interpretation":null},{"id":"ISM-1600","url":"https://latticeworksystems.com.au/ism/ism-1600/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1600.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1600.md","official":{"statement":"Media is sanitised before it is used for the first time.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Apr-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media usage","Sanitising media before first use"]},"latticework_interpretation":null},{"id":"ISM-1601","url":"https://latticeworksystems.com.au/ism/ism-1601/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1601.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1601.md","official":{"statement":"Microsoft’s attack surface reduction rules are implemented.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Hardening operating system configurations"]},"latticework_interpretation":null},{"id":"ISM-1602","url":"https://latticeworksystems.com.au/ism/ism-1602/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1602.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1602.md","official":{"statement":"Cyber security documentation, including notification of subsequent changes, is communicated to all stakeholders.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security documentation","Development and maintenance of cyber security documentation","Communication of cyber security documentation"]},"latticework_interpretation":null},{"id":"ISM-1603","url":"https://latticeworksystems.com.au/ism/ism-1603/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1603.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1603.md","official":{"statement":"Authentication methods susceptible to replay attacks are disabled.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Aug-20","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Insecure authentication methods"]},"latticework_interpretation":null},{"id":"ISM-1604","url":"https://latticeworksystems.com.au/ism/ism-1604/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1604.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1604.md","official":{"statement":"When using a software-based isolation mechanism that consumes shared physical computing resources, the configuration of the isolation mechanism is hardened by removing unneeded functionality and restricting access to the administrative interface used to manage the isolation mechanism.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Virtualisation hardening","Functional separation between operating environments"]},"latticework_interpretation":{"title":"Set and verify workload isolation defaults","implementation_steps":["Review ASD and vendor hardening guidance for the workload and runtime. Record conflicts and approved exceptions before changing production.","Set non-root execution, a read-only root filesystem, no privilege escalation, restricted capabilities and an appropriate seccomp profile. Remove unnecessary host namespace and hostPath access. Test application compatibility and admission enforcement."],"evidence_to_retain":["Keep the guidance review, pinned policy revision, admitted workload manifests and dated scan or PolicyReport with exclusions.","Use failing and passing fixtures to demonstrate the enforced policy. Retain runtime and node configuration evidence separately; manifest settings do not prove runtime isolation."],"responsibility_boundary":"Platform team: admission controls, runtime and node configuration. Workload team: container settings and compatibility. Organisation: hardening standard, exception approval and system boundary.","checks":[{"engine":"kubescape","name":"ism-no-privileged-containers"},{"engine":"kubescape","name":"ism-pod-security-standards"},{"engine":"kubescape","name":"ism-readonly-root-filesystem"},{"engine":"kubescape","name":"ism-non-root-containers"},{"engine":"kubescape","name":"ism-no-privilege-escalation"},{"engine":"kubescape","name":"ism-no-host-access"},{"engine":"kubescape","name":"ism-drop-all-capabilities"},{"engine":"kubescape","name":"ism-seccomp-profile"},{"engine":"kyverno","name":"ism-workload-hardening-security-context"},{"engine":"kyverno","name":"ism-workload-hardening-block-host-namespaces"},{"engine":"kyverno","name":"ism-workload-hardening-block-host-path"},{"engine":"kyverno","name":"ism-workload-hardening-require-read-only-rootfs"}],"coverage":"partial","limitations":"Findings show selected container isolation and workload hardening settings; they do not assess the Kubernetes control plane, node runtime configuration or every administrative interface used to manage the isolation mechanism.","responsibility_allocation":{"eks":"customer-workload","self-managed":"customer-workload","source":"provisional","notes":"Provisional allocation for the detector evidence only. No provider inheritance or whole-control ownership is established until an authorised CSCM and the engagement boundary are reviewed."},"mapping_source":{"repository":"https://github.com/Latticework-Systems/ism-kubernetes-controls","revision":"07b348a2952bf2d0e78d9e739f367cb0919ab888","url":"https://github.com/Latticework-Systems/ism-kubernetes-controls/blob/07b348a2952bf2d0e78d9e739f367cb0919ab888/mapping/ism-mapping.yaml","sha256":"f823681fd71e40e589aae714ef2215dd8dc33722a1ec70b81ded5b2322937470"}}},{"id":"ISM-1605","url":"https://latticeworksystems.com.au/ism/ism-1605/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1605.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1605.md","official":{"statement":"When using a software-based isolation mechanism that consumes shared physical computing resources, the underlying operating system is hardened.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Virtualisation hardening","Functional separation between operating environments"]},"latticework_interpretation":null},{"id":"ISM-1606","url":"https://latticeworksystems.com.au/ism/ism-1606/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1606.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1606.md","official":{"statement":"When using a software-based isolation mechanism that consumes shared physical computing resources, patches, updates or vendor mitigations for vulnerabilities are applied to the isolation mechanism and underlying operating system in a timely manner.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Virtualisation hardening","Functional separation between operating environments"]},"latticework_interpretation":null},{"id":"ISM-1607","url":"https://latticeworksystems.com.au/ism/ism-1607/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1607.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1607.md","official":{"statement":"When using a software-based isolation mechanism that consumes shared physical resources, integrity monitoring and centralised event logging is performed for the isolation mechanism and underlying operating system.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Virtualisation hardening","Functional separation between operating environments"]},"latticework_interpretation":null},{"id":"ISM-1608","url":"https://latticeworksystems.com.au/ism/ism-1608/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1608.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1608.md","official":{"statement":"SOEs provided by third parties are scanned for malicious code and configurations.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Standard operating environments"]},"latticework_interpretation":null},{"id":"ISM-1609","url":"https://latticeworksystems.com.au/ism/ism-1609/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1609.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1609.md","official":{"statement":"System owners are consulted before allowing intrusion activity to continue on a system for the purpose of collecting further data or evidence.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security incidents","Responding to cyber security incidents","Handling and containing intrusions"]},"latticework_interpretation":null},{"id":"ISM-1610","url":"https://latticeworksystems.com.au/ism/ism-1610/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1610.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1610.md","official":{"statement":"A method of emergency access to systems and their resources is documented and tested at least once when initially implemented and each time fundamental information technology infrastructure changes occur.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Emergency access to systems"]},"latticework_interpretation":null},{"id":"ISM-1611","url":"https://latticeworksystems.com.au/ism/ism-1611/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1611.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1611.md","official":{"statement":"Break glass accounts are only used when normal authentication processes cannot be used.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Aug-20","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Emergency access to systems"]},"latticework_interpretation":null},{"id":"ISM-1612","url":"https://latticeworksystems.com.au/ism/ism-1612/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1612.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1612.md","official":{"statement":"Break glass accounts are only used for specific authorised activities.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Aug-20","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Emergency access to systems"]},"latticework_interpretation":null},{"id":"ISM-1613","url":"https://latticeworksystems.com.au/ism/ism-1613/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1613.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1613.md","official":{"statement":"Use of break glass accounts is centrally logged.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Emergency access to systems"]},"latticework_interpretation":null},{"id":"ISM-1614","url":"https://latticeworksystems.com.au/ism/ism-1614/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1614.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1614.md","official":{"statement":"Break glass account credentials are changed by the account custodian after they are accessed by any other party.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Aug-20","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Emergency access to systems"]},"latticework_interpretation":null},{"id":"ISM-1615","url":"https://latticeworksystems.com.au/ism/ism-1615/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1615.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1615.md","official":{"statement":"Break glass accounts are tested after credentials are changed.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Aug-20","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Emergency access to systems"]},"latticework_interpretation":null},{"id":"ISM-1616","url":"https://latticeworksystems.com.au/ism/ism-1616/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1616.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1616.md","official":{"statement":"A vulnerability disclosure program is implemented to assist with the secure development and maintenance of products and services.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Aug-20","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Vulnerability disclosure program"]},"latticework_interpretation":null},{"id":"ISM-1617","url":"https://latticeworksystems.com.au/ism/ism-1617/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1617.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1617.md","official":{"statement":"The CISO regularly reviews and updates their organisation’s cyber security program to ensure its relevance in addressing cyber threats and harnessing business and cyber security opportunities.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Oct-20","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","Chief information security officer","Overseeing the cyber security program"]},"latticework_interpretation":null},{"id":"ISM-1618","url":"https://latticeworksystems.com.au/ism/ism-1618/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1618.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1618.md","official":{"statement":"The CISO oversees their organisation’s response to cyber security incidents.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Oct-20","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","Chief information security officer","Overseeing cyber security incident response activities"]},"latticework_interpretation":null},{"id":"ISM-1619","url":"https://latticeworksystems.com.au/ism/ism-1619/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1619.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1619.md","official":{"statement":"Service accounts are created as group Managed Service Accounts.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Oct-20","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Setting credentials for built-in Administrator accounts, break glass accounts, local administrator accounts and service accounts"]},"latticework_interpretation":null},{"id":"ISM-1620","url":"https://latticeworksystems.com.au/ism/ism-1620/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1620.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1620.md","official":{"statement":"Privileged user accounts are members of the Protected Users security group.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Mar-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services security group memberships"]},"latticework_interpretation":null},{"id":"ISM-1621","url":"https://latticeworksystems.com.au/ism/ism-1621/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1621.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1621.md","official":{"statement":"Windows PowerShell 2.0 is disabled or removed.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system hardening","Operating system hardening","PowerShell"]},"latticework_interpretation":null},{"id":"ISM-1622","url":"https://latticeworksystems.com.au/ism/ism-1622/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1622.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1622.md","official":{"statement":"PowerShell is configured to use Constrained Language Mode.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Oct-20","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system hardening","Operating system hardening","PowerShell"]},"latticework_interpretation":null},{"id":"ISM-1623","url":"https://latticeworksystems.com.au/ism/ism-1623/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1623.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1623.md","official":{"statement":"PowerShell module logging, script block logging and transcription events are centrally logged.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system hardening","Operating system hardening","PowerShell"]},"latticework_interpretation":null},{"id":"ISM-1624","url":"https://latticeworksystems.com.au/ism/ism-1624/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1624.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1624.md","official":{"statement":"PowerShell script block logs are protected by Protected Event Logging functionality.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Oct-20","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","PowerShell"]},"latticework_interpretation":null},{"id":"ISM-1625","url":"https://latticeworksystems.com.au/ism/ism-1625/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1625.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1625.md","official":{"statement":"An insider threat mitigation program is developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Jun-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security incidents","Managing cyber security incidents","Insider threat mitigation program"]},"latticework_interpretation":null},{"id":"ISM-1626","url":"https://latticeworksystems.com.au/ism/ism-1626/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1626.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1626.md","official":{"statement":"Legal advice is sought regarding the development and implementation of an insider threat mitigation program.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security incidents","Managing cyber security incidents","Insider threat mitigation program"]},"latticework_interpretation":null},{"id":"ISM-1627","url":"https://latticeworksystems.com.au/ism/ism-1627/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1627.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1627.md","official":{"statement":"Inbound network connections from anonymity networks are blocked.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Blocking anonymity network traffic"]},"latticework_interpretation":null},{"id":"ISM-1628","url":"https://latticeworksystems.com.au/ism/ism-1628/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1628.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1628.md","official":{"statement":"Outbound network connections to anonymity networks are blocked.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Nov-20","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Blocking anonymity network traffic"]},"latticework_interpretation":null},{"id":"ISM-1629","url":"https://latticeworksystems.com.au/ism/ism-1629/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1629.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1629.md","official":{"statement":"When using DH for agreeing on encryption session keys, a modulus and associated parameters are selected according to NIST SP 800-56A Rev. 3.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic algorithms","Using Diffie-Hellman"]},"latticework_interpretation":null},{"id":"ISM-1631","url":"https://latticeworksystems.com.au/ism/ism-1631/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1631.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1631.md","official":{"statement":"Suppliers of operating systems, applications, IT equipment, OT equipment and services associated with systems are identified.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Cyber supply chain risk management","Cyber supply chain risk management activities"]},"latticework_interpretation":null},{"id":"ISM-1632","url":"https://latticeworksystems.com.au/ism/ism-1632/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1632.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1632.md","official":{"statement":"Operating systems, applications, IT equipment, OT equipment and services are procured from suppliers that have a strong track record of maintaining the security of their own systems.","statement_format":"OSCAL markup-multiline","revision":"6","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Cyber supply chain risk management","Cyber supply chain risk management activities"]},"latticework_interpretation":null},{"id":"ISM-1633","url":"https://latticeworksystems.com.au/ism/ism-1633/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1633.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1633.md","official":{"statement":"System owners, in consultation with each system’s authorising officer, determine the system boundary, business criticality, and security and resilience objectives for each system based on an assessment of the impact if it were to be compromised or attacked.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Mar-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","System owners","Protecting systems and their resources"]},"latticework_interpretation":null},{"id":"ISM-1634","url":"https://latticeworksystems.com.au/ism/ism-1634/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1634.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1634.md","official":{"statement":"System owners, in consultation with each system’s authorising officer, select security controls for each system and tailor them to achieve desired security and resilience objectives.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","System owners","Protecting systems and their resources"]},"latticework_interpretation":null},{"id":"ISM-1635","url":"https://latticeworksystems.com.au/ism/ism-1635/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1635.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1635.md","official":{"statement":"System owners implement security controls for each system and its operating environment.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","System owners","Protecting systems and their resources"]},"latticework_interpretation":null},{"id":"ISM-1636","url":"https://latticeworksystems.com.au/ism/ism-1636/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1636.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1636.md","official":{"statement":"System owners, in consultation with each system’s authorising officer, ensure security controls for each non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET system and its operating environment undergo a security control assessment by their organisation’s own assessors or Infosec Registered Assessor Program (IRAP) assessors to determine if they have been implemented correctly and are operating as intended.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Sep-26","applicability":["NC","OS","P","S"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","System owners","Protecting systems and their resources"]},"latticework_interpretation":null},{"id":"ISM-1637","url":"https://latticeworksystems.com.au/ism/ism-1637/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1637.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1637.md","official":{"statement":"An outsourced cloud service register is developed, implemented, maintained and regularly verified.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Managed services and cloud services","Outsourced cloud services"]},"latticework_interpretation":null},{"id":"ISM-1638","url":"https://latticeworksystems.com.au/ism/ism-1638/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1638.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1638.md","official":{"statement":"An outsourced cloud service register contains the following for each outsourced cloud service:\n\n- cloud service provider’s name\n- cloud service’s name\n- purpose for using the cloud service\n- sensitivity or classification of data involved\n- due date for the next security control assessment of the cloud service\n- contractual arrangements for the cloud service\n- organisational point of contact for the cloud service\n- 24/7 contact details for the cloud service provider.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Managed services and cloud services","Outsourced cloud services"]},"latticework_interpretation":null},{"id":"ISM-1639","url":"https://latticeworksystems.com.au/ism/ism-1639/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1639.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1639.md","official":{"statement":"Building management cables are labelled with their purpose in black writing on a yellow background, with a minimum size of 2.5 cm x 1 cm, and attached at five-metre intervals.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Labelling building management cables"]},"latticework_interpretation":null},{"id":"ISM-1640","url":"https://latticeworksystems.com.au/ism/ism-1640/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1640.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1640.md","official":{"statement":"Cables for foreign systems installed in Australian facilities are labelled at inspection points.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Labelling cables for foreign systems in Australian facilities"]},"latticework_interpretation":null},{"id":"ISM-1641","url":"https://latticeworksystems.com.au/ism/ism-1641/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1641.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1641.md","official":{"statement":"Following the use of a degausser, magnetic media is physically damaged by deforming any internal platters.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media destruction","Degaussing magnetic media"]},"latticework_interpretation":null},{"id":"ISM-1642","url":"https://latticeworksystems.com.au/ism/ism-1642/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1642.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1642.md","official":{"statement":"Media is sanitised before it is reused in a different security domain.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Apr-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media usage","Sanitising media before first use"]},"latticework_interpretation":null},{"id":"ISM-1643","url":"https://latticeworksystems.com.au/ism/ism-1643/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1643.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1643.md","official":{"statement":"Software registers contain versions and patch histories of applications, drivers, operating systems and firmware.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system management","System administration","Software registers"]},"latticework_interpretation":null},{"id":"ISM-1644","url":"https://latticeworksystems.com.au/ism/ism-1644/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1644.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1644.md","official":{"statement":"Sensitive or classified phone calls and conversations are not conducted in public locations unless care is taken to reduce the chance of conversations being overheard.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Mar-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device usage","Using mobile devices in public spaces"]},"latticework_interpretation":null},{"id":"ISM-1645","url":"https://latticeworksystems.com.au/ism/ism-1645/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1645.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1645.md","official":{"statement":"Floor plan diagrams are developed, implemented, maintained and regularly verified.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Floor plan diagrams"]},"latticework_interpretation":null},{"id":"ISM-1646","url":"https://latticeworksystems.com.au/ism/ism-1646/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1646.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1646.md","official":{"statement":"Floor plan diagrams contain the following:\n\n- cable paths (including ingress and egress points between floors)\n- cable reticulation system and conduit paths\n- floor concentration boxes\n- wall outlet boxes\n- network cabinets.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Floor plan diagrams"]},"latticework_interpretation":null},{"id":"ISM-1647","url":"https://latticeworksystems.com.au/ism/ism-1647/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1647.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1647.md","official":{"statement":"Privileged access to systems and their resources are disabled after 12 months unless revalidated.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system access","Identity and access management","Suspension of access to systems"]},"latticework_interpretation":null},{"id":"ISM-1648","url":"https://latticeworksystems.com.au/ism/ism-1648/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1648.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1648.md","official":{"statement":"Privileged access to systems and their resources are disabled after 45 days of inactivity.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system access","Identity and access management","Suspension of access to systems"]},"latticework_interpretation":null},{"id":"ISM-1649","url":"https://latticeworksystems.com.au/ism/ism-1649/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1649.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1649.md","official":{"statement":"Just-in-time administration is used for the administration of systems and their resources.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system access","Identity and access management","Privileged access to systems"]},"latticework_interpretation":null},{"id":"ISM-1650","url":"https://latticeworksystems.com.au/ism/ism-1650/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1650.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1650.md","official":{"statement":"Privileged user account and security group management events are centrally logged.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system access","Identity and access management","Privileged access to systems"]},"latticework_interpretation":null},{"id":"ISM-1654","url":"https://latticeworksystems.com.au/ism/ism-1654/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1654.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1654.md","official":{"statement":"Internet Explorer 11 is disabled or removed.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system hardening","Operating system hardening","Hardening operating system configurations"]},"latticework_interpretation":null},{"id":"ISM-1655","url":"https://latticeworksystems.com.au/ism/ism-1655/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1655.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1655.md","official":{"statement":".NET Framework 3.5 (includes .NET 2.0 and 3.0) is disabled or removed.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system hardening","Operating system hardening","Hardening operating system configurations"]},"latticework_interpretation":null},{"id":"ISM-1656","url":"https://latticeworksystems.com.au/ism/ism-1656/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1656.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1656.md","official":{"statement":"Application control is implemented on non-internet-facing servers.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system hardening","Operating system hardening","Application control"]},"latticework_interpretation":null},{"id":"ISM-1657","url":"https://latticeworksystems.com.au/ism/ism-1657/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1657.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1657.md","official":{"statement":"Application control restricts the execution of executables, libraries, scripts, installers, compiled HTML, HTML applications and control panel applets to an organisation-approved set.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system hardening","Operating system hardening","Application control"]},"latticework_interpretation":{"title":"Review approved images and execution paths","implementation_steps":["Maintain an approved image registry policy with an owner and an exception process. Pin the policy revision and test regular and init containers.","Evaluate approved registries, privileged execution and Pod Security settings. Separately review the binaries, scripts and execution locations inside images and on hosts."],"evidence_to_retain":["Keep registry approvals, workload inventory, policy configuration, failing/passing fixtures and dated scan or admission results.","Link image contents and host application-control evidence to the same system boundary. Record namespaces and workload types omitted from the scan."],"responsibility_boundary":"Platform team: registry and admission guardrails. Workload team: image contents and required execution. Organisation: approved software set and exceptions.","checks":[{"engine":"kubescape","name":"ism-allowed-registries"},{"engine":"kubescape","name":"ism-no-privileged-containers"},{"engine":"kubescape","name":"ism-pod-security-standards"},{"engine":"kyverno","name":"ism-application-control-approved-registry"},{"engine":"kyverno","name":"ism-application-control-no-latest-tag"},{"engine":"kyverno","name":"ism-application-control-no-privileged"}],"coverage":"partial","limitations":"Approved-image and workload-execution findings evidence the Kubernetes translation of application control; they do not inspect binaries inside images.","responsibility_allocation":{"eks":"customer-workload","self-managed":"customer-workload","source":"provisional","notes":"Provisional allocation for the detector evidence only. No provider inheritance or whole-control ownership is established until an authorised CSCM and the engagement boundary are reviewed."},"mapping_source":{"repository":"https://github.com/Latticework-Systems/ism-kubernetes-controls","revision":"07b348a2952bf2d0e78d9e739f367cb0919ab888","url":"https://github.com/Latticework-Systems/ism-kubernetes-controls/blob/07b348a2952bf2d0e78d9e739f367cb0919ab888/mapping/ism-mapping.yaml","sha256":"f823681fd71e40e589aae714ef2215dd8dc33722a1ec70b81ded5b2322937470"}}},{"id":"ISM-1658","url":"https://latticeworksystems.com.au/ism/ism-1658/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1658.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1658.md","official":{"statement":"Application control restricts the execution of drivers to an organisation-approved set.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system hardening","Operating system hardening","Application control"]},"latticework_interpretation":null},{"id":"ISM-1659","url":"https://latticeworksystems.com.au/ism/ism-1659/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1659.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1659.md","official":{"statement":"Microsoft’s vulnerable driver blocklist is implemented.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system hardening","Operating system hardening","Application control"]},"latticework_interpretation":null},{"id":"ISM-1660","url":"https://latticeworksystems.com.au/ism/ism-1660/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1660.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1660.md","official":{"statement":"Allowed and blocked application control events are centrally logged.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system hardening","Operating system hardening","Application control"]},"latticework_interpretation":null},{"id":"ISM-1667","url":"https://latticeworksystems.com.au/ism/ism-1667/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1667.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1667.md","official":{"statement":"Microsoft Office is blocked from creating child processes.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system hardening","User application hardening","Office productivity suites"]},"latticework_interpretation":null},{"id":"ISM-1668","url":"https://latticeworksystems.com.au/ism/ism-1668/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1668.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1668.md","official":{"statement":"Microsoft Office is blocked from creating executable content.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system hardening","User application hardening","Office productivity suites"]},"latticework_interpretation":null},{"id":"ISM-1669","url":"https://latticeworksystems.com.au/ism/ism-1669/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1669.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1669.md","official":{"statement":"Microsoft Office is blocked from injecting code into other processes.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system hardening","User application hardening","Office productivity suites"]},"latticework_interpretation":null},{"id":"ISM-1670","url":"https://latticeworksystems.com.au/ism/ism-1670/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1670.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1670.md","official":{"statement":"PDF applications are blocked from creating child processes.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system hardening","User application hardening","Portable Document Format applications"]},"latticework_interpretation":null},{"id":"ISM-1671","url":"https://latticeworksystems.com.au/ism/ism-1671/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1671.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1671.md","official":{"statement":"Microsoft Office macros are disabled for human users that do not have a demonstrated business requirement.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system hardening","User application hardening","Office productivity suites"]},"latticework_interpretation":null},{"id":"ISM-1672","url":"https://latticeworksystems.com.au/ism/ism-1672/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1672.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1672.md","official":{"statement":"Microsoft Office macro antivirus scanning is enabled.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system hardening","User application hardening","Office productivity suites"]},"latticework_interpretation":null},{"id":"ISM-1673","url":"https://latticeworksystems.com.au/ism/ism-1673/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1673.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1673.md","official":{"statement":"Microsoft Office macros are blocked from making Win32 API calls.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system hardening","User application hardening","Office productivity suites"]},"latticework_interpretation":null},{"id":"ISM-1674","url":"https://latticeworksystems.com.au/ism/ism-1674/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1674.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1674.md","official":{"statement":"Only Microsoft Office macros running from within a sandboxed environment, a Trusted Location or that are digitally signed by a trusted publisher are allowed to execute.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system hardening","User application hardening","Office productivity suites"]},"latticework_interpretation":null},{"id":"ISM-1675","url":"https://latticeworksystems.com.au/ism/ism-1675/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1675.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1675.md","official":{"statement":"Microsoft Office macros digitally signed by an untrusted publisher cannot be enabled via the Message Bar or Backstage View.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system hardening","User application hardening","Office productivity suites"]},"latticework_interpretation":null},{"id":"ISM-1676","url":"https://latticeworksystems.com.au/ism/ism-1676/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1676.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1676.md","official":{"statement":"Microsoft Office’s list of trusted publishers is validated at least annually.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system hardening","User application hardening","Office productivity suites"]},"latticework_interpretation":null},{"id":"ISM-1679","url":"https://latticeworksystems.com.au/ism/ism-1679/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1679.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1679.md","official":{"statement":"Multi-factor authentication is used to authenticate human users to third-party online services that process, store or communicate their organisation’s sensitive data.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system access","Identity and access management","Multi-factor authentication"]},"latticework_interpretation":null},{"id":"ISM-1680","url":"https://latticeworksystems.com.au/ism/ism-1680/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1680.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1680.md","official":{"statement":"Multi-factor authentication (where available) is used to authenticate human users to third-party online services that process, store or communicate their organisation’s non-sensitive data.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system access","Identity and access management","Multi-factor authentication"]},"latticework_interpretation":null},{"id":"ISM-1681","url":"https://latticeworksystems.com.au/ism/ism-1681/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1681.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1681.md","official":{"statement":"Multi-factor authentication is used to authenticate customers to online customer services that process, store or communicate sensitive customer data.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system access","Identity and access management","Multi-factor authentication"]},"latticework_interpretation":null},{"id":"ISM-1682","url":"https://latticeworksystems.com.au/ism/ism-1682/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1682.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1682.md","official":{"statement":"Multi-factor authentication used for authenticating human users of systems is phishing-resistant.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system access","Identity and access management","Multi-factor authentication"]},"latticework_interpretation":null},{"id":"ISM-1683","url":"https://latticeworksystems.com.au/ism/ism-1683/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1683.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1683.md","official":{"statement":"Successful and unsuccessful multi-factor authentication events are centrally logged.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system access","Identity and access management","Multi-factor authentication"]},"latticework_interpretation":null},{"id":"ISM-1685","url":"https://latticeworksystems.com.au/ism/ism-1685/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1685.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1685.md","official":{"statement":"Credentials for break glass accounts, local administrator accounts and service accounts are long, unique, unpredictable and managed.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Jun-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system access","Credential management","Setting credentials for built-in Administrator accounts, break glass accounts, local administrator accounts and service accounts"]},"latticework_interpretation":{"title":"Inspect credential issuance, lifetime and sharing","implementation_steps":["Inventory workload and service identities, including credentials held outside Kubernetes. Prefer short-lived projected or dynamically issued credentials and explicitly set the intended audience.","Review legacy service-account token Secrets, default ServiceAccount use and credential sharing across workloads/environments. Test admission policies before rollout; assess existing credentials separately."],"evidence_to_retain":["Keep an identity-to-workload/environment inventory, credential issuer configuration, token lifetime/audience evidence and revocation/rotation records without recording secret values.","Keep policy configuration and admission results, plus a separate existing-credential review. Demonstrate uniqueness and dynamic issuance directly; non-default account names do not establish either."],"responsibility_boundary":"Platform team: token issuer and admission configuration. Workload team: identity allocation and application secrets. Organisation: credential policy, break-glass custody and access reviews.","checks":[{"engine":"kyverno","name":"ism-privileged-access-block-legacy-sa-tokens"}],"coverage":"partial","limitations":"PolicyReports show legacy long-lived service-account token Secrets; they do not assess external secret stores, break-glass credentials or rotation.","responsibility_allocation":{"eks":"customer-workload","self-managed":"customer-workload","source":"provisional","notes":"Provisional allocation for the detector evidence only. No provider inheritance or whole-control ownership is established until an authorised CSCM and the engagement boundary are reviewed."},"mapping_source":{"repository":"https://github.com/Latticework-Systems/ism-kubernetes-controls","revision":"07b348a2952bf2d0e78d9e739f367cb0919ab888","url":"https://github.com/Latticework-Systems/ism-kubernetes-controls/blob/07b348a2952bf2d0e78d9e739f367cb0919ab888/mapping/ism-mapping.yaml","sha256":"f823681fd71e40e589aae714ef2215dd8dc33722a1ec70b81ded5b2322937470"}}},{"id":"ISM-1686","url":"https://latticeworksystems.com.au/ism/ism-1686/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1686.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1686.md","official":{"statement":"Credential Guard functionality is enabled.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system access","Credential management","Protecting credentials"]},"latticework_interpretation":null},{"id":"ISM-1687","url":"https://latticeworksystems.com.au/ism/ism-1687/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1687.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1687.md","official":{"statement":"Privileged operating environments are not virtualised within unprivileged operating environments.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system management","System administration","Separate privileged operating environments"]},"latticework_interpretation":null},{"id":"ISM-1688","url":"https://latticeworksystems.com.au/ism/ism-1688/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1688.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1688.md","official":{"statement":"Unprivileged user accounts cannot be used to log on to privileged operating environments.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system management","System administration","Separate privileged operating environments"]},"latticework_interpretation":null},{"id":"ISM-1689","url":"https://latticeworksystems.com.au/ism/ism-1689/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1689.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1689.md","official":{"statement":"Privileged user accounts (excluding local administrator accounts) cannot be used to log on to unprivileged operating environments.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system management","System administration","Separate privileged operating environments"]},"latticework_interpretation":null},{"id":"ISM-1690","url":"https://latticeworksystems.com.au/ism/ism-1690/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1690.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1690.md","official":{"statement":"Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system management","System maintenance","Mitigating known vulnerabilities"]},"latticework_interpretation":{"title":"Connect image admission metadata to a real remediation timeline","implementation_steps":["Inventory affected services and dependencies and record their exposure. Triage vendor advisories and exploitation status against the exact deadline in this control.","Rebuild and deploy the remediated image, then verify the affected dependency version. Use build-age and build-date gates as supporting guardrails; image age alone does not establish patch inclusion."],"evidence_to_retain":["Keep advisory release time, severity/exploit assessment, affected component versions, build provenance and verified deployment time.","Link each PolicyReport to the image digest and actual scan/remediation records. Retain approved exceptions and unpatched exposure explicitly."],"responsibility_boundary":"Pipeline team: build provenance and deployment timeline. Workload team: dependency remediation and validation. Organisation: prioritisation, exposure decisions and exceptions.","checks":[{"engine":"kyverno","name":"ism-patch-applications-image-age-gate"},{"engine":"kyverno","name":"ism-patch-applications-require-build-date"}],"coverage":"partial","limitations":"PolicyReports show declared image build age at admission; they do not prove the image includes every applicable vendor patch.","responsibility_allocation":{"eks":"customer-platform","self-managed":"customer-platform","source":"provisional","notes":"Provisional allocation for the detector evidence only. No provider inheritance or whole-control ownership is established until an authorised CSCM and the engagement boundary are reviewed."},"mapping_source":{"repository":"https://github.com/Latticework-Systems/ism-kubernetes-controls","revision":"07b348a2952bf2d0e78d9e739f367cb0919ab888","url":"https://github.com/Latticework-Systems/ism-kubernetes-controls/blob/07b348a2952bf2d0e78d9e739f367cb0919ab888/mapping/ism-mapping.yaml","sha256":"f823681fd71e40e589aae714ef2215dd8dc33722a1ec70b81ded5b2322937470"}}},{"id":"ISM-1691","url":"https://latticeworksystems.com.au/ism/ism-1691/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1691.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1691.md","official":{"statement":"Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2"],"section_path":["Guidelines for system management","System maintenance","Mitigating known vulnerabilities"]},"latticework_interpretation":null},{"id":"ISM-1692","url":"https://latticeworksystems.com.au/ism/ism-1692/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1692.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1692.md","official":{"statement":"Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system management","System maintenance","Mitigating known vulnerabilities"]},"latticework_interpretation":null},{"id":"ISM-1693","url":"https://latticeworksystems.com.au/ism/ism-1693/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1693.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1693.md","official":{"statement":"Patches, updates or other vendor mitigations for vulnerabilities in applications other than office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within one month of release.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system management","System maintenance","Mitigating known vulnerabilities"]},"latticework_interpretation":{"title":"Connect image admission metadata to a real remediation timeline","implementation_steps":["Inventory affected services and dependencies and record their exposure. Triage vendor advisories and exploitation status against the exact deadline in this control.","Rebuild and deploy the remediated image, then verify the affected dependency version. Use build-age and build-date gates as supporting guardrails; image age alone does not establish patch inclusion."],"evidence_to_retain":["Keep advisory release time, severity/exploit assessment, affected component versions, build provenance and verified deployment time.","Link each PolicyReport to the image digest and actual scan/remediation records. Retain approved exceptions and unpatched exposure explicitly."],"responsibility_boundary":"Pipeline team: build provenance and deployment timeline. Workload team: dependency remediation and validation. Organisation: prioritisation, exposure decisions and exceptions.","checks":[{"engine":"kyverno","name":"ism-patch-applications-image-age-gate"},{"engine":"kyverno","name":"ism-patch-applications-require-build-date"}],"coverage":"partial","limitations":"PolicyReports show declared image build age at admission; they do not prove dependency-level remediation or the vendor release date.","responsibility_allocation":{"eks":"customer-platform","self-managed":"customer-platform","source":"provisional","notes":"Provisional allocation for the detector evidence only. No provider inheritance or whole-control ownership is established until an authorised CSCM and the engagement boundary are reviewed."},"mapping_source":{"repository":"https://github.com/Latticework-Systems/ism-kubernetes-controls","revision":"07b348a2952bf2d0e78d9e739f367cb0919ab888","url":"https://github.com/Latticework-Systems/ism-kubernetes-controls/blob/07b348a2952bf2d0e78d9e739f367cb0919ab888/mapping/ism-mapping.yaml","sha256":"f823681fd71e40e589aae714ef2215dd8dc33722a1ec70b81ded5b2322937470"}}},{"id":"ISM-1694","url":"https://latticeworksystems.com.au/ism/ism-1694/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1694.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1694.md","official":{"statement":"Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system management","System maintenance","Mitigating known vulnerabilities"]},"latticework_interpretation":{"title":"Track support and patch evidence for every operating-system layer","implementation_steps":["Inventory container base images, node operating systems and internet-facing network devices separately. Assign owners and record vendor support dates.","Use the mapped policies to review declared base-image metadata. Drive patch decisions from actual vendor advisories and vulnerability findings, then rebuild, deploy and verify the affected components within the applicable control deadline."],"evidence_to_retain":["Keep the component inventory, vendor advisory and release date, severity/exploit assessment, patch decision and deployment verification timestamps.","Retain image labels and PolicyReports as supporting metadata. Add node and device patch records; labels do not verify installed patches or support state."],"responsibility_boundary":"Platform team: node and device lifecycle. Workload/pipeline team: supported base images and rebuilt artefacts. Organisation: patch policy, deadlines and approved exceptions.","checks":[{"engine":"kyverno","name":"ism-patch-operating-systems-block-eol-base-images"},{"engine":"kyverno","name":"ism-patch-operating-systems-require-base-image-label"}],"coverage":"partial","limitations":"PolicyReports show declared container base-image support metadata; they do not prove patch timing for node operating systems or network devices.","responsibility_allocation":{"eks":"customer-platform","self-managed":"customer-platform","source":"provisional","notes":"Provisional allocation for the detector evidence only. No provider inheritance or whole-control ownership is established until an authorised CSCM and the engagement boundary are reviewed."},"mapping_source":{"repository":"https://github.com/Latticework-Systems/ism-kubernetes-controls","revision":"07b348a2952bf2d0e78d9e739f367cb0919ab888","url":"https://github.com/Latticework-Systems/ism-kubernetes-controls/blob/07b348a2952bf2d0e78d9e739f367cb0919ab888/mapping/ism-mapping.yaml","sha256":"f823681fd71e40e589aae714ef2215dd8dc33722a1ec70b81ded5b2322937470"}}},{"id":"ISM-1695","url":"https://latticeworksystems.com.au/ism/ism-1695/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1695.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1695.md","official":{"statement":"Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2"],"section_path":["Guidelines for system management","System maintenance","Mitigating known vulnerabilities"]},"latticework_interpretation":{"title":"Track support and patch evidence for every operating-system layer","implementation_steps":["Inventory container base images, node operating systems and internet-facing network devices separately. Assign owners and record vendor support dates.","Use the mapped policies to review declared base-image metadata. Drive patch decisions from actual vendor advisories and vulnerability findings, then rebuild, deploy and verify the affected components within the applicable control deadline."],"evidence_to_retain":["Keep the component inventory, vendor advisory and release date, severity/exploit assessment, patch decision and deployment verification timestamps.","Retain image labels and PolicyReports as supporting metadata. Add node and device patch records; labels do not verify installed patches or support state."],"responsibility_boundary":"Platform team: node and device lifecycle. Workload/pipeline team: supported base images and rebuilt artefacts. Organisation: patch policy, deadlines and approved exceptions.","checks":[{"engine":"kyverno","name":"ism-patch-operating-systems-block-eol-base-images"},{"engine":"kyverno","name":"ism-patch-operating-systems-require-base-image-label"}],"coverage":"partial","limitations":"PolicyReports show declared container base-image support metadata; they do not prove patch timing for node operating systems, workstations or network devices.","responsibility_allocation":{"eks":"customer-platform","self-managed":"customer-platform","source":"provisional","notes":"Provisional allocation for the detector evidence only. No provider inheritance or whole-control ownership is established until an authorised CSCM and the engagement boundary are reviewed."},"mapping_source":{"repository":"https://github.com/Latticework-Systems/ism-kubernetes-controls","revision":"07b348a2952bf2d0e78d9e739f367cb0919ab888","url":"https://github.com/Latticework-Systems/ism-kubernetes-controls/blob/07b348a2952bf2d0e78d9e739f367cb0919ab888/mapping/ism-mapping.yaml","sha256":"f823681fd71e40e589aae714ef2215dd8dc33722a1ec70b81ded5b2322937470"}}},{"id":"ISM-1696","url":"https://latticeworksystems.com.au/ism/ism-1696/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1696.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1696.md","official":{"statement":"Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system management","System maintenance","Mitigating known vulnerabilities"]},"latticework_interpretation":null},{"id":"ISM-1697","url":"https://latticeworksystems.com.au/ism/ism-1697/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1697.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1697.md","official":{"statement":"Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system management","System maintenance","Mitigating known vulnerabilities"]},"latticework_interpretation":null},{"id":"ISM-1698","url":"https://latticeworksystems.com.au/ism/ism-1698/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1698.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1698.md","official":{"statement":"A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online services.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for security assurance","Security assessments","Vulnerability scanning"]},"latticework_interpretation":{"title":"Prove scanner freshness and cadence outside admission labels","implementation_steps":["Configure vulnerability scanning for the affected services and dependencies at the cadence required by this control. Record the scanner identity, scope and database update process.","Connect trusted scan results to image digests in the delivery pipeline and preserve raw reports. Treat a declared scan-passed label as a signal to verify against the pipeline evidence."],"evidence_to_retain":["Keep scheduled job histories, successful and failed runs, coverage inventory, scanner configuration and vulnerability database timestamps.","Retain raw reports tied to image digests and remediation records. Reconcile missing services and stale scans; a successful admission result does not establish scan cadence."],"responsibility_boundary":"Pipeline team: scanner operation and trustworthy attestations. Workload team: coverage and remediation. Organisation: required cadence, scope and risk acceptance.","checks":[{"engine":"kyverno","name":"ism-patch-applications-require-scan-passed"}],"coverage":"partial","limitations":"PolicyReports show a declared successful image scan at admission; they do not prove scanner cadence, coverage or current vulnerability data.","responsibility_allocation":{"eks":"customer-platform","self-managed":"customer-platform","source":"provisional","notes":"Provisional allocation for the detector evidence only. No provider inheritance or whole-control ownership is established until an authorised CSCM and the engagement boundary are reviewed."},"mapping_source":{"repository":"https://github.com/Latticework-Systems/ism-kubernetes-controls","revision":"07b348a2952bf2d0e78d9e739f367cb0919ab888","url":"https://github.com/Latticework-Systems/ism-kubernetes-controls/blob/07b348a2952bf2d0e78d9e739f367cb0919ab888/mapping/ism-mapping.yaml","sha256":"f823681fd71e40e589aae714ef2215dd8dc33722a1ec70b81ded5b2322937470"}}},{"id":"ISM-1699","url":"https://latticeworksystems.com.au/ism/ism-1699/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1699.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1699.md","official":{"statement":"A vulnerability scanner is used at least weekly to identify missing patches or updates for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for security assurance","Security assessments","Vulnerability scanning"]},"latticework_interpretation":null},{"id":"ISM-1700","url":"https://latticeworksystems.com.au/ism/ism-1700/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1700.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1700.md","official":{"statement":"A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in applications other than office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for security assurance","Security assessments","Vulnerability scanning"]},"latticework_interpretation":{"title":"Prove scanner freshness and cadence outside admission labels","implementation_steps":["Configure vulnerability scanning for the affected services and dependencies at the cadence required by this control. Record the scanner identity, scope and database update process.","Connect trusted scan results to image digests in the delivery pipeline and preserve raw reports. Treat a declared scan-passed label as a signal to verify against the pipeline evidence."],"evidence_to_retain":["Keep scheduled job histories, successful and failed runs, coverage inventory, scanner configuration and vulnerability database timestamps.","Retain raw reports tied to image digests and remediation records. Reconcile missing services and stale scans; a successful admission result does not establish scan cadence."],"responsibility_boundary":"Pipeline team: scanner operation and trustworthy attestations. Workload team: coverage and remediation. Organisation: required cadence, scope and risk acceptance.","checks":[{"engine":"kyverno","name":"ism-patch-applications-require-scan-passed"}],"coverage":"partial","limitations":"PolicyReports show a declared successful image scan at admission; they do not prove fortnightly cadence or dependency-level scan coverage.","responsibility_allocation":{"eks":"customer-platform","self-managed":"customer-platform","source":"provisional","notes":"Provisional allocation for the detector evidence only. No provider inheritance or whole-control ownership is established until an authorised CSCM and the engagement boundary are reviewed."},"mapping_source":{"repository":"https://github.com/Latticework-Systems/ism-kubernetes-controls","revision":"07b348a2952bf2d0e78d9e739f367cb0919ab888","url":"https://github.com/Latticework-Systems/ism-kubernetes-controls/blob/07b348a2952bf2d0e78d9e739f367cb0919ab888/mapping/ism-mapping.yaml","sha256":"f823681fd71e40e589aae714ef2215dd8dc33722a1ec70b81ded5b2322937470"}}},{"id":"ISM-1701","url":"https://latticeworksystems.com.au/ism/ism-1701/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1701.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1701.md","official":{"statement":"A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for security assurance","Security assessments","Vulnerability scanning"]},"latticework_interpretation":null},{"id":"ISM-1702","url":"https://latticeworksystems.com.au/ism/ism-1702/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1702.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1702.md","official":{"statement":"A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for security assurance","Security assessments","Vulnerability scanning"]},"latticework_interpretation":null},{"id":"ISM-1703","url":"https://latticeworksystems.com.au/ism/ism-1703/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1703.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1703.md","official":{"statement":"A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in drivers.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for security assurance","Security assessments","Vulnerability scanning"]},"latticework_interpretation":null},{"id":"ISM-1704","url":"https://latticeworksystems.com.au/ism/ism-1704/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1704.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1704.md","official":{"statement":"Office productivity suites, web browsers and their extensions, email clients, PDF applications, Adobe Flash Player, and security products that are no longer supported by vendors are removed.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system management","System maintenance","Cessation of support"]},"latticework_interpretation":null},{"id":"ISM-1705","url":"https://latticeworksystems.com.au/ism/ism-1705/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1705.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1705.md","official":{"statement":"Privileged user accounts (excluding backup administrator accounts) cannot access backups belonging to other user accounts.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system management","Data backup and restoration","Backup access"]},"latticework_interpretation":null},{"id":"ISM-1706","url":"https://latticeworksystems.com.au/ism/ism-1706/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1706.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1706.md","official":{"statement":"Privileged user accounts (excluding backup administrator accounts) cannot access their own backups.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system management","Data backup and restoration","Backup access"]},"latticework_interpretation":null},{"id":"ISM-1707","url":"https://latticeworksystems.com.au/ism/ism-1707/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1707.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1707.md","official":{"statement":"Privileged user accounts (excluding backup administrator accounts) are prevented from modifying and deleting backups.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system management","Data backup and restoration","Backup modification and deletion"]},"latticework_interpretation":null},{"id":"ISM-1708","url":"https://latticeworksystems.com.au/ism/ism-1708/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1708.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1708.md","official":{"statement":"Backup administrator accounts are prevented from modifying and deleting backups during their retention period.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system management","Data backup and restoration","Backup modification and deletion"]},"latticework_interpretation":null},{"id":"ISM-1710","url":"https://latticeworksystems.com.au/ism/ism-1710/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1710.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1710.md","official":{"statement":"Settings for wireless access points are hardened.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Wireless networks","Default settings"]},"latticework_interpretation":null},{"id":"ISM-1711","url":"https://latticeworksystems.com.au/ism/ism-1711/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1711.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1711.md","official":{"statement":"User identity confidentiality is used if available with EAP-TLS implementations.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","802.1X authentication and key exchange"]},"latticework_interpretation":null},{"id":"ISM-1712","url":"https://latticeworksystems.com.au/ism/ism-1712/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1712.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1712.md","official":{"statement":"The use of FT (802.11r) is disabled unless authenticator-to-authenticator communications are secured by an ASD-Approved Cryptographic Protocol.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Wireless networks","Fast Basic Service Set Transition"]},"latticework_interpretation":null},{"id":"ISM-1713","url":"https://latticeworksystems.com.au/ism/ism-1713/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1713.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1713.md","official":{"statement":"A removable media register is developed, implemented, maintained and regularly verified.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media usage","Removable media register"]},"latticework_interpretation":null},{"id":"ISM-1717","url":"https://latticeworksystems.com.au/ism/ism-1717/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1717.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1717.md","official":{"statement":"A ‘security.txt’ file is hosted for each of an organisation’s internet-facing website domains to assist in the responsible disclosure of vulnerabilities in the organisation’s products and services.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Vulnerability disclosure program"]},"latticework_interpretation":null},{"id":"ISM-1718","url":"https://latticeworksystems.com.au/ism/ism-1718/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1718.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1718.md","official":{"statement":"SECRET cables are coloured salmon pink.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Mar-23","applicability":["S"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Cable colours"]},"latticework_interpretation":null},{"id":"ISM-1719","url":"https://latticeworksystems.com.au/ism/ism-1719/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1719.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1719.md","official":{"statement":"TOP SECRET cables are coloured red.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Mar-23","applicability":["TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Cable colours"]},"latticework_interpretation":null},{"id":"ISM-1720","url":"https://latticeworksystems.com.au/ism/ism-1720/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1720.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1720.md","official":{"statement":"SECRET wall outlet boxes are coloured salmon pink.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-21","applicability":["S"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Wall outlet box colours"]},"latticework_interpretation":null},{"id":"ISM-1721","url":"https://latticeworksystems.com.au/ism/ism-1721/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1721.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1721.md","official":{"statement":"TOP SECRET wall outlet boxes are coloured red.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-21","applicability":["TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Wall outlet box colours"]},"latticework_interpretation":null},{"id":"ISM-1722","url":"https://latticeworksystems.com.au/ism/ism-1722/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1722.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1722.md","official":{"statement":"Electrostatic memory devices are destroyed using a furnace/incinerator, hammer mill, disintegrator or grinder/sander.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media destruction","Media destruction methods"]},"latticework_interpretation":null},{"id":"ISM-1723","url":"https://latticeworksystems.com.au/ism/ism-1723/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1723.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1723.md","official":{"statement":"Magnetic floppy disks are destroyed using a furnace/incinerator, hammer mill, disintegrator, degausser or by cutting.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media destruction","Media destruction methods"]},"latticework_interpretation":null},{"id":"ISM-1724","url":"https://latticeworksystems.com.au/ism/ism-1724/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1724.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1724.md","official":{"statement":"Magnetic hard disks are destroyed using a furnace/incinerator, hammer mill, disintegrator, grinder/sander or degausser.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media destruction","Media destruction methods"]},"latticework_interpretation":null},{"id":"ISM-1725","url":"https://latticeworksystems.com.au/ism/ism-1725/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1725.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1725.md","official":{"statement":"Magnetic tapes are destroyed using a furnace/incinerator, hammer mill, disintegrator, degausser or by cutting.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media destruction","Media destruction methods"]},"latticework_interpretation":null},{"id":"ISM-1726","url":"https://latticeworksystems.com.au/ism/ism-1726/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1726.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1726.md","official":{"statement":"Optical disks are destroyed using a furnace/incinerator, hammer mill, disintegrator, grinder/sander or by cutting.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media destruction","Media destruction methods"]},"latticework_interpretation":null},{"id":"ISM-1727","url":"https://latticeworksystems.com.au/ism/ism-1727/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1727.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1727.md","official":{"statement":"Semiconductor memory is destroyed using a furnace/incinerator, hammer mill or disintegrator.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media destruction","Media destruction methods"]},"latticework_interpretation":null},{"id":"ISM-1728","url":"https://latticeworksystems.com.au/ism/ism-1728/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1728.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1728.md","official":{"statement":"The resulting media waste particles from the destruction of SECRET media is stored and handled as OFFICIAL if less than or equal to 3 mm, PROTECTED if greater than 3 mm and less than or equal to 6 mm, or SECRET if greater than 6 mm and less than or equal to 9 mm.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-21","applicability":["S"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media destruction","Treatment of media waste particles"]},"latticework_interpretation":null},{"id":"ISM-1729","url":"https://latticeworksystems.com.au/ism/ism-1729/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1729.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1729.md","official":{"statement":"The resulting media waste particles from the destruction of TOP SECRET media is stored and handled as OFFICIAL if less than or equal to 3 mm, or SECRET if greater than 3 mm and less than or equal to 9 mm.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-21","applicability":["TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media destruction","Treatment of media waste particles"]},"latticework_interpretation":null},{"id":"ISM-1730","url":"https://latticeworksystems.com.au/ism/ism-1730/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1730.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1730.md","official":{"statement":"A software bill of materials is produced and made available to consumers of software.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-21","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Software bill of materials"]},"latticework_interpretation":null},{"id":"ISM-1731","url":"https://latticeworksystems.com.au/ism/ism-1731/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1731.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1731.md","official":{"statement":"Planning and coordination of intrusion remediation activities are conducted using trusted systems separate from a compromised system.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security incidents","Responding to cyber security incidents","Handling and containing intrusions"]},"latticework_interpretation":null},{"id":"ISM-1732","url":"https://latticeworksystems.com.au/ism/ism-1732/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1732.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1732.md","official":{"statement":"Intrusion remediation activities are coordinated and sequenced to minimise opportunities for re-compromise of a system while balancing operational risk and business continuity requirements.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security incidents","Responding to cyber security incidents","Handling and containing intrusions"]},"latticework_interpretation":null},{"id":"ISM-1735","url":"https://latticeworksystems.com.au/ism/ism-1735/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1735.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1735.md","official":{"statement":"Media that cannot be successfully sanitised is destroyed prior to its disposal.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media sanitisation","Media that cannot be successfully sanitised"]},"latticework_interpretation":null},{"id":"ISM-1736","url":"https://latticeworksystems.com.au/ism/ism-1736/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1736.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1736.md","official":{"statement":"A managed service register is developed, implemented, maintained and regularly verified.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Managed services and cloud services","Managed services"]},"latticework_interpretation":null},{"id":"ISM-1737","url":"https://latticeworksystems.com.au/ism/ism-1737/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1737.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1737.md","official":{"statement":"A managed service register contains the following for each managed service:\n\n- managed service provider’s name\n- managed service’s name\n- purpose for using the managed service\n- sensitivity or classification of data involved\n- due date for the next security control assessment of the managed service\n- contractual arrangements for the managed service\n- organisational point of contact for the managed service\n- 24/7 contact details for the managed service provider.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Managed services and cloud services","Managed services"]},"latticework_interpretation":null},{"id":"ISM-1738","url":"https://latticeworksystems.com.au/ism/ism-1738/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1738.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1738.md","official":{"statement":"The right to verify compliance with security requirements documented in contractual arrangements with service providers is regularly exercised.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Managed services and cloud services","Contractual security requirements with service providers"]},"latticework_interpretation":null},{"id":"ISM-1739","url":"https://latticeworksystems.com.au/ism/ism-1739/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1739.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1739.md","official":{"statement":"A system’s security architecture is approved prior to the development of the system.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security documentation","Development and maintenance of cyber security documentation","Approval of cyber security documentation"]},"latticework_interpretation":null},{"id":"ISM-1740","url":"https://latticeworksystems.com.au/ism/ism-1740/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1740.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1740.md","official":{"statement":"Personnel dealing with banking details and payment requests are advised of what business email compromise is and how to manage and report it.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for personnel security","Cyber security awareness training","Managing requests to change banking details or transfer funds"]},"latticework_interpretation":null},{"id":"ISM-1741","url":"https://latticeworksystems.com.au/ism/ism-1741/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1741.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1741.md","official":{"statement":"IT equipment destruction processes, and supporting IT equipment destruction procedures, are developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Jun-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment sanitisation and destruction","IT equipment destruction processes and procedures"]},"latticework_interpretation":null},{"id":"ISM-1742","url":"https://latticeworksystems.com.au/ism/ism-1742/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1742.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1742.md","official":{"statement":"IT equipment that cannot be sanitised is destroyed.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment sanitisation and destruction","Sanitising IT equipment"]},"latticework_interpretation":null},{"id":"ISM-1743","url":"https://latticeworksystems.com.au/ism/ism-1743/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1743.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1743.md","official":{"statement":"Vendors that have demonstrated a commitment to Secure by Design and Secure by Default principles and practices, including secure programming practices and either memory-safe programming languages or less preferably memory-safe programming practices, are used for operating systems.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Mar-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Operating system selection"]},"latticework_interpretation":null},{"id":"ISM-1745","url":"https://latticeworksystems.com.au/ism/ism-1745/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1745.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1745.md","official":{"statement":"Early Launch Antimalware, Secure Boot, Trusted Boot and Measured Boot functionality is enabled.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Hardening operating system configurations"]},"latticework_interpretation":null},{"id":"ISM-1746","url":"https://latticeworksystems.com.au/ism/ism-1746/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1746.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1746.md","official":{"statement":"When implementing application control using path rules, only approved users can change file system permissions for approved files and folders.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Mar-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Application control"]},"latticework_interpretation":null},{"id":"ISM-1748","url":"https://latticeworksystems.com.au/ism/ism-1748/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1748.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1748.md","official":{"statement":"Email client security settings cannot be changed by human users.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","User application hardening","Email clients"]},"latticework_interpretation":null},{"id":"ISM-1749","url":"https://latticeworksystems.com.au/ism/ism-1749/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1749.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1749.md","official":{"statement":"Cached credentials are limited to one previous logon.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Protecting credentials"]},"latticework_interpretation":null},{"id":"ISM-1750","url":"https://latticeworksystems.com.au/ism/ism-1750/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1750.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1750.md","official":{"statement":"Administrative infrastructure for critical servers, high-value servers and regular servers is segregated from each other.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system management","System administration","Administrative infrastructure"]},"latticework_interpretation":null},{"id":"ISM-1751","url":"https://latticeworksystems.com.au/ism/ism-1751/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1751.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1751.md","official":{"statement":"Patches, updates or other vendor mitigations for vulnerabilities in operating systems of IT equipment other than workstations, servers and network devices are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Jun-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system management","System maintenance","Mitigating known vulnerabilities"]},"latticework_interpretation":null},{"id":"ISM-1752","url":"https://latticeworksystems.com.au/ism/ism-1752/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1752.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1752.md","official":{"statement":"A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of IT equipment other than workstations, servers and network devices.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Jun-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for security assurance","Security assessments","Vulnerability scanning"]},"latticework_interpretation":null},{"id":"ISM-1753","url":"https://latticeworksystems.com.au/ism/ism-1753/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1753.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1753.md","official":{"statement":"Internet-facing network devices that are no longer supported by vendors are replaced.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system management","System maintenance","Cessation of support"]},"latticework_interpretation":null},{"id":"ISM-1754","url":"https://latticeworksystems.com.au/ism/ism-1754/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1754.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1754.md","official":{"statement":"Vulnerabilities identified in software are resolved in a timely manner.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Reporting and resolving vulnerabilities"]},"latticework_interpretation":null},{"id":"ISM-1755","url":"https://latticeworksystems.com.au/ism/ism-1755/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1755.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1755.md","official":{"statement":"A vulnerability disclosure policy is developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Vulnerability disclosure program"]},"latticework_interpretation":null},{"id":"ISM-1756","url":"https://latticeworksystems.com.au/ism/ism-1756/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1756.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1756.md","official":{"statement":"Vulnerability disclosure processes, and supporting vulnerability disclosure procedures, are developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Vulnerability disclosure program"]},"latticework_interpretation":null},{"id":"ISM-1759","url":"https://latticeworksystems.com.au/ism/ism-1759/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1759.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1759.md","official":{"statement":"When using DH for agreeing on encryption session keys, a modulus of at least 3072 bits is used, preferably 3072 bits.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-22","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic algorithms","Using Diffie-Hellman"]},"latticework_interpretation":null},{"id":"ISM-1761","url":"https://latticeworksystems.com.au/ism/ism-1761/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1761.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1761.md","official":{"statement":"When using ECDH for agreeing on encryption session keys, NIST P-256, P-384 or P-521 curves are used, preferably the NIST P-384 curve.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-22","applicability":["S"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic algorithms","Using Elliptic Curve Diffie-Hellman"]},"latticework_interpretation":null},{"id":"ISM-1762","url":"https://latticeworksystems.com.au/ism/ism-1762/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1762.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1762.md","official":{"statement":"When using ECDH for agreeing on encryption session keys, NIST P-384 or P-521 curves are used, preferably the NIST P-384 curve.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-22","applicability":["TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic algorithms","Using Elliptic Curve Diffie-Hellman"]},"latticework_interpretation":null},{"id":"ISM-1763","url":"https://latticeworksystems.com.au/ism/ism-1763/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1763.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1763.md","official":{"statement":"When using ECDSA for digital signatures, NIST P-256, P-384 or P-521 curves are used, preferably the NIST P-384 curve.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-22","applicability":["S"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic algorithms","Using the Elliptic Curve Digital Signature Algorithm"]},"latticework_interpretation":null},{"id":"ISM-1764","url":"https://latticeworksystems.com.au/ism/ism-1764/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1764.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1764.md","official":{"statement":"When using ECDSA for digital signatures, NIST P-384 or P-521 curves are used, preferably the NIST P-384 curve.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-22","applicability":["TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic algorithms","Using the Elliptic Curve Digital Signature Algorithm"]},"latticework_interpretation":null},{"id":"ISM-1765","url":"https://latticeworksystems.com.au/ism/ism-1765/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1765.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1765.md","official":{"statement":"When using RSA for digital signatures, and transporting encryption session keys (and similar keys), a modulus of at least 3072 bits is used, preferably 3072 bits.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-24","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic algorithms","Using Rivest-Shamir-Adleman"]},"latticework_interpretation":null},{"id":"ISM-1766","url":"https://latticeworksystems.com.au/ism/ism-1766/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1766.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1766.md","official":{"statement":"When using SHA-2 for hashing, an output size of at least 224 bits is used, preferably SHA-384 or SHA-512.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-24","applicability":["NC","OS","P"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic algorithms","Using Secure Hashing Algorithms"]},"latticework_interpretation":null},{"id":"ISM-1767","url":"https://latticeworksystems.com.au/ism/ism-1767/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1767.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1767.md","official":{"statement":"When using SHA-2 for hashing, an output size of at least 256 bits is used, preferably SHA-384 or SHA-512.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-24","applicability":["S"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic algorithms","Using Secure Hashing Algorithms"]},"latticework_interpretation":null},{"id":"ISM-1768","url":"https://latticeworksystems.com.au/ism/ism-1768/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1768.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1768.md","official":{"statement":"When using SHA-2 for hashing, an output size of at least 384 bits is used, preferably SHA-384 or SHA-512.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-24","applicability":["TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic algorithms","Using Secure Hashing Algorithms"]},"latticework_interpretation":null},{"id":"ISM-1769","url":"https://latticeworksystems.com.au/ism/ism-1769/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1769.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1769.md","official":{"statement":"When using AES for encryption, AES-128, AES-192 or AES-256 is used, preferably AES-256.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-24","applicability":["NC","OS","P","S"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic algorithms","Using symmetric cryptographic algorithms"]},"latticework_interpretation":null},{"id":"ISM-1770","url":"https://latticeworksystems.com.au/ism/ism-1770/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1770.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1770.md","official":{"statement":"When using AES for encryption, AES-192 or AES-256 is used, preferably AES-256.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-22","applicability":["TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic algorithms","Using symmetric cryptographic algorithms"]},"latticework_interpretation":null},{"id":"ISM-1771","url":"https://latticeworksystems.com.au/ism/ism-1771/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1771.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1771.md","official":{"statement":"AES is used for encrypting IPsec connections, preferably ENCR_AES_GCM_16.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Internet Protocol Security","Encryption algorithms"]},"latticework_interpretation":null},{"id":"ISM-1772","url":"https://latticeworksystems.com.au/ism/ism-1772/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1772.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1772.md","official":{"statement":"PRF_HMAC_SHA2_256, PRF_HMAC_SHA2_384 or PRF_HMAC_SHA2_512 is used for IPsec connections, preferably PRF_HMAC_SHA2_512.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Internet Protocol Security","Pseudorandom function"]},"latticework_interpretation":null},{"id":"ISM-1773","url":"https://latticeworksystems.com.au/ism/ism-1773/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1773.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1773.md","official":{"statement":"System administrators for gateways that connect to Australian Government Access Only networks are Australian nationals or seconded foreign nationals.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-22","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Gateways","System administrators for gateways"]},"latticework_interpretation":null},{"id":"ISM-1774","url":"https://latticeworksystems.com.au/ism/ism-1774/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1774.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1774.md","official":{"statement":"Gateways are managed via a secure path isolated from all connected networks.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Gateways","System administration of gateways"]},"latticework_interpretation":null},{"id":"ISM-1778","url":"https://latticeworksystems.com.au/ism/ism-1778/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1778.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1778.md","official":{"statement":"When manually importing data to systems, all data that fails security checks is quarantined until reviewed and subsequently approved or not approved for release.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for data transfers","Data transfers","Manual import of data"]},"latticework_interpretation":null},{"id":"ISM-1779","url":"https://latticeworksystems.com.au/ism/ism-1779/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1779.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1779.md","official":{"statement":"When manually exporting data from systems, all data that fails security checks is quarantined until reviewed and subsequently approved or not approved for release.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for data transfers","Data transfers","Manual export of data"]},"latticework_interpretation":null},{"id":"ISM-1780","url":"https://latticeworksystems.com.au/ism/ism-1780/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1780.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1780.md","official":{"statement":"SecDevOps practices are used for software development.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Mar-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Secure software development"]},"latticework_interpretation":null},{"id":"ISM-1781","url":"https://latticeworksystems.com.au/ism/ism-1781/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1781.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1781.md","official":{"statement":"All data communicated over network infrastructure is encrypted using ASD-approved cryptography.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Network encryption"]},"latticework_interpretation":null},{"id":"ISM-1782","url":"https://latticeworksystems.com.au/ism/ism-1782/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1782.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1782.md","official":{"statement":"A protective DNS service is used to block access to known malicious domain names.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Protective Domain Name System Services"]},"latticework_interpretation":null},{"id":"ISM-1783","url":"https://latticeworksystems.com.au/ism/ism-1783/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1783.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1783.md","official":{"statement":"Public IP addresses controlled by, or used by, an organisation are signed by valid ROA records.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Gateways","Border Gateway Protocol routing security"]},"latticework_interpretation":null},{"id":"ISM-1784","url":"https://latticeworksystems.com.au/ism/ism-1784/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1784.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1784.md","official":{"statement":"The cyber security incident management policy, including the associated cyber security incident response plan, is exercised at least annually.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security incidents","Managing cyber security incidents","Cyber security incident management policy"]},"latticework_interpretation":null},{"id":"ISM-1785","url":"https://latticeworksystems.com.au/ism/ism-1785/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1785.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1785.md","official":{"statement":"A supplier relationship management policy is developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Cyber supply chain risk management","Supplier relationship management"]},"latticework_interpretation":null},{"id":"ISM-1786","url":"https://latticeworksystems.com.au/ism/ism-1786/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1786.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1786.md","official":{"statement":"An approved supplier list is developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Cyber supply chain risk management","Supplier relationship management"]},"latticework_interpretation":null},{"id":"ISM-1787","url":"https://latticeworksystems.com.au/ism/ism-1787/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1787.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1787.md","official":{"statement":"Operating systems, applications, IT equipment, OT equipment and services are sourced from approved suppliers.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Cyber supply chain risk management","Sourcing operating systems, applications, IT equipment, OT equipment and services"]},"latticework_interpretation":null},{"id":"ISM-1788","url":"https://latticeworksystems.com.au/ism/ism-1788/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1788.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1788.md","official":{"statement":"Multiple potential suppliers are identified for sourcing critical operating systems, applications, IT equipment, OT equipment and services.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Cyber supply chain risk management","Sourcing operating systems, applications, IT equipment, OT equipment and services"]},"latticework_interpretation":null},{"id":"ISM-1789","url":"https://latticeworksystems.com.au/ism/ism-1789/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1789.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1789.md","official":{"statement":"Sufficient spares of critical IT equipment and OT equipment are sourced and kept in reserve.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Jun-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Cyber supply chain risk management","Sourcing operating systems, applications, IT equipment, OT equipment and services"]},"latticework_interpretation":null},{"id":"ISM-1790","url":"https://latticeworksystems.com.au/ism/ism-1790/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1790.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1790.md","official":{"statement":"Operating systems, applications, IT equipment, OT equipment and services are delivered in a manner that maintains their integrity.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Cyber supply chain risk management","Delivery of operating systems, applications, IT equipment, OT equipment and services"]},"latticework_interpretation":null},{"id":"ISM-1791","url":"https://latticeworksystems.com.au/ism/ism-1791/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1791.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1791.md","official":{"statement":"The integrity of operating systems, applications, IT equipment, OT equipment and services are assessed as part of acceptance of products and services.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Cyber supply chain risk management","Delivery of operating systems, applications, IT equipment, OT equipment and services"]},"latticework_interpretation":null},{"id":"ISM-1792","url":"https://latticeworksystems.com.au/ism/ism-1792/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1792.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1792.md","official":{"statement":"The authenticity of operating systems, applications, IT equipment, OT equipment and services are assessed as part of acceptance of products and services.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Cyber supply chain risk management","Delivery of operating systems, applications, IT equipment, OT equipment and services"]},"latticework_interpretation":null},{"id":"ISM-1793","url":"https://latticeworksystems.com.au/ism/ism-1793/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1793.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1793.md","official":{"statement":"Managed service providers and their non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET managed services undergo an Infosec Registered Assessor Program (IRAP) assessment, using the latest release of the ISM available prior to the beginning of the IRAP assessment (or a subsequent release), at least every 24 months.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-24","applicability":["NC","OS","P","S"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Managed services and cloud services","Assessment of managed service providers"]},"latticework_interpretation":null},{"id":"ISM-1794","url":"https://latticeworksystems.com.au/ism/ism-1794/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1794.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1794.md","official":{"statement":"A minimum notification period of one month by service providers for significant changes to their own service provider arrangements is documented in contractual arrangements with service providers.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Managed services and cloud services","Contractual security requirements with service providers"]},"latticework_interpretation":null},{"id":"ISM-1795","url":"https://latticeworksystems.com.au/ism/ism-1795/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1795.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1795.md","official":{"statement":"Credentials for built-in Administrator accounts, break glass accounts, local administrator accounts and service accounts are a minimum of 30 characters.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Setting credentials for built-in Administrator accounts, break glass accounts, local administrator accounts and service accounts"]},"latticework_interpretation":null},{"id":"ISM-1796","url":"https://latticeworksystems.com.au/ism/ism-1796/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1796.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1796.md","official":{"statement":"Files containing executable content are digitally signed by a certificate with a verifiable chain of trust as part of software development.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Mar-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Secure software development"]},"latticework_interpretation":null},{"id":"ISM-1797","url":"https://latticeworksystems.com.au/ism/ism-1797/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1797.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1797.md","official":{"statement":"Installers, patches and updates are digitally signed or provided with cryptographic checksums as part of software development.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Mar-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Secure software development"]},"latticework_interpretation":null},{"id":"ISM-1798","url":"https://latticeworksystems.com.au/ism/ism-1798/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1798.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1798.md","official":{"statement":"Secure configuration guidance, in the form of a hardening guide or loosening guide, is produced and made available to consumers as part of software development.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Secure software development"]},"latticework_interpretation":null},{"id":"ISM-1799","url":"https://latticeworksystems.com.au/ism/ism-1799/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1799.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1799.md","official":{"statement":"Incoming emails are rejected if they do not pass DMARC checks.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for email","Email gateways and servers","Domain-based Message Authentication, Reporting and Conformance"]},"latticework_interpretation":null},{"id":"ISM-1800","url":"https://latticeworksystems.com.au/ism/ism-1800/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1800.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1800.md","official":{"statement":"Network devices are flashed with trusted firmware before they are used for the first time.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Network device integrity"]},"latticework_interpretation":null},{"id":"ISM-1801","url":"https://latticeworksystems.com.au/ism/ism-1801/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1801.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1801.md","official":{"statement":"Network devices are restarted at least monthly.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Regularly restarting network devices"]},"latticework_interpretation":null},{"id":"ISM-1802","url":"https://latticeworksystems.com.au/ism/ism-1802/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1802.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1802.md","official":{"statement":"HACE are issued an Approval for Use by ASD and operated in accordance with the latest version of their associated Australian Communications Security Instructions.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-23","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic fundamentals","High Assurance Cryptographic Equipment"]},"latticework_interpretation":null},{"id":"ISM-1803","url":"https://latticeworksystems.com.au/ism/ism-1803/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1803.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1803.md","official":{"statement":"A cyber security incident register contains the following for each cyber security incident:\n\n- the date the cyber security incident occurred\n- the date the cyber security incident was discovered\n- a description of the cyber security incident\n- any actions taken in response to the cyber security incident\n- to whom the cyber security incident was reported.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security incidents","Managing cyber security incidents","Cyber security incident register"]},"latticework_interpretation":null},{"id":"ISM-1804","url":"https://latticeworksystems.com.au/ism/ism-1804/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1804.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1804.md","official":{"statement":"Break clauses associated with failure to meet security requirements are documented in contractual arrangements with service providers.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Managed services and cloud services","Contractual security requirements with service providers"]},"latticework_interpretation":null},{"id":"ISM-1805","url":"https://latticeworksystems.com.au/ism/ism-1805/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1805.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1805.md","official":{"statement":"A denial of service response plan for video conferencing and IP telephony services contains the following:\n\n- how to identify signs of a denial-of-service attack\n- how to identify the source of a denial-of-service attack\n- how capabilities can be maintained during a denial-of-service attack\n- what actions can be taken to respond to a denial-of-service attack.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Video conferencing and Internet Protocol telephony","Denial of service response plan"]},"latticework_interpretation":null},{"id":"ISM-1806","url":"https://latticeworksystems.com.au/ism/ism-1806/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1806.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1806.md","official":{"statement":"Default user accounts or credentials for user applications, including for any pre-configured user accounts, are changed, disabled or removed during initial setup.","statement_format":"OSCAL markup-multiline","revision":"4","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","User application hardening","Hardening user application configurations"]},"latticework_interpretation":null},{"id":"ISM-1807","url":"https://latticeworksystems.com.au/ism/ism-1807/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1807.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1807.md","official":{"statement":"An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activities.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for security assurance","Security assessments","Vulnerability scanning"]},"latticework_interpretation":null},{"id":"ISM-1808","url":"https://latticeworksystems.com.au/ism/ism-1808/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1808.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1808.md","official":{"statement":"A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for security assurance","Security assessments","Vulnerability scanning"]},"latticework_interpretation":{"title":"Prove scanner freshness and cadence outside admission labels","implementation_steps":["Configure vulnerability scanning for the affected services and dependencies at the cadence required by this control. Record the scanner identity, scope and database update process.","Connect trusted scan results to image digests in the delivery pipeline and preserve raw reports. Treat a declared scan-passed label as a signal to verify against the pipeline evidence."],"evidence_to_retain":["Keep scheduled job histories, successful and failed runs, coverage inventory, scanner configuration and vulnerability database timestamps.","Retain raw reports tied to image digests and remediation records. Reconcile missing services and stale scans; a successful admission result does not establish scan cadence."],"responsibility_boundary":"Pipeline team: scanner operation and trustworthy attestations. Workload team: coverage and remediation. Organisation: required cadence, scope and risk acceptance.","checks":[{"engine":"kyverno","name":"ism-patch-applications-require-scan-passed"}],"coverage":"partial","limitations":"PolicyReports show only the workload's declared scan result; scanner identity, database freshness and scan configuration require pipeline evidence.","responsibility_allocation":{"eks":"customer-platform","self-managed":"customer-platform","source":"provisional","notes":"Provisional allocation for the detector evidence only. No provider inheritance or whole-control ownership is established until an authorised CSCM and the engagement boundary are reviewed."},"mapping_source":{"repository":"https://github.com/Latticework-Systems/ism-kubernetes-controls","revision":"07b348a2952bf2d0e78d9e739f367cb0919ab888","url":"https://github.com/Latticework-Systems/ism-kubernetes-controls/blob/07b348a2952bf2d0e78d9e739f367cb0919ab888/mapping/ism-mapping.yaml","sha256":"f823681fd71e40e589aae714ef2215dd8dc33722a1ec70b81ded5b2322937470"}}},{"id":"ISM-1809","url":"https://latticeworksystems.com.au/ism/ism-1809/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1809.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1809.md","official":{"statement":"When applications, operating systems, network devices or networked IT equipment that are no longer supported by vendors cannot be immediately removed or replaced, compensating security controls are implemented until such time that they can be removed or replaced.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system management","System maintenance","Cessation of support"]},"latticework_interpretation":null},{"id":"ISM-1810","url":"https://latticeworksystems.com.au/ism/ism-1810/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1810.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1810.md","official":{"statement":"Backups of data, applications and settings are synchronised to enable restoration to a common point in time.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system management","Data backup and restoration","Performing and retaining backups"]},"latticework_interpretation":null},{"id":"ISM-1811","url":"https://latticeworksystems.com.au/ism/ism-1811/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1811.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1811.md","official":{"statement":"Backups of data, applications and settings are retained in a secure and resilient manner.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system management","Data backup and restoration","Performing and retaining backups"]},"latticework_interpretation":null},{"id":"ISM-1812","url":"https://latticeworksystems.com.au/ism/ism-1812/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1812.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1812.md","official":{"statement":"Unprivileged user accounts cannot access backups belonging to other user accounts.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system management","Data backup and restoration","Backup access"]},"latticework_interpretation":null},{"id":"ISM-1813","url":"https://latticeworksystems.com.au/ism/ism-1813/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1813.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1813.md","official":{"statement":"Unprivileged user accounts cannot access their own backups.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system management","Data backup and restoration","Backup access"]},"latticework_interpretation":null},{"id":"ISM-1814","url":"https://latticeworksystems.com.au/ism/ism-1814/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1814.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1814.md","official":{"statement":"Unprivileged user accounts are prevented from modifying and deleting backups.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system management","Data backup and restoration","Backup modification and deletion"]},"latticework_interpretation":null},{"id":"ISM-1815","url":"https://latticeworksystems.com.au/ism/ism-1815/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1815.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1815.md","official":{"statement":"Event logs are protected from unauthorised modification and deletion.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for security assurance","Security monitoring","Centralised event logging facility"]},"latticework_interpretation":null},{"id":"ISM-1816","url":"https://latticeworksystems.com.au/ism/ism-1816/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1816.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1816.md","official":{"statement":"Unauthorised modification of the authoritative source for software is prevented.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-22","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Authoritative source for software"]},"latticework_interpretation":null},{"id":"ISM-1817","url":"https://latticeworksystems.com.au/ism/ism-1817/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1817.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1817.md","official":{"statement":"Authentication and authorisation of clients is performed when clients call network APIs that facilitate access to data not authorised for release into the public domain and are accessible over the internet.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Mar-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Network application programming interfaces"]},"latticework_interpretation":null},{"id":"ISM-1818","url":"https://latticeworksystems.com.au/ism/ism-1818/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1818.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1818.md","official":{"statement":"Authentication and authorisation of clients is performed when clients call network APIs that facilitate modification of data and are accessible over the internet.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Mar-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Network application programming interfaces"]},"latticework_interpretation":null},{"id":"ISM-1819","url":"https://latticeworksystems.com.au/ism/ism-1819/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1819.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1819.md","official":{"statement":"Following the identification of a cyber security incident, the cyber security incident response plan is enacted.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for cyber security incidents","Responding to cyber security incidents","Enacting cyber security incident response plans"]},"latticework_interpretation":null},{"id":"ISM-1820","url":"https://latticeworksystems.com.au/ism/ism-1820/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1820.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1820.md","official":{"statement":"Cables for individual systems use a consistent colour.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Cable colours"]},"latticework_interpretation":null},{"id":"ISM-1821","url":"https://latticeworksystems.com.au/ism/ism-1821/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1821.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1821.md","official":{"statement":"TOP SECRET cables, when bundled together or run in conduit, are run exclusively in their own individual cable bundle or conduit.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-23","applicability":["TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Common cable bundles and conduits"]},"latticework_interpretation":null},{"id":"ISM-1822","url":"https://latticeworksystems.com.au/ism/ism-1822/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1822.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1822.md","official":{"statement":"Wall outlet boxes for individual systems use a consistent colour.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Cabling infrastructure","Wall outlet box colours"]},"latticework_interpretation":null},{"id":"ISM-1823","url":"https://latticeworksystems.com.au/ism/ism-1823/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1823.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1823.md","official":{"statement":"Office productivity suite security settings cannot be changed by human users.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system hardening","User application hardening","Office productivity suites"]},"latticework_interpretation":null},{"id":"ISM-1824","url":"https://latticeworksystems.com.au/ism/ism-1824/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1824.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1824.md","official":{"statement":"PDF application security settings cannot be changed by human users.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system hardening","User application hardening","Portable Document Format applications"]},"latticework_interpretation":null},{"id":"ISM-1825","url":"https://latticeworksystems.com.au/ism/ism-1825/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1825.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1825.md","official":{"statement":"Security product security settings cannot be changed by human users.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","User application hardening","Security products"]},"latticework_interpretation":null},{"id":"ISM-1826","url":"https://latticeworksystems.com.au/ism/ism-1826/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1826.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1826.md","official":{"statement":"Vendors that have demonstrated a commitment to Secure by Design and Secure by Default principles and practices, including secure programming practices and either memory-safe programming languages or less preferably memory-safe programming practices, are used for server applications.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Mar-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Server application selection"]},"latticework_interpretation":null},{"id":"ISM-1827","url":"https://latticeworksystems.com.au/ism/ism-1827/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1827.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1827.md","official":{"statement":"Microsoft AD DS domain controllers are administered using dedicated domain administrator user accounts that are not used to administer other systems.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services"]},"latticework_interpretation":null},{"id":"ISM-1828","url":"https://latticeworksystems.com.au/ism/ism-1828/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1828.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1828.md","official":{"statement":"The Print Spooler service is disabled on Microsoft AD DS domain controllers.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services"]},"latticework_interpretation":null},{"id":"ISM-1829","url":"https://latticeworksystems.com.au/ism/ism-1829/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1829.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1829.md","official":{"statement":"Passwords are not stored in Group Policy Preferences.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services"]},"latticework_interpretation":null},{"id":"ISM-1830","url":"https://latticeworksystems.com.au/ism/ism-1830/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1830.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1830.md","official":{"statement":"Security-relevant events for Microsoft AD DS domain controllers, Microsoft AD CS servers, Microsoft AD FS servers and Microsoft Entra Connect servers are centrally logged.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory services"]},"latticework_interpretation":null},{"id":"ISM-1832","url":"https://latticeworksystems.com.au/ism/ism-1832/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1832.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1832.md","official":{"statement":"Only service accounts and computer accounts are configured with Service Principal Names (SPNs).","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services account hardening"]},"latticework_interpretation":null},{"id":"ISM-1833","url":"https://latticeworksystems.com.au/ism/ism-1833/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1833.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1833.md","official":{"statement":"User accounts are provisioned with the minimum privileges required.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services account hardening"]},"latticework_interpretation":null},{"id":"ISM-1834","url":"https://latticeworksystems.com.au/ism/ism-1834/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1834.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1834.md","official":{"statement":"Duplicate SPNs do not exist within the domain.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services account hardening"]},"latticework_interpretation":null},{"id":"ISM-1835","url":"https://latticeworksystems.com.au/ism/ism-1835/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1835.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1835.md","official":{"statement":"Privileged user accounts are configured as sensitive and cannot be delegated.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services account hardening"]},"latticework_interpretation":null},{"id":"ISM-1836","url":"https://latticeworksystems.com.au/ism/ism-1836/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1836.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1836.md","official":{"statement":"User accounts require Kerberos pre-authentication.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services account hardening"]},"latticework_interpretation":null},{"id":"ISM-1838","url":"https://latticeworksystems.com.au/ism/ism-1838/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1838.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1838.md","official":{"statement":"The UserPassword attribute for user accounts is not used.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services account hardening"]},"latticework_interpretation":null},{"id":"ISM-1839","url":"https://latticeworksystems.com.au/ism/ism-1839/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1839.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1839.md","official":{"statement":"Account properties accessible by unprivileged users are not used to store passwords.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services account hardening"]},"latticework_interpretation":null},{"id":"ISM-1840","url":"https://latticeworksystems.com.au/ism/ism-1840/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1840.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1840.md","official":{"statement":"User account passwords do not use reversible encryption.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services account hardening"]},"latticework_interpretation":null},{"id":"ISM-1841","url":"https://latticeworksystems.com.au/ism/ism-1841/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1841.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1841.md","official":{"statement":"Unprivileged user accounts cannot add machines to the domain.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services account hardening"]},"latticework_interpretation":null},{"id":"ISM-1842","url":"https://latticeworksystems.com.au/ism/ism-1842/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1842.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1842.md","official":{"statement":"Dedicated privileged service accounts are used to add machines to the domain.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services account hardening"]},"latticework_interpretation":null},{"id":"ISM-1843","url":"https://latticeworksystems.com.au/ism/ism-1843/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1843.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1843.md","official":{"statement":"User accounts with unconstrained delegation are reviewed at least annually, and those without an SPN or demonstrated business requirement are removed.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services account hardening"]},"latticework_interpretation":null},{"id":"ISM-1844","url":"https://latticeworksystems.com.au/ism/ism-1844/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1844.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1844.md","official":{"statement":"Computer accounts that are not Microsoft AD DS domain controllers are not trusted for delegation to services.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services account hardening"]},"latticework_interpretation":null},{"id":"ISM-1845","url":"https://latticeworksystems.com.au/ism/ism-1845/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1845.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1845.md","official":{"statement":"When a user account is disabled, it is removed from all security group memberships.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services security group memberships"]},"latticework_interpretation":null},{"id":"ISM-1846","url":"https://latticeworksystems.com.au/ism/ism-1846/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1846.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1846.md","official":{"statement":"The Pre-Windows 2000 Compatible Access security group does not contain user accounts.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services security group memberships"]},"latticework_interpretation":null},{"id":"ISM-1847","url":"https://latticeworksystems.com.au/ism/ism-1847/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1847.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1847.md","official":{"statement":"Credentials for the Kerberos Key Distribution Center’s service account (KRBTGT) are changed twice, allowing for replication to all Microsoft AD DS domain controllers in-between each change, if the domain has been directly compromised, the domain is suspected of being compromised or they have not been changed in the past six months.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Changing credentials"]},"latticework_interpretation":null},{"id":"ISM-1848","url":"https://latticeworksystems.com.au/ism/ism-1848/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1848.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1848.md","official":{"statement":"When using a software-based isolation mechanism that consumes shared physical computing resources, the isolation mechanism or underlying operating system is replaced when it is no longer supported by a vendor.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Virtualisation hardening","Functional separation between operating environments"]},"latticework_interpretation":null},{"id":"ISM-1849","url":"https://latticeworksystems.com.au/ism/ism-1849/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1849.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1849.md","official":{"statement":"The OWASP Top 10 Proactive Controls are used in the development of web applications.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Web application development","Secure web application design and development"]},"latticework_interpretation":null},{"id":"ISM-1850","url":"https://latticeworksystems.com.au/ism/ism-1850/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1850.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1850.md","official":{"statement":"The OWASP Top 10 are mitigated in the development of web applications.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Web application development","Secure web application design and development"]},"latticework_interpretation":null},{"id":"ISM-1851","url":"https://latticeworksystems.com.au/ism/ism-1851/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1851.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1851.md","official":{"statement":"The OWASP API Security Top 10 are mitigated in the development of web APIs.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Web application development","Web application programming interfaces"]},"latticework_interpretation":null},{"id":"ISM-1852","url":"https://latticeworksystems.com.au/ism/ism-1852/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1852.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1852.md","official":{"statement":"Unprivileged access to systems and their resources is limited to only what is required for users to undertake their duties or functions.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Unprivileged access to systems"]},"latticework_interpretation":null},{"id":"ISM-1854","url":"https://latticeworksystems.com.au/ism/ism-1854/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1854.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1854.md","official":{"statement":"Human users authenticate to MFDs before they can print, scan or copy documents.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Multifunction devices","Authenticating to multifunction devices"]},"latticework_interpretation":null},{"id":"ISM-1855","url":"https://latticeworksystems.com.au/ism/ism-1855/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1855.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1855.md","official":{"statement":"Use of MFDs for printing, scanning and copying purposes, including the capture of shadow copies of documents, are centrally logged.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Multifunction devices","Logging multifunction device use"]},"latticework_interpretation":null},{"id":"ISM-1858","url":"https://latticeworksystems.com.au/ism/ism-1858/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1858.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1858.md","official":{"statement":"IT equipment is hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment usage","Hardening IT equipment configurations"]},"latticework_interpretation":null},{"id":"ISM-1859","url":"https://latticeworksystems.com.au/ism/ism-1859/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1859.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1859.md","official":{"statement":"Office productivity suites are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system hardening","User application hardening","Office productivity suites"]},"latticework_interpretation":null},{"id":"ISM-1860","url":"https://latticeworksystems.com.au/ism/ism-1860/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1860.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1860.md","official":{"statement":"PDF applications are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system hardening","User application hardening","Portable Document Format applications"]},"latticework_interpretation":null},{"id":"ISM-1861","url":"https://latticeworksystems.com.au/ism/ism-1861/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1861.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1861.md","official":{"statement":"Local Security Authority protection functionality is enabled.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system access","Credential management","Protecting credentials"]},"latticework_interpretation":null},{"id":"ISM-1862","url":"https://latticeworksystems.com.au/ism/ism-1862/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1862.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1862.md","official":{"statement":"If using a WAF, disclosing the IP addresses of web servers under an organisation’s control (referred to as origin servers) is avoided and access to the origin servers is restricted to the WAF and authorised management networks.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Web application firewalls","Using web application firewalls"]},"latticework_interpretation":null},{"id":"ISM-1863","url":"https://latticeworksystems.com.au/ism/ism-1863/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1863.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1863.md","official":{"statement":"Networked management interfaces for IT equipment are not directly exposed to the internet.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Networked management interfaces"]},"latticework_interpretation":null},{"id":"ISM-1864","url":"https://latticeworksystems.com.au/ism/ism-1864/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1864.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1864.md","official":{"statement":"A system usage policy is developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","System usage policy"]},"latticework_interpretation":null},{"id":"ISM-1865","url":"https://latticeworksystems.com.au/ism/ism-1865/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1865.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1865.md","official":{"statement":"Personnel agree to abide by system usage policies before being granted access to systems and their resources.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","System access requirements"]},"latticework_interpretation":null},{"id":"ISM-1866","url":"https://latticeworksystems.com.au/ism/ism-1866/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1866.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1866.md","official":{"statement":"Personnel using privately owned mobile devices or desktop computers to access OFFICIAL: Sensitive or PROTECTED systems or data are prevented from storing classified data on their privately owned mobile devices and desktop computers.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Jun-26","applicability":["OS","P"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Enterprise mobility","Privately owned mobile devices and desktop computers"]},"latticework_interpretation":null},{"id":"ISM-1867","url":"https://latticeworksystems.com.au/ism/ism-1867/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1867.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1867.md","official":{"statement":"Mobile devices that access OFFICIAL: Sensitive or PROTECTED systems or data use mobile platforms that have completed a Common Criteria evaluation against the Protection Profile for Mobile Device Fundamentals, version 3.3 or later, and are operated in accordance with the latest version of their associated ASD security configuration guide.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Mar-24","applicability":["OS","P"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device management","Approved mobile platforms"]},"latticework_interpretation":null},{"id":"ISM-1868","url":"https://latticeworksystems.com.au/ism/ism-1868/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1868.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1868.md","official":{"statement":"SECRET and TOP SECRET mobile devices do not use removable media unless approved beforehand by ASD.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-23","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device management","Encrypted storage"]},"latticework_interpretation":null},{"id":"ISM-1869","url":"https://latticeworksystems.com.au/ism/ism-1869/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1869.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1869.md","official":{"statement":"A non-networked IT equipment register is developed, implemented, maintained and regularly verified.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment usage","IT equipment registers"]},"latticework_interpretation":null},{"id":"ISM-1870","url":"https://latticeworksystems.com.au/ism/ism-1870/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1870.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1870.md","official":{"statement":"Application control is applied to user profiles and temporary folders used by operating systems, web browsers and email clients.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system hardening","Operating system hardening","Application control"]},"latticework_interpretation":null},{"id":"ISM-1871","url":"https://latticeworksystems.com.au/ism/ism-1871/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1871.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1871.md","official":{"statement":"Application control is applied to all locations other than user profiles and temporary folders used by operating systems, web browsers and email clients.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system hardening","Operating system hardening","Application control"]},"latticework_interpretation":{"title":"Review approved images and execution paths","implementation_steps":["Maintain an approved image registry policy with an owner and an exception process. Pin the policy revision and test regular and init containers.","Evaluate approved registries, privileged execution and Pod Security settings. Separately review the binaries, scripts and execution locations inside images and on hosts."],"evidence_to_retain":["Keep registry approvals, workload inventory, policy configuration, failing/passing fixtures and dated scan or admission results.","Link image contents and host application-control evidence to the same system boundary. Record namespaces and workload types omitted from the scan."],"responsibility_boundary":"Platform team: registry and admission guardrails. Workload team: image contents and required execution. Organisation: approved software set and exceptions.","checks":[{"engine":"kubescape","name":"ism-allowed-registries"},{"engine":"kubescape","name":"ism-no-privileged-containers"},{"engine":"kubescape","name":"ism-pod-security-standards"},{"engine":"kyverno","name":"ism-application-control-approved-registry"},{"engine":"kyverno","name":"ism-application-control-no-latest-tag"},{"engine":"kyverno","name":"ism-application-control-no-privileged"}],"coverage":"partial","limitations":"Cluster-wide workload findings show whether the Kubernetes translation is applied across scanned namespaces; they do not assess host filesystem locations.","responsibility_allocation":{"eks":"customer-workload","self-managed":"customer-workload","source":"provisional","notes":"Provisional allocation for the detector evidence only. No provider inheritance or whole-control ownership is established until an authorised CSCM and the engagement boundary are reviewed."},"mapping_source":{"repository":"https://github.com/Latticework-Systems/ism-kubernetes-controls","revision":"07b348a2952bf2d0e78d9e739f367cb0919ab888","url":"https://github.com/Latticework-Systems/ism-kubernetes-controls/blob/07b348a2952bf2d0e78d9e739f367cb0919ab888/mapping/ism-mapping.yaml","sha256":"f823681fd71e40e589aae714ef2215dd8dc33722a1ec70b81ded5b2322937470"}}},{"id":"ISM-1872","url":"https://latticeworksystems.com.au/ism/ism-1872/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1872.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1872.md","official":{"statement":"Multi-factor authentication used for authenticating human users of online services is phishing-resistant.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system access","Identity and access management","Multi-factor authentication"]},"latticework_interpretation":null},{"id":"ISM-1873","url":"https://latticeworksystems.com.au/ism/ism-1873/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1873.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1873.md","official":{"statement":"Multi-factor authentication used for authenticating customers of online customer services provides a phishing-resistant option.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2"],"section_path":["Guidelines for system access","Identity and access management","Multi-factor authentication"]},"latticework_interpretation":null},{"id":"ISM-1874","url":"https://latticeworksystems.com.au/ism/ism-1874/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1874.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1874.md","official":{"statement":"Multi-factor authentication used for authenticating customers of online customer services is phishing-resistant.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system access","Identity and access management","Multi-factor authentication"]},"latticework_interpretation":null},{"id":"ISM-1875","url":"https://latticeworksystems.com.au/ism/ism-1875/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1875.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1875.md","official":{"statement":"Systems are scanned at least monthly to identify any credentials that are being stored in the clear.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Protecting credentials"]},"latticework_interpretation":null},{"id":"ISM-1876","url":"https://latticeworksystems.com.au/ism/ism-1876/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1876.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1876.md","official":{"statement":"Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system management","System maintenance","Mitigating known vulnerabilities"]},"latticework_interpretation":{"title":"Connect image admission metadata to a real remediation timeline","implementation_steps":["Inventory affected services and dependencies and record their exposure. Triage vendor advisories and exploitation status against the exact deadline in this control.","Rebuild and deploy the remediated image, then verify the affected dependency version. Use build-age and build-date gates as supporting guardrails; image age alone does not establish patch inclusion."],"evidence_to_retain":["Keep advisory release time, severity/exploit assessment, affected component versions, build provenance and verified deployment time.","Link each PolicyReport to the image digest and actual scan/remediation records. Retain approved exceptions and unpatched exposure explicitly."],"responsibility_boundary":"Pipeline team: build provenance and deployment timeline. Workload team: dependency remediation and validation. Organisation: prioritisation, exposure decisions and exceptions.","checks":[{"engine":"kyverno","name":"ism-patch-applications-image-age-gate"}],"coverage":"partial","limitations":"Admission-time image age is supporting evidence only; criticality, exploit status and the 48-hour remediation clock require vulnerability pipeline data.","responsibility_allocation":{"eks":"customer-platform","self-managed":"customer-platform","source":"provisional","notes":"Provisional allocation for the detector evidence only. No provider inheritance or whole-control ownership is established until an authorised CSCM and the engagement boundary are reviewed."},"mapping_source":{"repository":"https://github.com/Latticework-Systems/ism-kubernetes-controls","revision":"07b348a2952bf2d0e78d9e739f367cb0919ab888","url":"https://github.com/Latticework-Systems/ism-kubernetes-controls/blob/07b348a2952bf2d0e78d9e739f367cb0919ab888/mapping/ism-mapping.yaml","sha256":"f823681fd71e40e589aae714ef2215dd8dc33722a1ec70b81ded5b2322937470"}}},{"id":"ISM-1877","url":"https://latticeworksystems.com.au/ism/ism-1877/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1877.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1877.md","official":{"statement":"Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system management","System maintenance","Mitigating known vulnerabilities"]},"latticework_interpretation":{"title":"Track support and patch evidence for every operating-system layer","implementation_steps":["Inventory container base images, node operating systems and internet-facing network devices separately. Assign owners and record vendor support dates.","Use the mapped policies to review declared base-image metadata. Drive patch decisions from actual vendor advisories and vulnerability findings, then rebuild, deploy and verify the affected components within the applicable control deadline."],"evidence_to_retain":["Keep the component inventory, vendor advisory and release date, severity/exploit assessment, patch decision and deployment verification timestamps.","Retain image labels and PolicyReports as supporting metadata. Add node and device patch records; labels do not verify installed patches or support state."],"responsibility_boundary":"Platform team: node and device lifecycle. Workload/pipeline team: supported base images and rebuilt artefacts. Organisation: patch policy, deadlines and approved exceptions.","checks":[{"engine":"kyverno","name":"ism-patch-operating-systems-block-eol-base-images"},{"engine":"kyverno","name":"ism-patch-operating-systems-require-base-image-label"}],"coverage":"partial","limitations":"Container base-image support metadata is supporting evidence only; criticality, exploit status and node or network-device patch timing remain external.","responsibility_allocation":{"eks":"customer-platform","self-managed":"customer-platform","source":"provisional","notes":"Provisional allocation for the detector evidence only. No provider inheritance or whole-control ownership is established until an authorised CSCM and the engagement boundary are reviewed."},"mapping_source":{"repository":"https://github.com/Latticework-Systems/ism-kubernetes-controls","revision":"07b348a2952bf2d0e78d9e739f367cb0919ab888","url":"https://github.com/Latticework-Systems/ism-kubernetes-controls/blob/07b348a2952bf2d0e78d9e739f367cb0919ab888/mapping/ism-mapping.yaml","sha256":"f823681fd71e40e589aae714ef2215dd8dc33722a1ec70b81ded5b2322937470"}}},{"id":"ISM-1878","url":"https://latticeworksystems.com.au/ism/ism-1878/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1878.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1878.md","official":{"statement":"Patches, updates or other vendor mitigations for vulnerabilities in operating systems of IT equipment other than workstations, servers and network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system management","System maintenance","Mitigating known vulnerabilities"]},"latticework_interpretation":null},{"id":"ISM-1879","url":"https://latticeworksystems.com.au/ism/ism-1879/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1879.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1879.md","official":{"statement":"Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system management","System maintenance","Mitigating known vulnerabilities"]},"latticework_interpretation":null},{"id":"ISM-1880","url":"https://latticeworksystems.com.au/ism/ism-1880/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1880.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1880.md","official":{"statement":"Cyber security incidents that involve customer data are reported to customers and the public in a timely manner after they occur or are discovered.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security incidents","Managing cyber security incidents","Reporting cyber security incidents to customers and the public"]},"latticework_interpretation":null},{"id":"ISM-1881","url":"https://latticeworksystems.com.au/ism/ism-1881/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1881.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1881.md","official":{"statement":"Cyber security incidents that do not involve customer data are reported to customers and the public in a timely manner after they occur or are discovered.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security incidents","Managing cyber security incidents","Reporting cyber security incidents to customers and the public"]},"latticework_interpretation":null},{"id":"ISM-1882","url":"https://latticeworksystems.com.au/ism/ism-1882/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1882.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1882.md","official":{"statement":"Operating systems, applications, IT equipment, OT equipment and services are procured from suppliers that have demonstrated a commitment to transparency for their products and services.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Cyber supply chain risk management","Cyber supply chain risk management activities"]},"latticework_interpretation":null},{"id":"ISM-1883","url":"https://latticeworksystems.com.au/ism/ism-1883/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1883.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1883.md","official":{"statement":"Privileged user accounts explicitly authorised to access online services are strictly limited to only what is required for users to undertake their duties or functions.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system access","Identity and access management","Privileged access to systems"]},"latticework_interpretation":{"title":"Review privileged human access against duties","implementation_steps":["Inventory privileged human identities and the online services they can access. Have service owners approve the minimum permissions needed for each role.","Review cluster-admin bindings and wildcard RBAC grants, test reduced permissions, and remove unnecessary access through a reviewed change. Include external identity-provider and application roles."],"evidence_to_retain":["Keep dated identity and RBAC exports, role-to-duty approvals, removal records and scan/admission results.","Link technical permission findings to human account ownership, authorisation and lifecycle reviews. ServiceAccount counts alone cannot establish this control."],"responsibility_boundary":"Platform team: Kubernetes RBAC and identity integration. Service owners: duties and permissions. Organisation: privileged-access authorisation, human account lifecycle and review cadence.","checks":[{"engine":"kubescape","name":"ism-no-cluster-admin-binding"},{"engine":"kubescape","name":"ism-no-wildcard-permissions"},{"engine":"kyverno","name":"ism-privileged-access-block-cluster-admin-binding"}],"coverage":"partial","limitations":"RBAC findings show Kubernetes permission breadth and cluster-admin assignments; they do not establish which privileged human accounts require online-service access, authorisation workflow, human account lifecycle or external systems.","responsibility_allocation":{"eks":"customer-platform","self-managed":"customer-platform","source":"provisional","notes":"Provisional allocation for the detector evidence only. No provider inheritance or whole-control ownership is established until an authorised CSCM and the engagement boundary are reviewed."},"mapping_source":{"repository":"https://github.com/Latticework-Systems/ism-kubernetes-controls","revision":"07b348a2952bf2d0e78d9e739f367cb0919ab888","url":"https://github.com/Latticework-Systems/ism-kubernetes-controls/blob/07b348a2952bf2d0e78d9e739f367cb0919ab888/mapping/ism-mapping.yaml","sha256":"f823681fd71e40e589aae714ef2215dd8dc33722a1ec70b81ded5b2322937470"}}},{"id":"ISM-1884","url":"https://latticeworksystems.com.au/ism/ism-1884/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1884.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1884.md","official":{"statement":"Emanation security doctrine produced by ASD for the management of emanation security matters is complied with.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-23","applicability":["OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Emanation security","Emanation security doctrine"]},"latticework_interpretation":null},{"id":"ISM-1885","url":"https://latticeworksystems.com.au/ism/ism-1885/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1885.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1885.md","official":{"statement":"Recommended actions contained within emanation security mitigation advice issued for systems are implemented by system owners.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Mar-26","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications infrastructure","Emanation security","Emanation security risk assessments"]},"latticework_interpretation":null},{"id":"ISM-1886","url":"https://latticeworksystems.com.au/ism/ism-1886/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1886.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1886.md","official":{"statement":"Mobile devices are configured to operate in a supervised (or equivalent) mode.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device management","Maintaining mobile device security"]},"latticework_interpretation":null},{"id":"ISM-1887","url":"https://latticeworksystems.com.au/ism/ism-1887/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1887.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1887.md","official":{"statement":"Mobile devices are configured with remote locate and wipe functionality.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device management","Maintaining mobile device security"]},"latticework_interpretation":null},{"id":"ISM-1888","url":"https://latticeworksystems.com.au/ism/ism-1888/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1888.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1888.md","official":{"statement":"Mobile devices are configured with secure password-based lock screens.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Mar-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device management","Maintaining mobile device security"]},"latticework_interpretation":null},{"id":"ISM-1889","url":"https://latticeworksystems.com.au/ism/ism-1889/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1889.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1889.md","official":{"statement":"Command line process creation events are centrally logged.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for system hardening","Operating system hardening","Command Shell"]},"latticework_interpretation":null},{"id":"ISM-1890","url":"https://latticeworksystems.com.au/ism/ism-1890/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1890.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1890.md","official":{"statement":"Microsoft Office macros are checked to ensure they are free of malicious code before being digitally signed or placed within Trusted Locations.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system hardening","User application hardening","Office productivity suites"]},"latticework_interpretation":null},{"id":"ISM-1891","url":"https://latticeworksystems.com.au/ism/ism-1891/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1891.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1891.md","official":{"statement":"Microsoft Office macros digitally signed by signatures other than V3 signatures cannot be enabled via the Message Bar or Backstage View.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system hardening","User application hardening","Office productivity suites"]},"latticework_interpretation":null},{"id":"ISM-1892","url":"https://latticeworksystems.com.au/ism/ism-1892/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1892.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1892.md","official":{"statement":"Multi-factor authentication is used to authenticate human users to their organisation’s online customer services that process, store or communicate their organisation’s sensitive customer data.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system access","Identity and access management","Multi-factor authentication"]},"latticework_interpretation":null},{"id":"ISM-1893","url":"https://latticeworksystems.com.au/ism/ism-1893/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1893.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1893.md","official":{"statement":"Multi-factor authentication is used to authenticate human users to third-party online customer services that process, store or communicate their organisation’s sensitive customer data.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system access","Identity and access management","Multi-factor authentication"]},"latticework_interpretation":null},{"id":"ISM-1894","url":"https://latticeworksystems.com.au/ism/ism-1894/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1894.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1894.md","official":{"statement":"Multi-factor authentication used for authenticating human users of data repositories is phishing-resistant.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system access","Identity and access management","Multi-factor authentication"]},"latticework_interpretation":null},{"id":"ISM-1895","url":"https://latticeworksystems.com.au/ism/ism-1895/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1895.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1895.md","official":{"statement":"Successful and unsuccessful single-factor authentication events are centrally logged.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Single-factor authentication"]},"latticework_interpretation":null},{"id":"ISM-1896","url":"https://latticeworksystems.com.au/ism/ism-1896/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1896.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1896.md","official":{"statement":"Memory integrity functionality is enabled.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system hardening","Operating system hardening","Hardening operating system configurations"]},"latticework_interpretation":null},{"id":"ISM-1897","url":"https://latticeworksystems.com.au/ism/ism-1897/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1897.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1897.md","official":{"statement":"Remote Credential Guard functionality is enabled.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system access","Credential management","Protecting credentials"]},"latticework_interpretation":null},{"id":"ISM-1898","url":"https://latticeworksystems.com.au/ism/ism-1898/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1898.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1898.md","official":{"statement":"Secure Admin Workstations are used in the performance of administrative activities.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system management","System administration","Separate privileged operating environments"]},"latticework_interpretation":null},{"id":"ISM-1899","url":"https://latticeworksystems.com.au/ism/ism-1899/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1899.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1899.md","official":{"statement":"Network devices that do not belong to administrative infrastructure cannot initiate connections with administrative infrastructure.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system management","System administration","Administrative infrastructure"]},"latticework_interpretation":null},{"id":"ISM-1900","url":"https://latticeworksystems.com.au/ism/ism-1900/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1900.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1900.md","official":{"statement":"A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in firmware.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for security assurance","Security assessments","Vulnerability scanning"]},"latticework_interpretation":null},{"id":"ISM-1901","url":"https://latticeworksystems.com.au/ism/ism-1901/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1901.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1901.md","official":{"statement":"Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system management","System maintenance","Mitigating known vulnerabilities"]},"latticework_interpretation":null},{"id":"ISM-1902","url":"https://latticeworksystems.com.au/ism/ism-1902/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1902.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1902.md","official":{"statement":"Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system management","System maintenance","Mitigating known vulnerabilities"]},"latticework_interpretation":null},{"id":"ISM-1903","url":"https://latticeworksystems.com.au/ism/ism-1903/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1903.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1903.md","official":{"statement":"Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system management","System maintenance","Mitigating known vulnerabilities"]},"latticework_interpretation":null},{"id":"ISM-1904","url":"https://latticeworksystems.com.au/ism/ism-1904/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1904.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1904.md","official":{"statement":"Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for system management","System maintenance","Mitigating known vulnerabilities"]},"latticework_interpretation":null},{"id":"ISM-1905","url":"https://latticeworksystems.com.au/ism/ism-1905/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1905.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1905.md","official":{"statement":"Online services that are no longer supported by vendors are removed.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML1","ML2","ML3"],"section_path":["Guidelines for system management","System maintenance","Cessation of support"]},"latticework_interpretation":null},{"id":"ISM-1906","url":"https://latticeworksystems.com.au/ism/ism-1906/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1906.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1906.md","official":{"statement":"Event logs from internet-facing servers are analysed in a timely manner to detect cyber security events.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML2","ML3"],"section_path":["Guidelines for security assurance","Security monitoring","Event log monitoring"]},"latticework_interpretation":null},{"id":"ISM-1907","url":"https://latticeworksystems.com.au/ism/ism-1907/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1907.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1907.md","official":{"statement":"Event logs from non-internet-facing servers are analysed in a timely manner to detect cyber security events.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":["ML3"],"section_path":["Guidelines for security assurance","Security monitoring","Event log monitoring"]},"latticework_interpretation":null},{"id":"ISM-1908","url":"https://latticeworksystems.com.au/ism/ism-1908/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1908.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1908.md","official":{"statement":"Vulnerabilities identified in software are publicly disclosed in a responsible and timely manner, including with Common Weakness Enumeration and Common Platform Enumeration information.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Reporting and resolving vulnerabilities"]},"latticework_interpretation":null},{"id":"ISM-1909","url":"https://latticeworksystems.com.au/ism/ism-1909/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1909.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1909.md","official":{"statement":"In resolving vulnerabilities, root cause analysis is performed and, to the greatest extent possible, entire vulnerability classes are remediated.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Reporting and resolving vulnerabilities"]},"latticework_interpretation":null},{"id":"ISM-1910","url":"https://latticeworksystems.com.au/ism/ism-1910/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1910.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1910.md","official":{"statement":"Network API calls that facilitate modification of data, or access to data not authorised for release into the public domain, and are accessible over the internet, are centrally logged.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Mar-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Network application programming interfaces"]},"latticework_interpretation":null},{"id":"ISM-1911","url":"https://latticeworksystems.com.au/ism/ism-1911/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1911.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1911.md","official":{"statement":"Security-relevant usage, error messages and crashes for software are centrally logged.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Software event logging"]},"latticework_interpretation":null},{"id":"ISM-1912","url":"https://latticeworksystems.com.au/ism/ism-1912/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1912.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1912.md","official":{"statement":"Network documentation includes device settings for all critical servers, high-value servers, network devices and network security appliances.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-23","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Network documentation"]},"latticework_interpretation":null},{"id":"ISM-1913","url":"https://latticeworksystems.com.au/ism/ism-1913/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1913.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1913.md","official":{"statement":"Approved configurations for IT equipment are developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for information technology equipment","IT equipment usage","Hardening IT equipment configurations"]},"latticework_interpretation":null},{"id":"ISM-1914","url":"https://latticeworksystems.com.au/ism/ism-1914/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1914.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1914.md","official":{"statement":"Approved configurations for operating systems are developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Hardening operating system configurations"]},"latticework_interpretation":null},{"id":"ISM-1915","url":"https://latticeworksystems.com.au/ism/ism-1915/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1915.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1915.md","official":{"statement":"Approved configurations for user applications are developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","User application hardening","Hardening user application configurations"]},"latticework_interpretation":null},{"id":"ISM-1916","url":"https://latticeworksystems.com.au/ism/ism-1916/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1916.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1916.md","official":{"statement":"Approved configurations for server applications are developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Hardening server application configurations"]},"latticework_interpretation":null},{"id":"ISM-1917","url":"https://latticeworksystems.com.au/ism/ism-1917/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1917.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1917.md","official":{"statement":"The development and procurement of new cryptographic equipment, applications and libraries ensures support for the use of ML-DSA-87, ML-KEM-1024, SHA-384, SHA-512 and AES-256 by no later than 2030.","statement_format":"OSCAL markup-multiline","revision":"3","updated":"Sep-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic algorithms","Transitioning to post-quantum cryptography"]},"latticework_interpretation":null},{"id":"ISM-1918","url":"https://latticeworksystems.com.au/ism/ism-1918/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1918.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1918.md","official":{"statement":"The CISO regularly reports directly to their organisation’s audit, risk and compliance committee (or equivalent) on cyber security matters.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","Chief information security officer","Reporting on cyber security"]},"latticework_interpretation":null},{"id":"ISM-1919","url":"https://latticeworksystems.com.au/ism/ism-1919/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1919.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1919.md","official":{"statement":"When multi-factor authentication is used to authenticate human users or customers to online services or online customer services, all other authentication protocols that do not support multi-factor authentication are disabled.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Multi-factor authentication"]},"latticework_interpretation":null},{"id":"ISM-1920","url":"https://latticeworksystems.com.au/ism/ism-1920/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1920.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1920.md","official":{"statement":"When multi-factor authentication is used to authenticate human users to online services, online customer services, systems or data repositories – that process, store or communicate their organisation’s sensitive data or sensitive customer data – human users are prevented from self-enrolling into multi-factor authentication from untrustworthy devices.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Multi-factor authentication"]},"latticework_interpretation":null},{"id":"ISM-1921","url":"https://latticeworksystems.com.au/ism/ism-1921/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1921.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1921.md","official":{"statement":"The likelihood of system compromise is frequently assessed when working exploits exist for unmitigated vulnerabilities.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for security assurance","Security assessments","Vulnerability scanning"]},"latticework_interpretation":null},{"id":"ISM-1922","url":"https://latticeworksystems.com.au/ism/ism-1922/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1922.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1922.md","official":{"statement":"The OWASP Mobile Application Security Verification Standard is used in the development of mobile applications.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Mobile application development","Secure mobile application development"]},"latticework_interpretation":null},{"id":"ISM-1924","url":"https://latticeworksystems.com.au/ism/ism-1924/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1924.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1924.md","official":{"statement":"Generative AI applications evaluate user prompts to detect and mitigate adversarial inputs or suffixes designed to elicit unintended behaviour or assist in the generation of sensitive or harmful content.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Artificial intelligence application development","Prompt injection"]},"latticework_interpretation":null},{"id":"ISM-1926","url":"https://latticeworksystems.com.au/ism/ism-1926/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1926.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1926.md","official":{"statement":"Microsoft AD DS domain controllers, Microsoft AD CS servers, Microsoft AD FS servers and Microsoft Entra Connect servers are only used for their designed role and no other applications or services are installed, unless they are security related.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory services"]},"latticework_interpretation":null},{"id":"ISM-1927","url":"https://latticeworksystems.com.au/ism/ism-1927/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1927.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1927.md","official":{"statement":"Access to Microsoft AD DS domain controllers, Microsoft AD CS servers, Microsoft AD FS servers and Microsoft Entra Connect servers is limited to privileged users that require access.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory services"]},"latticework_interpretation":null},{"id":"ISM-1928","url":"https://latticeworksystems.com.au/ism/ism-1928/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1928.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1928.md","official":{"statement":"Backups of Microsoft AD DS domain controllers, Microsoft AD CS servers, Microsoft AD FS servers and Microsoft Entra Connect servers are encrypted using ASD-approved cryptography, stored securely and only accessible to backup administrator accounts.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory services"]},"latticework_interpretation":null},{"id":"ISM-1929","url":"https://latticeworksystems.com.au/ism/ism-1929/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1929.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1929.md","official":{"statement":"Lightweight Directory Access Protocol signing is enabled on Microsoft AD DS domain controllers.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services"]},"latticework_interpretation":null},{"id":"ISM-1930","url":"https://latticeworksystems.com.au/ism/ism-1930/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1930.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1930.md","official":{"statement":"Passwords are prevented from being stored in Group Policy Preferences.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services"]},"latticework_interpretation":null},{"id":"ISM-1931","url":"https://latticeworksystems.com.au/ism/ism-1931/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1931.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1931.md","official":{"statement":"SID Filtering is enabled for domain and forest trusts.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services"]},"latticework_interpretation":null},{"id":"ISM-1932","url":"https://latticeworksystems.com.au/ism/ism-1932/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1932.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1932.md","official":{"statement":"The number of service accounts configured with an SPN is minimised.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services account hardening"]},"latticework_interpretation":null},{"id":"ISM-1933","url":"https://latticeworksystems.com.au/ism/ism-1933/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1933.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1933.md","official":{"statement":"Service accounts configured with an SPN do not have DCSync permissions.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services account hardening"]},"latticework_interpretation":null},{"id":"ISM-1934","url":"https://latticeworksystems.com.au/ism/ism-1934/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1934.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1934.md","official":{"statement":"User accounts with DCSync permissions are reviewed at least every six months, and those without an ongoing requirement for the permissions have them removed.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services account hardening"]},"latticework_interpretation":null},{"id":"ISM-1935","url":"https://latticeworksystems.com.au/ism/ism-1935/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1935.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1935.md","official":{"statement":"Computer accounts are not configured for unconstrained delegation.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services account hardening"]},"latticework_interpretation":null},{"id":"ISM-1936","url":"https://latticeworksystems.com.au/ism/ism-1936/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1936.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1936.md","official":{"statement":"The sIDHistory attribute for user accounts is not used.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services account hardening"]},"latticework_interpretation":null},{"id":"ISM-1937","url":"https://latticeworksystems.com.au/ism/ism-1937/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1937.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1937.md","official":{"statement":"User accounts are checked at least weekly for the presence of the sIDHistory attribute.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services account hardening"]},"latticework_interpretation":null},{"id":"ISM-1938","url":"https://latticeworksystems.com.au/ism/ism-1938/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1938.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1938.md","official":{"statement":"The Domain Computers security group does not have write or modify permissions to any Microsoft Active Directory objects.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services account hardening"]},"latticework_interpretation":null},{"id":"ISM-1939","url":"https://latticeworksystems.com.au/ism/ism-1939/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1939.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1939.md","official":{"statement":"The number of user accounts that are members of the Domain Admins, Enterprise Admins or other highly privileged security groups is minimised.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services security group memberships"]},"latticework_interpretation":null},{"id":"ISM-1940","url":"https://latticeworksystems.com.au/ism/ism-1940/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1940.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1940.md","official":{"statement":"Service accounts are not members of the Domain Admins, Enterprise Admins or other highly privileged security groups.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services security group memberships"]},"latticework_interpretation":null},{"id":"ISM-1941","url":"https://latticeworksystems.com.au/ism/ism-1941/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1941.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1941.md","official":{"statement":"Computer accounts are not members of the Domain Admins, Enterprise Admins or other highly privileged security groups.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services security group memberships"]},"latticework_interpretation":null},{"id":"ISM-1942","url":"https://latticeworksystems.com.au/ism/ism-1942/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1942.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1942.md","official":{"statement":"The Domain Computers security group is not a member of any privileged or highly privileged security groups.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services security group memberships"]},"latticework_interpretation":null},{"id":"ISM-1943","url":"https://latticeworksystems.com.au/ism/ism-1943/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1943.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1943.md","official":{"statement":"Strong mapping between certificates and users is enforced.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Certificate Services"]},"latticework_interpretation":null},{"id":"ISM-1944","url":"https://latticeworksystems.com.au/ism/ism-1944/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1944.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1944.md","official":{"statement":"The EDITF_ATTRIBUTESUBJECTALTNAME2 flag is removed from Microsoft AD CS certification authority configurations.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Certificate Services"]},"latticework_interpretation":null},{"id":"ISM-1945","url":"https://latticeworksystems.com.au/ism/ism-1945/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1945.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1945.md","official":{"statement":"The CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag is removed from certificate templates.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Certificate Services"]},"latticework_interpretation":null},{"id":"ISM-1946","url":"https://latticeworksystems.com.au/ism/ism-1946/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1946.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1946.md","official":{"statement":"Unprivileged user accounts do not have write access to certificate templates.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Certificate Services"]},"latticework_interpretation":null},{"id":"ISM-1947","url":"https://latticeworksystems.com.au/ism/ism-1947/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1947.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1947.md","official":{"statement":"Extended Key Usages that enable user authentication are removed.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Certificate Services"]},"latticework_interpretation":null},{"id":"ISM-1948","url":"https://latticeworksystems.com.au/ism/ism-1948/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1948.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1948.md","official":{"statement":"Certificate manager approval is required for certificate templates that allow a Subject Alternative Name to be supplied.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Certificate Services"]},"latticework_interpretation":null},{"id":"ISM-1949","url":"https://latticeworksystems.com.au/ism/ism-1949/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1949.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1949.md","official":{"statement":"Microsoft AD FS servers are administered using a dedicated service account that is not used to administer other systems.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Federation Services"]},"latticework_interpretation":null},{"id":"ISM-1950","url":"https://latticeworksystems.com.au/ism/ism-1950/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1950.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1950.md","official":{"statement":"Soft matching between Microsoft AD DS and Microsoft Entra ID is disabled following initial synchronisation activities.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Entra Connect"]},"latticework_interpretation":null},{"id":"ISM-1951","url":"https://latticeworksystems.com.au/ism/ism-1951/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1951.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1951.md","official":{"statement":"Hard match takeover is disabled for Microsoft Entra Connect servers.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Entra Connect"]},"latticework_interpretation":null},{"id":"ISM-1952","url":"https://latticeworksystems.com.au/ism/ism-1952/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1952.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1952.md","official":{"statement":"Privileged user accounts are not synchronised between Microsoft AD DS and Microsoft Entra ID.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Entra Connect"]},"latticework_interpretation":null},{"id":"ISM-1953","url":"https://latticeworksystems.com.au/ism/ism-1953/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1953.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1953.md","official":{"statement":"Credentials for the built-in Administrator account in each domain are long, unique, unpredictable and managed.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Setting credentials for built-in Administrator accounts, break glass accounts, local administrator accounts and service accounts"]},"latticework_interpretation":null},{"id":"ISM-1954","url":"https://latticeworksystems.com.au/ism/ism-1954/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1954.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1954.md","official":{"statement":"Credentials for built-in Administrator accounts, break glass accounts, local administrator accounts and service accounts are randomly generated.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Setting credentials for built-in Administrator accounts, break glass accounts, local administrator accounts and service accounts"]},"latticework_interpretation":null},{"id":"ISM-1955","url":"https://latticeworksystems.com.au/ism/ism-1955/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1955.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1955.md","official":{"statement":"Credentials for computer accounts are changed if they are compromised, they are suspected of being compromised or they have not been changed in the past 30 days.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Changing credentials"]},"latticework_interpretation":null},{"id":"ISM-1956","url":"https://latticeworksystems.com.au/ism/ism-1956/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1956.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1956.md","official":{"statement":"Microsoft AD FS token-signing and encryption certificates are changed twice in quick succession if they are compromised, they are suspected of being compromised or they have not been changed in the past 12 months.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Changing credentials"]},"latticework_interpretation":null},{"id":"ISM-1957","url":"https://latticeworksystems.com.au/ism/ism-1957/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1957.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1957.md","official":{"statement":"Private keys for Microsoft AD CS certification authority servers are protected by a hardware security module.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Protecting credentials"]},"latticework_interpretation":null},{"id":"ISM-1958","url":"https://latticeworksystems.com.au/ism/ism-1958/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1958.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1958.md","official":{"statement":"User accounts with DCSync permissions cannot be used to log on to unprivileged operating environments.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system management","System administration","Separate privileged operating environments"]},"latticework_interpretation":null},{"id":"ISM-1959","url":"https://latticeworksystems.com.au/ism/ism-1959/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1959.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1959.md","official":{"statement":"To the extent possible, event logs are captured and stored in a consistent and structured format.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for security assurance","Security monitoring","Event log details"]},"latticework_interpretation":null},{"id":"ISM-1960","url":"https://latticeworksystems.com.au/ism/ism-1960/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1960.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1960.md","official":{"statement":"Event logs from internet-facing network devices are analysed in a timely manner to detect cyber security events.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for security assurance","Security monitoring","Event log monitoring"]},"latticework_interpretation":null},{"id":"ISM-1961","url":"https://latticeworksystems.com.au/ism/ism-1961/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1961.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1961.md","official":{"statement":"Event logs from non-internet-facing network devices are analysed in a timely manner to detect cyber security events.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for security assurance","Security monitoring","Event log monitoring"]},"latticework_interpretation":null},{"id":"ISM-1962","url":"https://latticeworksystems.com.au/ism/ism-1962/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1962.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1962.md","official":{"statement":"SMB version 1 is not used on networks.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Using the Server Message Block protocol"]},"latticework_interpretation":null},{"id":"ISM-1963","url":"https://latticeworksystems.com.au/ism/ism-1963/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1963.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1963.md","official":{"statement":"Security-relevant events for internet-facing network devices are centrally logged.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Network device event logging"]},"latticework_interpretation":null},{"id":"ISM-1964","url":"https://latticeworksystems.com.au/ism/ism-1964/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1964.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1964.md","official":{"statement":"Security-relevant events for non-internet-facing network devices are centrally logged.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Network device event logging"]},"latticework_interpretation":null},{"id":"ISM-1965","url":"https://latticeworksystems.com.au/ism/ism-1965/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1965.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1965.md","official":{"statement":"Files imported or exported via gateways or CDSs undergo content checking.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Content filtering","Content checking"]},"latticework_interpretation":null},{"id":"ISM-1966","url":"https://latticeworksystems.com.au/ism/ism-1966/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1966.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1966.md","official":{"statement":"The CISO develops, implements, maintains and regularly verifies a register of systems used by their organisation.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","Chief information security officer","Overseeing the cyber security program"]},"latticework_interpretation":null},{"id":"ISM-1967","url":"https://latticeworksystems.com.au/ism/ism-1967/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1967.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1967.md","official":{"statement":"System owners, in consultation with each system’s authorising officer, ensure security controls for each TOP SECRET system and its operating environment, including each sensitive compartmented information system and its operating environment, undergo a security control assessment by ASD assessors (or their delegates) to determine if they have been implemented correctly and are operating as intended.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-26","applicability":["TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","System owners","Protecting systems and their resources"]},"latticework_interpretation":null},{"id":"ISM-1968","url":"https://latticeworksystems.com.au/ism/ism-1968/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1968.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1968.md","official":{"statement":"System owners obtain an authorisation to operate for each TOP SECRET system, including for each sensitive compartmented information system, from Director-General ASD (or their delegate).","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Mar-26","applicability":["TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","System owners","Protecting systems and their resources"]},"latticework_interpretation":null},{"id":"ISM-1969","url":"https://latticeworksystems.com.au/ism/ism-1969/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1969.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1969.md","official":{"statement":"Malicious code, when stored or communicated, is treated beforehand to prevent accidental execution.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security incidents","Responding to cyber security incidents","Handling and containing malicious code infections"]},"latticework_interpretation":null},{"id":"ISM-1970","url":"https://latticeworksystems.com.au/ism/ism-1970/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1970.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1970.md","official":{"statement":"Malicious code processing for cyber security incident response or research purposes is conducted in a dedicated analysis environment segregated from other systems.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security incidents","Responding to cyber security incidents","Handling and containing malicious code infections"]},"latticework_interpretation":null},{"id":"ISM-1971","url":"https://latticeworksystems.com.au/ism/ism-1971/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1971.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1971.md","official":{"statement":"Managed service providers and their TOP SECRET managed services, including sensitive compartmented information managed services, undergo a security control assessment by ASD assessors (or their delegates), using the latest release of the ISM available prior to the beginning of the security control assessment (or a subsequent release), at least every 24 months.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-26","applicability":["TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Managed services and cloud services","Assessment of managed service providers"]},"latticework_interpretation":null},{"id":"ISM-1972","url":"https://latticeworksystems.com.au/ism/ism-1972/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1972.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1972.md","official":{"statement":"Outsourced cloud service providers and their TOP SECRET cloud services, including sensitive compartmented information cloud services, undergo a security control assessment by ASD assessors (or their delegates), using the latest release of the ISM available prior to the beginning of the security control assessment (or a subsequent release), at least every 24 months.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-26","applicability":["TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Managed services and cloud services","Assessment of outsourced cloud service providers"]},"latticework_interpretation":null},{"id":"ISM-1973","url":"https://latticeworksystems.com.au/ism/ism-1973/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1973.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1973.md","official":{"statement":"Non-classified systems are secured in suitably secure facilities.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-24","applicability":["NC"],"essential_eight_applicability":[],"section_path":["Guidelines for physical security","Facilities and systems","Physical access to systems"]},"latticework_interpretation":null},{"id":"ISM-1974","url":"https://latticeworksystems.com.au/ism/ism-1974/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1974.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1974.md","official":{"statement":"Non-classified servers, network devices and cryptographic equipment are secured in suitably secure server rooms or communications rooms.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-24","applicability":["NC"],"essential_eight_applicability":[],"section_path":["Guidelines for physical security","Facilities and systems","Physical access to servers, network devices and cryptographic equipment"]},"latticework_interpretation":null},{"id":"ISM-1975","url":"https://latticeworksystems.com.au/ism/ism-1975/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1975.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1975.md","official":{"statement":"Non-classified servers, network devices and cryptographic equipment are secured in suitably secure security containers.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-24","applicability":["NC"],"essential_eight_applicability":[],"section_path":["Guidelines for physical security","Facilities and systems","Physical access to servers, network devices and cryptographic equipment"]},"latticework_interpretation":null},{"id":"ISM-1976","url":"https://latticeworksystems.com.au/ism/ism-1976/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1976.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1976.md","official":{"statement":"Security-relevant events for Apple macOS operating systems are centrally logged.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Operating system event logging"]},"latticework_interpretation":null},{"id":"ISM-1977","url":"https://latticeworksystems.com.au/ism/ism-1977/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1977.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1977.md","official":{"statement":"Security-relevant events for Linux operating systems are centrally logged.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Operating system event logging"]},"latticework_interpretation":null},{"id":"ISM-1978","url":"https://latticeworksystems.com.au/ism/ism-1978/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1978.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1978.md","official":{"statement":"Security-relevant events for server applications on internet-facing servers are centrally logged.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Server application event logging"]},"latticework_interpretation":null},{"id":"ISM-1979","url":"https://latticeworksystems.com.au/ism/ism-1979/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1979.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1979.md","official":{"statement":"Security-relevant events for server applications on non-internet-facing servers are centrally logged.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Server application event logging"]},"latticework_interpretation":null},{"id":"ISM-1980","url":"https://latticeworksystems.com.au/ism/ism-1980/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1980.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1980.md","official":{"statement":"Credential hint functionality is not used for systems.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Protecting credentials"]},"latticework_interpretation":null},{"id":"ISM-1981","url":"https://latticeworksystems.com.au/ism/ism-1981/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1981.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1981.md","official":{"statement":"Non-internet-facing network devices that are no longer supported by vendors are replaced.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system management","System maintenance","Cessation of support"]},"latticework_interpretation":null},{"id":"ISM-1982","url":"https://latticeworksystems.com.au/ism/ism-1982/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1982.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1982.md","official":{"statement":"Networked IT equipment that is no longer supported by vendors is replaced.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system management","System maintenance","Cessation of support"]},"latticework_interpretation":null},{"id":"ISM-1983","url":"https://latticeworksystems.com.au/ism/ism-1983/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1983.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1983.md","official":{"statement":"Event logs sent to a centralised event logging facility are sent as soon as possible after they occur.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for security assurance","Security monitoring","Centralised event logging facility"]},"latticework_interpretation":null},{"id":"ISM-1984","url":"https://latticeworksystems.com.au/ism/ism-1984/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1984.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1984.md","official":{"statement":"Event logs sent to a centralised event logging facility are encrypted in transit using Australian Signals Directorate (ASD)-approved cryptography.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for security assurance","Security monitoring","Centralised event logging facility"]},"latticework_interpretation":null},{"id":"ISM-1985","url":"https://latticeworksystems.com.au/ism/ism-1985/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1985.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1985.md","official":{"statement":"Event logs are protected from unauthorised access.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for security assurance","Security monitoring","Centralised event logging facility"]},"latticework_interpretation":null},{"id":"ISM-1986","url":"https://latticeworksystems.com.au/ism/ism-1986/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1986.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1986.md","official":{"statement":"Event logs from critical servers are analysed in a timely manner to detect cyber security events.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for security assurance","Security monitoring","Event log monitoring"]},"latticework_interpretation":null},{"id":"ISM-1987","url":"https://latticeworksystems.com.au/ism/ism-1987/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1987.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1987.md","official":{"statement":"Event logs from security products are analysed in a timely manner to detect cyber security events.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for security assurance","Security monitoring","Event log monitoring"]},"latticework_interpretation":null},{"id":"ISM-1988","url":"https://latticeworksystems.com.au/ism/ism-1988/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1988.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1988.md","official":{"statement":"Event logs are retained in a searchable manner for at least 12 months.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for security assurance","Security monitoring","Event log retention"]},"latticework_interpretation":null},{"id":"ISM-1989","url":"https://latticeworksystems.com.au/ism/ism-1989/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1989.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1989.md","official":{"statement":"Event logs are retained as per minimum retention requirements for various classes of records as set out by the National Archives of Australia’s Administrative Functions Disposal Authority Express (AFDA Express) Version 2 publication.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for security assurance","Security monitoring","Event log retention"]},"latticework_interpretation":null},{"id":"ISM-1990","url":"https://latticeworksystems.com.au/ism/ism-1990/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1990.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1990.md","official":{"statement":"When using ML-DSA and ML-KEM, as per FIPS 204 and FIPS 203 respectively, adherence to pre-requisite FIPS 140-3 validation is preferred.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Mar-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic algorithms","Using post-quantum cryptographic algorithms"]},"latticework_interpretation":null},{"id":"ISM-1991","url":"https://latticeworksystems.com.au/ism/ism-1991/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1991.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1991.md","official":{"statement":"When using ML-DSA for digital signatures, ML-DSA-65 or ML-DSA-87 is used, preferably ML-DSA-87.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic algorithms","Using the Module-Lattice-Based Digital Signature Algorithm"]},"latticework_interpretation":null},{"id":"ISM-1992","url":"https://latticeworksystems.com.au/ism/ism-1992/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1992.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1992.md","official":{"statement":"When using ML-DSA for digital signatures, the hedged variant is used whenever possible.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic algorithms","Using the Module-Lattice-Based Digital Signature Algorithm"]},"latticework_interpretation":null},{"id":"ISM-1993","url":"https://latticeworksystems.com.au/ism/ism-1993/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1993.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1993.md","official":{"statement":"Pre-hashed variants of ML-DSA-65 and ML-DSA-87 are only used when the performance of default variants is unacceptable.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic algorithms","Using the Module-Lattice-Based Digital Signature Algorithm"]},"latticework_interpretation":null},{"id":"ISM-1994","url":"https://latticeworksystems.com.au/ism/ism-1994/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1994.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1994.md","official":{"statement":"When the pre-hashed variants of ML-DSA-65 and ML-DSA-87 are used, at least SHA-384 and SHA-512 respectively are used for pre-hashing.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic algorithms","Using the Module-Lattice-Based Digital Signature Algorithm"]},"latticework_interpretation":null},{"id":"ISM-1995","url":"https://latticeworksystems.com.au/ism/ism-1995/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1995.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1995.md","official":{"statement":"When using ML-KEM for encapsulating encryption session keys (and similar keys), ML-KEM-768 or ML-KEM-1024 is used, preferably ML-KEM-1024.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic algorithms","Using the Module-Lattice-Based Key Encapsulation Mechanism"]},"latticework_interpretation":null},{"id":"ISM-1996","url":"https://latticeworksystems.com.au/ism/ism-1996/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1996.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1996.md","official":{"statement":"When a post-quantum traditional hybrid scheme is used, either the post-quantum cryptographic algorithm, the traditional cryptographic algorithm or both are AACAs.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-24","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic algorithms","Post-quantum traditional hybrid schemes"]},"latticework_interpretation":null},{"id":"ISM-1997","url":"https://latticeworksystems.com.au/ism/ism-1997/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1997.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1997.md","official":{"statement":"The board of directors or executive committee defines clear roles and responsibilities for cyber security both within the board of directors or executive committee and broadly within their organisation.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","Board of directors and executive committee","Embedding cyber security"]},"latticework_interpretation":null},{"id":"ISM-1998","url":"https://latticeworksystems.com.au/ism/ism-1998/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1998.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1998.md","official":{"statement":"The board of directors or executive committee ensures that cyber security is integrated throughout all business functions within their organisation.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","Board of directors and executive committee","Embedding cyber security"]},"latticework_interpretation":null},{"id":"ISM-1999","url":"https://latticeworksystems.com.au/ism/ism-1999/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1999.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-1999.md","official":{"statement":"The board of directors or executive committee ensures the cyber security strategy for their organisation is aligned with the overarching strategic direction and business strategy for their organisation.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","Board of directors and executive committee","Embedding cyber security"]},"latticework_interpretation":null},{"id":"ISM-2000","url":"https://latticeworksystems.com.au/ism/ism-2000/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2000.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2000.md","official":{"statement":"The board of directors or executive committee seeks regular briefings or reporting on the cyber security posture of their organisation, as well as the threat environment in which they operate, from internal and external subject matter experts.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","Board of directors and executive committee","Embedding cyber security"]},"latticework_interpretation":null},{"id":"ISM-2001","url":"https://latticeworksystems.com.au/ism/ism-2001/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2001.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2001.md","official":{"statement":"The board of directors or executive committee champions a positive cyber security culture within their organisation, including through leading by example.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","Board of directors and executive committee","Championing a positive cyber security culture"]},"latticework_interpretation":null},{"id":"ISM-2002","url":"https://latticeworksystems.com.au/ism/ism-2002/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2002.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2002.md","official":{"statement":"The board of directors or executive committee maintains a sufficient level of cyber security literacy to fulfil both their fiduciary duties and any legislative or regulatory obligations.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","Board of directors and executive committee","Building cyber security expertise"]},"latticework_interpretation":null},{"id":"ISM-2003","url":"https://latticeworksystems.com.au/ism/ism-2003/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2003.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2003.md","official":{"statement":"The board of directors or executive committee maintains awareness of key cyber security recruitment activities, retention rates for cyber security personnel, and cyber security skills and experience gaps within their organisation.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","Board of directors and executive committee","Building cyber security expertise"]},"latticework_interpretation":null},{"id":"ISM-2004","url":"https://latticeworksystems.com.au/ism/ism-2004/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2004.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2004.md","official":{"statement":"The board of directors or executive committee supports the development of cyber security skills and experience for all personnel via internal and external cyber security awareness raising and training opportunities.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","Board of directors and executive committee","Building cyber security expertise"]},"latticework_interpretation":null},{"id":"ISM-2005","url":"https://latticeworksystems.com.au/ism/ism-2005/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2005.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2005.md","official":{"statement":"The board of directors or executive committee understands the business criticality of their organisation’s systems, including at least a basic understanding of what systems exist, their value, where they reside, who has access, who might seek access, how they are protected, and how that protection is verified.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","Board of directors and executive committee","Identifying critical business assets"]},"latticework_interpretation":null},{"id":"ISM-2006","url":"https://latticeworksystems.com.au/ism/ism-2006/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2006.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2006.md","official":{"statement":"The board of directors or executive committee plans for major cyber security incidents, including by participating in exercises, and understands their duties in relation to such cyber security incidents.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","Board of directors and executive committee","Planning for major cyber security incidents"]},"latticework_interpretation":null},{"id":"ISM-2007","url":"https://latticeworksystems.com.au/ism/ism-2007/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2007.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2007.md","official":{"statement":"An authorised medical device register for SECRET and TOP SECRET areas is developed, implemented, maintained and regularly verified.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-26","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for physical security","Facilities and systems","Bringing medical devices into facilities"]},"latticework_interpretation":null},{"id":"ISM-2008","url":"https://latticeworksystems.com.au/ism/ism-2008/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2008.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2008.md","official":{"statement":"Medical devices authorised to be brought into SECRET and TOP SECRET areas meet, at a minimum, the following criteria:\n\n- are listed on the Australian Register of Therapeutic Goods\n- have been prescribed by a legally qualified medical practitioner\n- have been commercially purchased within Australia\n- do not have inbuilt cellular connectivity\n- can operate independently of mobile devices\n- where possible, have Wi-Fi, Bluetooth and other forms of wireless connectivity disabled when operating within SECRET and TOP SECRET areas.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-26","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for physical security","Facilities and systems","Bringing medical devices into facilities"]},"latticework_interpretation":null},{"id":"ISM-2009","url":"https://latticeworksystems.com.au/ism/ism-2009/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2009.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2009.md","official":{"statement":"Unauthorised medical devices are not brought into SECRET and TOP SECRET areas.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-25","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for physical security","Facilities and systems","Bringing medical devices into facilities"]},"latticework_interpretation":null},{"id":"ISM-2010","url":"https://latticeworksystems.com.au/ism/ism-2010/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2010.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2010.md","official":{"statement":"Service accounts configured with an SPN use the Advanced Encryption Standard for encryption.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Domain Services account hardening"]},"latticework_interpretation":null},{"id":"ISM-2011","url":"https://latticeworksystems.com.au/ism/ism-2011/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2011.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2011.md","official":{"statement":"When phishing-resistant multi-factor authentication is used by human users, other non-phishing-resistant multi-factor authentication options are disabled for their user accounts.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Multi-factor authentication"]},"latticework_interpretation":null},{"id":"ISM-2012","url":"https://latticeworksystems.com.au/ism/ism-2012/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2012.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2012.md","official":{"statement":"Systems are configured with a screen lock that:\n\n- activates after a maximum of 15 minutes of human user inactivity, or when manually activated\n- conceals all content on the screen\n- ensures that the screen does not enter a power saving state before the screen lock is activated\n- requires re-authentication by human users using all authentication factors to unlock the system\n- denies human users the ability to disable the screen locking mechanism.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Screen locking"]},"latticework_interpretation":null},{"id":"ISM-2013","url":"https://latticeworksystems.com.au/ism/ism-2013/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2013.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2013.md","official":{"statement":"Authentication and authorisation of clients is performed when clients call network APIs that facilitate modification of data but are not accessible over the internet.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Network application programming interfaces"]},"latticework_interpretation":null},{"id":"ISM-2014","url":"https://latticeworksystems.com.au/ism/ism-2014/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2014.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2014.md","official":{"statement":"Authentication and authorisation of clients is performed when clients call network APIs that facilitate access to data not authorised for release into the public domain but are not accessible over the internet.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Network application programming interfaces"]},"latticework_interpretation":null},{"id":"ISM-2015","url":"https://latticeworksystems.com.au/ism/ism-2015/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2015.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2015.md","official":{"statement":"Network API calls that facilitate modification of data, or access to data not authorised for release into the public domain, but are not accessible over the internet, are centrally logged.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Network application programming interfaces"]},"latticework_interpretation":null},{"id":"ISM-2016","url":"https://latticeworksystems.com.au/ism/ism-2016/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2016.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2016.md","official":{"statement":"Validation and sanitisation are performed on all input received over a local network by software.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Software input handling"]},"latticework_interpretation":null},{"id":"ISM-2017","url":"https://latticeworksystems.com.au/ism/ism-2017/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2017.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2017.md","official":{"statement":"DNS traffic is encrypted by clients and servers using ASD-approved cryptography.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Encrypted Domain Name System Services"]},"latticework_interpretation":null},{"id":"ISM-2018","url":"https://latticeworksystems.com.au/ism/ism-2018/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2018.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2018.md","official":{"statement":"Routes for RPKI-registered IP addresses that are advertised from invalid Autonomous Systems, or that are longer than allowed, are rejected or deprioritised by routers that exchange routes via BGP.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Gateways","Border Gateway Protocol routing security"]},"latticework_interpretation":null},{"id":"ISM-2019","url":"https://latticeworksystems.com.au/ism/ism-2019/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2019.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2019.md","official":{"statement":"TOP SECRET gateways undergo a security control assessment by ASD assessors (or their delegates), using the latest release of the ISM available prior to the beginning of the assessment (or a subsequent release), at least every 24 months.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-26","applicability":["TS"],"essential_eight_applicability":[],"section_path":["Guidelines for gateways","Gateways","Assessment of gateways"]},"latticework_interpretation":null},{"id":"ISM-2020","url":"https://latticeworksystems.com.au/ism/ism-2020/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2020.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2020.md","official":{"statement":"The CISO ensures sufficient cyber security personnel, with the right skills and experience, are acquired to support cyber security activities within their organisation.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","Chief information security officer","Overseeing cyber security personnel"]},"latticework_interpretation":null},{"id":"ISM-2021","url":"https://latticeworksystems.com.au/ism/ism-2021/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2021.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2021.md","official":{"statement":"System owners implement and maintain data minimisation practices for each of their systems.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cyber security roles","System owners","Protecting systems and their resources"]},"latticework_interpretation":null},{"id":"ISM-2022","url":"https://latticeworksystems.com.au/ism/ism-2022/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2022.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2022.md","official":{"statement":"A cyber security awareness training register is developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for personnel security","Cyber security awareness training","Providing cyber security awareness training"]},"latticework_interpretation":null},{"id":"ISM-2023","url":"https://latticeworksystems.com.au/ism/ism-2023/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2023.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2023.md","official":{"statement":"An authoritative source for software is established and maintained.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Authoritative source for software"]},"latticework_interpretation":null},{"id":"ISM-2024","url":"https://latticeworksystems.com.au/ism/ism-2024/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2024.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2024.md","official":{"statement":"The authoritative source for software is used for all software development activities.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Authoritative source for software"]},"latticework_interpretation":null},{"id":"ISM-2025","url":"https://latticeworksystems.com.au/ism/ism-2025/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2025.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2025.md","official":{"statement":"An issue tracking solution is used to link software development tasks to security issues and decisions, change or feature requests, programming issues, or bug fixes.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Issue tracking"]},"latticework_interpretation":null},{"id":"ISM-2026","url":"https://latticeworksystems.com.au/ism/ism-2026/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2026.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2026.md","official":{"statement":"All software artefacts are scanned for malicious content before being imported into the authoritative source for software.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Mar-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Software artefacts"]},"latticework_interpretation":null},{"id":"ISM-2027","url":"https://latticeworksystems.com.au/ism/ism-2027/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2027.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2027.md","official":{"statement":"All software artefacts are verified by a digital signature, or a secure hash provided over a secure channel, before being imported into the authoritative source for software.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Software artefacts"]},"latticework_interpretation":null},{"id":"ISM-2028","url":"https://latticeworksystems.com.au/ism/ism-2028/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2028.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2028.md","official":{"statement":"All software artefacts are tested to detect known weaknesses using static application security testing (SAST), dynamic application security testing (DAST) or software composition analysis (SCA), depending on the software artefact type, before being imported into the authoritative source for software.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Mar-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Software artefacts"]},"latticework_interpretation":null},{"id":"ISM-2029","url":"https://latticeworksystems.com.au/ism/ism-2029/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2029.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2029.md","official":{"statement":"The authoritative source for software restricts the use and import of third-party libraries and software components to trustworthy sources.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Software artefacts"]},"latticework_interpretation":null},{"id":"ISM-2030","url":"https://latticeworksystems.com.au/ism/ism-2030/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2030.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2030.md","official":{"statement":"Scanning is used during commits to identify plain text or encoded credentials, keys and secrets, which are then blocked from being stored in the authoritative source for software.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Software artefacts"]},"latticework_interpretation":null},{"id":"ISM-2031","url":"https://latticeworksystems.com.au/ism/ism-2031/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2031.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2031.md","official":{"statement":"Compilers, interpreters and build tools (including pipelines) that provide security features to improve executable file security are implemented and such security features are used.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Build solution"]},"latticework_interpretation":null},{"id":"ISM-2032","url":"https://latticeworksystems.com.au/ism/ism-2032/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2032.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2032.md","official":{"statement":"The build solution ensures that all automated testing is completed without warnings, alerts or errors before building software artefacts.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Build solution"]},"latticework_interpretation":null},{"id":"ISM-2033","url":"https://latticeworksystems.com.au/ism/ism-2033/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2033.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2033.md","official":{"statement":"All software security requirements are documented, stored securely and maintained throughout the software development life cycle.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Secure software development"]},"latticework_interpretation":null},{"id":"ISM-2034","url":"https://latticeworksystems.com.au/ism/ism-2034/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2034.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2034.md","official":{"statement":"Security design decisions are documented and reviewed throughout the software development cycle.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Secure software development"]},"latticework_interpretation":null},{"id":"ISM-2035","url":"https://latticeworksystems.com.au/ism/ism-2035/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2035.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2035.md","official":{"statement":"Security roles, responsibilities and knowledge required to support the software development life cycle are identified and documented.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Secure software development"]},"latticework_interpretation":null},{"id":"ISM-2036","url":"https://latticeworksystems.com.au/ism/ism-2036/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2036.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2036.md","official":{"statement":"Security responsibilities for software developers are identified and documented.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Secure software development"]},"latticework_interpretation":null},{"id":"ISM-2037","url":"https://latticeworksystems.com.au/ism/ism-2037/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2037.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2037.md","official":{"statement":"Software developers that lack sufficient cyber security knowledge and skills required for their projects or tasks undertake suitable training or upskilling on secure software development and programming practices.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Secure software development"]},"latticework_interpretation":null},{"id":"ISM-2038","url":"https://latticeworksystems.com.au/ism/ism-2038/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2038.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2038.md","official":{"statement":"A software developer cyber security knowledge and skills register is developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"2","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Secure software development"]},"latticework_interpretation":null},{"id":"ISM-2039","url":"https://latticeworksystems.com.au/ism/ism-2039/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2039.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2039.md","official":{"statement":"The software threat model is reviewed throughout the software development life cycle to ensure it reflects the as-built software and any changes to the threat environment.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Secure software development"]},"latticework_interpretation":null},{"id":"ISM-2040","url":"https://latticeworksystems.com.au/ism/ism-2040/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2040.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2040.md","official":{"statement":"Secure programming practices for the chosen programming language are used for software development.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Secure software development"]},"latticework_interpretation":null},{"id":"ISM-2041","url":"https://latticeworksystems.com.au/ism/ism-2041/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2041.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2041.md","official":{"statement":"Memory-safe programming languages, or less preferably memory-safe programming practices, are used for software development.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Secure software development"]},"latticework_interpretation":null},{"id":"ISM-2042","url":"https://latticeworksystems.com.au/ism/ism-2042/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2042.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2042.md","official":{"statement":"Secure by Default principles and practices are followed throughout the software development life cycle, including by ensuring that all built-in security measures are included and enabled in the base product at no extra cost to consumers.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Secure software development"]},"latticework_interpretation":null},{"id":"ISM-2043","url":"https://latticeworksystems.com.au/ism/ism-2043/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2043.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2043.md","official":{"statement":"Software is architected and structured to support readability and maintainability.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Secure software development"]},"latticework_interpretation":null},{"id":"ISM-2044","url":"https://latticeworksystems.com.au/ism/ism-2044/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2044.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2044.md","official":{"statement":"Software has no default credentials; however, if credentials are required, they are created on first install by the installing organisation.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Secure software development"]},"latticework_interpretation":null},{"id":"ISM-2045","url":"https://latticeworksystems.com.au/ism/ism-2045/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2045.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2045.md","official":{"statement":"Application backwards compatibility does not compromise any security measures or features.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Secure software development"]},"latticework_interpretation":null},{"id":"ISM-2046","url":"https://latticeworksystems.com.au/ism/ism-2046/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2046.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2046.md","official":{"statement":"Where software allows user impersonation, sensitive data is not logged and appropriate permissions are set.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Secure software development"]},"latticework_interpretation":null},{"id":"ISM-2047","url":"https://latticeworksystems.com.au/ism/ism-2047/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2047.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2047.md","official":{"statement":"Where software allows an authentication factor to be reset for a human user, the human user is notified of the reset through a secondary channel.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Secure software development"]},"latticework_interpretation":null},{"id":"ISM-2048","url":"https://latticeworksystems.com.au/ism/ism-2048/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2048.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2048.md","official":{"statement":"Where software supports multiple user roles, non-administrative users are prevented from altering their profile permissions or privileges.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Secure software development"]},"latticework_interpretation":null},{"id":"ISM-2049","url":"https://latticeworksystems.com.au/ism/ism-2049/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2049.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2049.md","official":{"statement":"When user permissions or credentials are changed, software forces all impacted users to re-authenticate.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Secure software development"]},"latticework_interpretation":null},{"id":"ISM-2050","url":"https://latticeworksystems.com.au/ism/ism-2050/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2050.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2050.md","official":{"statement":"When digital signatures are processed by software, they are validated against a certificate trust chain and checked for revocation using a Certificate Revocation List or with the Online Certificate Status Protocol.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Secure software development"]},"latticework_interpretation":null},{"id":"ISM-2051","url":"https://latticeworksystems.com.au/ism/ism-2051/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2051.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2051.md","official":{"statement":"Software generates sufficient event logs to support the detection of cyber security events.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Secure software development"]},"latticework_interpretation":null},{"id":"ISM-2052","url":"https://latticeworksystems.com.au/ism/ism-2052/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2052.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2052.md","official":{"statement":"Event logs produced by software ensure that any sensitive data is protected.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Secure software development"]},"latticework_interpretation":null},{"id":"ISM-2053","url":"https://latticeworksystems.com.au/ism/ism-2053/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2053.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2053.md","official":{"statement":"End of life procedures for software, including procedures for software removal and the archival or destruction of user accounts and data, are produced and made available to consumers.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Secure software development"]},"latticework_interpretation":null},{"id":"ISM-2054","url":"https://latticeworksystems.com.au/ism/ism-2054/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2054.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2054.md","official":{"statement":"If a software bill of materials is available for imported third-party software components, it is used during software development to ensure such software components have no known vulnerabilities.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Software bill of materials"]},"latticework_interpretation":null},{"id":"ISM-2055","url":"https://latticeworksystems.com.au/ism/ism-2055/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2055.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2055.md","official":{"statement":"If a software build provenance is available for imported third-party software components, it is used during software development to ensure such software components are built to an appropriate standard.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Software build provenance"]},"latticework_interpretation":null},{"id":"ISM-2056","url":"https://latticeworksystems.com.au/ism/ism-2056/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2056.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2056.md","official":{"statement":"A software build provenance is produced and made available to consumers of software.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Software build provenance"]},"latticework_interpretation":null},{"id":"ISM-2057","url":"https://latticeworksystems.com.au/ism/ism-2057/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2057.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2057.md","official":{"statement":"All input validation rules are documented, implemented in code, and tested using both positive and negative unit tests and integration tests.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Software input handling"]},"latticework_interpretation":null},{"id":"ISM-2058","url":"https://latticeworksystems.com.au/ism/ism-2058/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2058.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2058.md","official":{"statement":"Data sources and serialised data inputs are validated before being deserialised.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Software input handling"]},"latticework_interpretation":null},{"id":"ISM-2059","url":"https://latticeworksystems.com.au/ism/ism-2059/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2059.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2059.md","official":{"statement":"File uploads or input are restricted to specific file types, with malicious content scanning occurring prior to file access, file execution or file storage.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Software input handling"]},"latticework_interpretation":null},{"id":"ISM-2060","url":"https://latticeworksystems.com.au/ism/ism-2060/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2060.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2060.md","official":{"statement":"Code reviews are utilised to ensure software components meets Secure by Design principles and practices as well as secure programming practices.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Software security testing"]},"latticework_interpretation":null},{"id":"ISM-2061","url":"https://latticeworksystems.com.au/ism/ism-2061/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2061.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2061.md","official":{"statement":"Peer reviews are conducted on all critical and security-related software components.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Software security testing"]},"latticework_interpretation":null},{"id":"ISM-2062","url":"https://latticeworksystems.com.au/ism/ism-2062/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2062.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2062.md","official":{"statement":"Unit testing and integration testing, covering both positive and negative use cases, are used for software components to ensure code quality and correctness.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Software security testing"]},"latticework_interpretation":null},{"id":"ISM-2063","url":"https://latticeworksystems.com.au/ism/ism-2063/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2063.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2063.md","official":{"statement":"If supported, web application session cookies set the HttpOnly flag, Secure flag and the SameSite flag by default.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Web application development","Secure web application design and development"]},"latticework_interpretation":null},{"id":"ISM-2064","url":"https://latticeworksystems.com.au/ism/ism-2064/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2064.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2064.md","official":{"statement":"Web application session cookies contain only digitally signed opaque bearer tokens.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Web application development","Secure web application design and development"]},"latticework_interpretation":null},{"id":"ISM-2065","url":"https://latticeworksystems.com.au/ism/ism-2065/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2065.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2065.md","official":{"statement":"Web application session cookies using opaque bearer tokens that are not digitally signed use non-sequential random identifiers with a minimum of 128 bits of entropy, preferably 256 bits of entropy.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Web application development","Secure web application design and development"]},"latticework_interpretation":null},{"id":"ISM-2066","url":"https://latticeworksystems.com.au/ism/ism-2066/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2066.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2066.md","official":{"statement":"Web application sessions are centrally managed server side.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Web application development","Secure web application design and development"]},"latticework_interpretation":null},{"id":"ISM-2067","url":"https://latticeworksystems.com.au/ism/ism-2067/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2067.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2067.md","official":{"statement":"Web applications that support Single Sign On equally support Single Logout.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Web application development","Secure web application design and development"]},"latticework_interpretation":null},{"id":"ISM-2068","url":"https://latticeworksystems.com.au/ism/ism-2068/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2068.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2068.md","official":{"statement":"Internet connectivity for networked devices is strictly limited to those that require access.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Functional separation between networked devices and the internet"]},"latticework_interpretation":null},{"id":"ISM-2069","url":"https://latticeworksystems.com.au/ism/ism-2069/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2069.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2069.md","official":{"statement":"An authorised photographic and video recording device register for SECRET and TOP SECRET areas is developed, implemented, maintained and regularly verified.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-26","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for physical security","Facilities and systems","Bringing photographic and video recording devices into facilities"]},"latticework_interpretation":null},{"id":"ISM-2070","url":"https://latticeworksystems.com.au/ism/ism-2070/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2070.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2070.md","official":{"statement":"Unauthorised photographic and video recording devices are not brought into SECRET and TOP SECRET areas.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-25","applicability":["S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for physical security","Facilities and systems","Bringing photographic and video recording devices into facilities"]},"latticework_interpretation":null},{"id":"ISM-2071","url":"https://latticeworksystems.com.au/ism/ism-2071/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2071.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2071.md","official":{"statement":"Personnel dealing with user account details are advised of what social engineering attacks are, how to manage such situations and how to report them.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for personnel security","Cyber security awareness training","Managing requests to modify user accounts"]},"latticework_interpretation":null},{"id":"ISM-2072","url":"https://latticeworksystems.com.au/ism/ism-2072/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2072.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2072.md","official":{"statement":"AI models are stored in a non-executable file format that does not allow arbitrary code execution.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Artificial intelligence application development","Secure artificial intelligence application development"]},"latticework_interpretation":null},{"id":"ISM-2073","url":"https://latticeworksystems.com.au/ism/ism-2073/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2073.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2073.md","official":{"statement":"A post-quantum cryptography transition plan is developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for cryptography","Cryptographic algorithms","Transitioning to post-quantum cryptography"]},"latticework_interpretation":null},{"id":"ISM-2074","url":"https://latticeworksystems.com.au/ism/ism-2074/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2074.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2074.md","official":{"statement":"A general-purpose AI usage policy is developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for personnel security","Cyber security awareness training","General-purpose artificial intelligence usage policy"]},"latticework_interpretation":null},{"id":"ISM-2075","url":"https://latticeworksystems.com.au/ism/ism-2075/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2075.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2075.md","official":{"statement":"Fax machines, and online fax services, are not used for sending or receiving fax messages.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for communications systems","Fax machines and services","Sending and receiving fax messages"]},"latticework_interpretation":null},{"id":"ISM-2076","url":"https://latticeworksystems.com.au/ism/ism-2076/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2076.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2076.md","official":{"statement":"Security questions are not used for authentication purposes.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Insecure authentication methods"]},"latticework_interpretation":null},{"id":"ISM-2077","url":"https://latticeworksystems.com.au/ism/ism-2077/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2077.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2077.md","official":{"statement":"Email is not used for out-of-band authentication purposes.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Insecure authentication methods"]},"latticework_interpretation":null},{"id":"ISM-2078","url":"https://latticeworksystems.com.au/ism/ism-2078/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2078.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2078.md","official":{"statement":"Passwords appearing in lists of commonly used passwords or lists of compromised passwords are not used.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Password strength"]},"latticework_interpretation":null},{"id":"ISM-2079","url":"https://latticeworksystems.com.au/ism/ism-2079/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2079.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2079.md","official":{"statement":"Maximum length limits for passwords are not less than 64 characters.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Password strength"]},"latticework_interpretation":null},{"id":"ISM-2080","url":"https://latticeworksystems.com.au/ism/ism-2080/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2080.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2080.md","official":{"statement":"Password complexity requirements are not imposed for passwords.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Password strength"]},"latticework_interpretation":null},{"id":"ISM-2081","url":"https://latticeworksystems.com.au/ism/ism-2081/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2081.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2081.md","official":{"statement":"All ASCII printable characters are supported for passwords.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Password strength"]},"latticework_interpretation":null},{"id":"ISM-2082","url":"https://latticeworksystems.com.au/ism/ism-2082/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2082.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2082.md","official":{"statement":"If a cryptographic bill of materials is available for imported third-party software components, it is used during software development to ensure such software components provide support for standardised implementations of ASD-Approved Cryptographic Algorithms.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Cryptographic bill of materials"]},"latticework_interpretation":null},{"id":"ISM-2083","url":"https://latticeworksystems.com.au/ism/ism-2083/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2083.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2083.md","official":{"statement":"A cryptographic bill of materials is produced and made available to consumers of software.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Cryptographic bill of materials"]},"latticework_interpretation":null},{"id":"ISM-2084","url":"https://latticeworksystems.com.au/ism/ism-2084/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2084.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2084.md","official":{"statement":"AI-specific documentation, including AI model cards and AI system cards (or equivalent artefacts), is used to document AI model characteristics, system architectures, use cases and security risks.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Artificial intelligence application development","Secure artificial intelligence application development"]},"latticework_interpretation":null},{"id":"ISM-2085","url":"https://latticeworksystems.com.au/ism/ism-2085/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2085.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2085.md","official":{"statement":"The exposure of exact AI model confidence scores in API outputs or user interfaces is prevented.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Artificial intelligence application development","Secure artificial intelligence application development"]},"latticework_interpretation":null},{"id":"ISM-2086","url":"https://latticeworksystems.com.au/ism/ism-2086/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2086.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2086.md","official":{"statement":"The source and integrity of AI models, structures and weights are verified.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Artificial intelligence application development","Artificial intelligence model poisoning"]},"latticework_interpretation":null},{"id":"ISM-2087","url":"https://latticeworksystems.com.au/ism/ism-2087/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2087.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2087.md","official":{"statement":"The source and integrity of training data for AI models is verified.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Artificial intelligence application development","Artificial intelligence model poisoning"]},"latticework_interpretation":null},{"id":"ISM-2088","url":"https://latticeworksystems.com.au/ism/ism-2088/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2088.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2088.md","official":{"statement":"Data validation and verification techniques are used to ensure the reliability and accuracy of training data used by AI models.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Artificial intelligence application development","Artificial intelligence model poisoning"]},"latticework_interpretation":null},{"id":"ISM-2089","url":"https://latticeworksystems.com.au/ism/ism-2089/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2089.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2089.md","official":{"statement":"AI model performance metrics are monitored and anomalies are investigated.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Artificial intelligence application development","Unbounded consumption"]},"latticework_interpretation":null},{"id":"ISM-2090","url":"https://latticeworksystems.com.au/ism/ism-2090/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2090.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2090.md","official":{"statement":"Rate limiting is applied to inference queries for AI models.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Artificial intelligence application development","Unbounded consumption"]},"latticework_interpretation":null},{"id":"ISM-2091","url":"https://latticeworksystems.com.au/ism/ism-2091/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2091.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2091.md","official":{"statement":"Resource limits are enforced for AI models.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Artificial intelligence application development","Unbounded consumption"]},"latticework_interpretation":null},{"id":"ISM-2092","url":"https://latticeworksystems.com.au/ism/ism-2092/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2092.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2092.md","official":{"statement":"Access control policies are implemented to enforce fine-grained permissions for AI applications.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Artificial intelligence application development","Excessive agency"]},"latticework_interpretation":null},{"id":"ISM-2093","url":"https://latticeworksystems.com.au/ism/ism-2093/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2093.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2093.md","official":{"statement":"Role-based access controls are implemented for AI applications to restrict access to sensitive data.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Artificial intelligence application development","Excessive agency"]},"latticework_interpretation":null},{"id":"ISM-2094","url":"https://latticeworksystems.com.au/ism/ism-2094/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2094.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2094.md","official":{"statement":"Content filtering is implemented by AI applications to detect and block sensitive data exposure and improper output.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Dec-25","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Artificial intelligence application development","Sensitive data exposure and improper output"]},"latticework_interpretation":null},{"id":"ISM-2095","url":"https://latticeworksystems.com.au/ism/ism-2095/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2095.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2095.md","official":{"statement":"Personnel using privately owned mobile devices or desktop computers to access OFFICIAL: Sensitive or PROTECTED systems or data are disallowed from granting access to unapproved artificial intelligence agents.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Jun-26","applicability":["OS","P"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Enterprise mobility","Privately owned mobile devices and desktop computers"]},"latticework_interpretation":null},{"id":"ISM-2096","url":"https://latticeworksystems.com.au/ism/ism-2096/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2096.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2096.md","official":{"statement":"Mobile devices are configured to enforce separation between organisational and personal mobile applications and data.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device management","Maintaining mobile device security"]},"latticework_interpretation":null},{"id":"ISM-2097","url":"https://latticeworksystems.com.au/ism/ism-2097/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2097.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2097.md","official":{"statement":"Mobile devices are configured with always on VPN functionality.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device management","Maintaining mobile device security"]},"latticework_interpretation":null},{"id":"ISM-2098","url":"https://latticeworksystems.com.au/ism/ism-2098/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2098.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2098.md","official":{"statement":"Mobile devices are configured to prevent data transfers over Universal Serial Bus connections.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device management","Maintaining mobile device security"]},"latticework_interpretation":null},{"id":"ISM-2099","url":"https://latticeworksystems.com.au/ism/ism-2099/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2099.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2099.md","official":{"statement":"Mobile devices are not connected to the infotainment systems of connected vehicles.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device usage","Connecting mobile devices to connected vehicles"]},"latticework_interpretation":null},{"id":"ISM-2100","url":"https://latticeworksystems.com.au/ism/ism-2100/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2100.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2100.md","official":{"statement":"Sensitive or classified data is not viewed on mobile devices within or near connected vehicles.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device usage","Using mobile devices within or near connected vehicles"]},"latticework_interpretation":null},{"id":"ISM-2101","url":"https://latticeworksystems.com.au/ism/ism-2101/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2101.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2101.md","official":{"statement":"Sensitive or classified phone calls and conversations are not conducted within or near connected vehicles.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device usage","Using mobile devices within or near connected vehicles"]},"latticework_interpretation":null},{"id":"ISM-2102","url":"https://latticeworksystems.com.au/ism/ism-2102/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2102.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2102.md","official":{"statement":"Existing software artefacts in the authoritative source for software are periodically tested to detect known weaknesses using SAST, DAST or SCA, depending on the software artefact type, throughout the software development life cycle.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Software artefacts"]},"latticework_interpretation":null},{"id":"ISM-2103","url":"https://latticeworksystems.com.au/ism/ism-2103/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2103.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2103.md","official":{"statement":"Organisational data generated, collected or processed by AI applications is not used for training, fine-tuning or improving AI models unless informed and explicit consent has been obtained from data owners in advance.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Mar-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Artificial intelligence application development","Data collection, retention and use"]},"latticework_interpretation":null},{"id":"ISM-2104","url":"https://latticeworksystems.com.au/ism/ism-2104/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2104.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2104.md","official":{"statement":"Personnel are advised not to post information about their security clearance and briefings on unauthorised online services, and to report cases where such information is posted.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for personnel security","Cyber security awareness training","Posting work-related information on online services"]},"latticework_interpretation":null},{"id":"ISM-2105","url":"https://latticeworksystems.com.au/ism/ism-2105/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2105.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2105.md","official":{"statement":"Personnel are advised to limit posting information about their work-related duties on unauthorised online services, and to report cases where such information is posted.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for personnel security","Cyber security awareness training","Posting work-related information on online services"]},"latticework_interpretation":null},{"id":"ISM-2106","url":"https://latticeworksystems.com.au/ism/ism-2106/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2106.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2106.md","official":{"statement":"Personnel are advised to limit posting information about their work-related skills and experience on unauthorised online services, and to report cases where such information is posted.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for personnel security","Cyber security awareness training","Posting work-related information on online services"]},"latticework_interpretation":null},{"id":"ISM-2107","url":"https://latticeworksystems.com.au/ism/ism-2107/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2107.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2107.md","official":{"statement":"Personnel are encouraged to use any available privacy settings to restrict who can view personal information they post on online services.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for personnel security","Cyber security awareness training","Posting personal information on online services"]},"latticework_interpretation":null},{"id":"ISM-2108","url":"https://latticeworksystems.com.au/ism/ism-2108/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2108.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2108.md","official":{"statement":"Mobile applications encrypt all sensitive or classified data communicated over public network infrastructure using ASD-approved cryptography.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for enterprise mobility","Mobile device management","Encrypted communications"]},"latticework_interpretation":null},{"id":"ISM-2109","url":"https://latticeworksystems.com.au/ism/ism-2109/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2109.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2109.md","official":{"statement":"Pre-boot authentication using passwords, or managed network-based key release, is implemented for media containing encrypted system volumes.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for media","Media usage","Encrypting media"]},"latticework_interpretation":null},{"id":"ISM-2110","url":"https://latticeworksystems.com.au/ism/ism-2110/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2110.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2110.md","official":{"statement":"User applications are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","User application hardening","Hardening user application configurations"]},"latticework_interpretation":null},{"id":"ISM-2111","url":"https://latticeworksystems.com.au/ism/ism-2111/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2111.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2111.md","official":{"statement":"All temporary installation files created during user application installation processes are removed after user applications have been installed.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","User application hardening","Hardening user application configurations"]},"latticework_interpretation":null},{"id":"ISM-2112","url":"https://latticeworksystems.com.au/ism/ism-2112/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2112.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2112.md","official":{"statement":"AI applications that process classified data have their ability to directly access external public data sources disabled.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-26","applicability":["OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","User application hardening","Artificial intelligence applications"]},"latticework_interpretation":null},{"id":"ISM-2113","url":"https://latticeworksystems.com.au/ism/ism-2113/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2113.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2113.md","official":{"statement":"AI applications are configured to require human approval before executing sensitive or high-impact actions.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","User application hardening","Artificial intelligence applications"]},"latticework_interpretation":null},{"id":"ISM-2114","url":"https://latticeworksystems.com.au/ism/ism-2114/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2114.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2114.md","official":{"statement":"Baselines of expected behaviour and performance for AI applications are established and monitored for unexpected deviations.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","User application hardening","Artificial intelligence applications"]},"latticework_interpretation":null},{"id":"ISM-2115","url":"https://latticeworksystems.com.au/ism/ism-2115/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2115.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2115.md","official":{"statement":"Extensions for server applications are restricted to an organisation-approved set.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Hardening server application configurations"]},"latticework_interpretation":null},{"id":"ISM-2116","url":"https://latticeworksystems.com.au/ism/ism-2116/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2116.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2116.md","official":{"statement":"Cyber threat intelligence services are used to support the detection of cyber security events and the identification of cyber security incidents.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for security assurance","Security monitoring","Event log monitoring"]},"latticework_interpretation":null},{"id":"ISM-2117","url":"https://latticeworksystems.com.au/ism/ism-2117/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2117.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2117.md","official":{"statement":"Suitable AI models are used to augment the detection of cyber security events and the identification of cyber security incidents.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for security assurance","Security monitoring","Event log monitoring"]},"latticework_interpretation":null},{"id":"ISM-2118","url":"https://latticeworksystems.com.au/ism/ism-2118/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2118.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2118.md","official":{"statement":"Vulnerability assessments and penetration tests are conducted for systems prior to their deployment, including prior to the deployment of significant changes, and at least every six months thereafter.","statement_format":"OSCAL markup-multiline","revision":"1","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for security assurance","Security assessments","Vulnerability assessments and penetration tests"]},"latticework_interpretation":null},{"id":"ISM-2119","url":"https://latticeworksystems.com.au/ism/ism-2119/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2119.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2119.md","official":{"statement":"Suitable AI models are used to augment vulnerability assessments and penetration tests.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for security assurance","Security assessments","Vulnerability assessments and penetration tests"]},"latticework_interpretation":null},{"id":"ISM-2120","url":"https://latticeworksystems.com.au/ism/ism-2120/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2120.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2120.md","official":{"statement":"A secure software development policy is developed, implemented and maintained.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Secure software development"]},"latticework_interpretation":null},{"id":"ISM-2121","url":"https://latticeworksystems.com.au/ism/ism-2121/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2121.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2121.md","official":{"statement":"Software developers that lack sufficient cyber security knowledge and skills required for their projects or tasks are not used.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Secure software development"]},"latticework_interpretation":null},{"id":"ISM-2122","url":"https://latticeworksystems.com.au/ism/ism-2122/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2122.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2122.md","official":{"statement":"Suitable AI models are used to augment software security testing.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Software security testing"]},"latticework_interpretation":null},{"id":"ISM-2123","url":"https://latticeworksystems.com.au/ism/ism-2123/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2123.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2123.md","official":{"statement":"All prompts and outputs associated with chat sessions are securely deleted when chat sessions are removed from AI applications.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Jun-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Artificial intelligence application development","Data collection, retention and use"]},"latticework_interpretation":null},{"id":"ISM-2124","url":"https://latticeworksystems.com.au/ism/ism-2124/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2124.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2124.md","official":{"statement":"Access by a service provider to an organisation’s systems is restricted to remote management tools, source network addresses and time windows explicitly approved by the organisation.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Managed services and cloud services","Access to systems by service providers"]},"latticework_interpretation":null},{"id":"ISM-2125","url":"https://latticeworksystems.com.au/ism/ism-2125/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2125.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2125.md","official":{"statement":"All access to an organisation’s systems by a service provider is independently logged by the organisation in a manner that the service provider cannot modify or delete, and analysed in a timely manner to detect any anomalous, unexpected or unauthorised activity.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for procurement and outsourcing","Managed services and cloud services","Access to systems by service providers"]},"latticework_interpretation":null},{"id":"ISM-2126","url":"https://latticeworksystems.com.au/ism/ism-2126/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2126.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2126.md","official":{"statement":"Personnel positively identify requestors using a pre-established authentication method or independent trusted communication channel before actioning requests to modify user account details, modify banking details or conduct financial transactions.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for personnel security","Cyber security awareness training","Synthetic impersonation"]},"latticework_interpretation":null},{"id":"ISM-2127","url":"https://latticeworksystems.com.au/ism/ism-2127/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2127.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2127.md","official":{"statement":"Digital signature verification functionality for drivers is enforced before they are loaded.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Hardening operating system configurations"]},"latticework_interpretation":null},{"id":"ISM-2128","url":"https://latticeworksystems.com.au/ism/ism-2128/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2128.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2128.md","official":{"statement":"The ability to install, load or modify kernel-mode code, including drivers, kernel modules and extensions, is limited to privileged users who require such abilities as part of their duties or functions.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Hardening operating system configurations"]},"latticework_interpretation":{"title":"Set and verify workload isolation defaults","implementation_steps":["Review ASD and vendor hardening guidance for the workload and runtime. Record conflicts and approved exceptions before changing production.","Set non-root execution, a read-only root filesystem, no privilege escalation, restricted capabilities and an appropriate seccomp profile. Remove unnecessary host namespace and hostPath access. Test application compatibility and admission enforcement.","Review who can install, load or modify kernel modules and drivers on nodes, including access through privileged workloads and added SYS_MODULE capabilities. Remove unnecessary access and retain approved duties and driver/module policy separately."],"evidence_to_retain":["Keep the guidance review, pinned policy revision, admitted workload manifests and dated scan or PolicyReport with exclusions.","Use failing and passing fixtures to demonstrate the enforced policy. Retain runtime and node configuration evidence separately; manifest settings do not prove runtime isolation.","Retain node access reviews and kernel module/driver configuration. The mapped privileged-container detector does not inspect SYS_MODULE or establish which human users require kernel-mode access."],"responsibility_boundary":"Platform team: admission controls, runtime and node configuration. Workload team: container settings and compatibility. Organisation: hardening standard, exception approval and system boundary.","checks":[{"engine":"kubescape","name":"ism-no-privileged-containers"},{"engine":"kubescape","name":"ism-drop-all-capabilities"}],"coverage":"partial","limitations":"Findings show whether workloads run privileged or add SYS_ADMIN, and whether regular or init containers add capabilities back after dropping ALL other than NET_BIND_SERVICE. The added-capability check does not cover ephemeral containers; these findings do not assess node access, driver signing or which privileged users can modify kernel-mode code.","responsibility_allocation":{"eks":"customer-workload","self-managed":"customer-workload","source":"provisional","notes":"Provisional allocation for the detector evidence only. No provider inheritance or whole-control ownership is established until an authorised CSCM and the engagement boundary are reviewed."},"mapping_source":{"repository":"https://github.com/Latticework-Systems/ism-kubernetes-controls","revision":"07b348a2952bf2d0e78d9e739f367cb0919ab888","url":"https://github.com/Latticework-Systems/ism-kubernetes-controls/blob/07b348a2952bf2d0e78d9e739f367cb0919ab888/mapping/ism-mapping.yaml","sha256":"f823681fd71e40e589aae714ef2215dd8dc33722a1ec70b81ded5b2322937470"}}},{"id":"ISM-2129","url":"https://latticeworksystems.com.au/ism/ism-2129/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2129.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2129.md","official":{"statement":"WMI activity, including the creation of permanent event subscriptions, is centrally logged.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Operating system hardening","Windows Management Instrumentation"]},"latticework_interpretation":null},{"id":"ISM-2130","url":"https://latticeworksystems.com.au/ism/ism-2130/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2130.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2130.md","official":{"statement":"Web-based enrolment interfaces for Microsoft AD CS servers are disabled unless required, and where enabled, are configured to require HTTPS and Extended Protection for Authentication.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Certificate Services"]},"latticework_interpretation":null},{"id":"ISM-2131","url":"https://latticeworksystems.com.au/ism/ism-2131/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2131.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2131.md","official":{"statement":"Certificate templates are reviewed at least every three months to identify and remediate misconfigurations that could enable privilege escalation or unauthorised certificate enrolment.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Certificate Services"]},"latticework_interpretation":null},{"id":"ISM-2132","url":"https://latticeworksystems.com.au/ism/ism-2132/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2132.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2132.md","official":{"statement":"Certificate enrolment events, including successful and unsuccessful requests and changes to certificate templates or Microsoft AD CS configurations, are centrally logged.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system hardening","Server application hardening","Microsoft Active Directory Certificate Services"]},"latticework_interpretation":null},{"id":"ISM-2133","url":"https://latticeworksystems.com.au/ism/ism-2133/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2133.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2133.md","official":{"statement":"Each AI agent is assigned a unique identity that is distinct from the user accounts of personnel and the identities of other AI agents.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Artificial intelligence agent identification"]},"latticework_interpretation":null},{"id":"ISM-2134","url":"https://latticeworksystems.com.au/ism/ism-2134/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2134.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2134.md","official":{"statement":"An AI agent register is developed, implemented, maintained and regularly verified.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Artificial intelligence agent register"]},"latticework_interpretation":null},{"id":"ISM-2135","url":"https://latticeworksystems.com.au/ism/ism-2135/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2135.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2135.md","official":{"statement":"An AI agent register contains the following for each AI agent:\n\n- its unique identifier\n- its owner and business purpose\n- the identities assigned to it\n- any user accounts and credentials it uses\n- the tools, permissions and data repositories it can access.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Artificial intelligence agent register"]},"latticework_interpretation":null},{"id":"ISM-2136","url":"https://latticeworksystems.com.au/ism/ism-2136/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2136.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2136.md","official":{"statement":"Risk-based access decisions, informed by contextual signals, are enforced for access to systems and their resources.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Authenticating to systems"]},"latticework_interpretation":null},{"id":"ISM-2137","url":"https://latticeworksystems.com.au/ism/ism-2137/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2137.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2137.md","official":{"statement":"Human users are prevented from granting consent to third-party OAuth applications, with such consent granted only by an authorised administrator.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Third-party application access and device code authentication"]},"latticework_interpretation":null},{"id":"ISM-2138","url":"https://latticeworksystems.com.au/ism/ism-2138/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2138.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2138.md","official":{"statement":"OAuth application consents, including their granted permissions, are reviewed at least every six months, with unused applications and excessive permissions revoked.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Third-party application access and device code authentication"]},"latticework_interpretation":null},{"id":"ISM-2139","url":"https://latticeworksystems.com.au/ism/ism-2139/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2139.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2139.md","official":{"statement":"Consent grants, token issuance and token use for third-party OAuth applications are centrally logged.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Third-party application access and device code authentication"]},"latticework_interpretation":null},{"id":"ISM-2140","url":"https://latticeworksystems.com.au/ism/ism-2140/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2140.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2140.md","official":{"statement":"The OAuth device code authentication flow is disabled unless required, and where required, is restricted to authorised user accounts and managed devices.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Identity and access management","Third-party application access and device code authentication"]},"latticework_interpretation":null},{"id":"ISM-2141","url":"https://latticeworksystems.com.au/ism/ism-2141/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2141.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2141.md","official":{"statement":"Applications and workloads use short-lived dynamically issued credentials in preference to long-lived static credentials.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Application and workload credentials"]},"latticework_interpretation":{"title":"Inspect credential issuance, lifetime and sharing","implementation_steps":["Inventory workload and service identities, including credentials held outside Kubernetes. Prefer short-lived projected or dynamically issued credentials and explicitly set the intended audience.","Review legacy service-account token Secrets, default ServiceAccount use and credential sharing across workloads/environments. Test admission policies before rollout; assess existing credentials separately."],"evidence_to_retain":["Keep an identity-to-workload/environment inventory, credential issuer configuration, token lifetime/audience evidence and revocation/rotation records without recording secret values.","Keep policy configuration and admission results, plus a separate existing-credential review. Demonstrate uniqueness and dynamic issuance directly; non-default account names do not establish either."],"responsibility_boundary":"Platform team: token issuer and admission configuration. Workload team: identity allocation and application secrets. Organisation: credential policy, break-glass custody and access reviews.","checks":[{"engine":"kyverno","name":"ism-privileged-access-block-legacy-sa-tokens"}],"coverage":"partial","limitations":"Admission results show whether new or updated legacy service-account token Secrets are rejected or reported; background scanning is disabled. They do not prove existing tokens are removed, projected tokens are used, token lifetimes are short, or application and external credentials are dynamic.","responsibility_allocation":{"eks":"customer-workload","self-managed":"customer-workload","source":"provisional","notes":"Provisional allocation for the detector evidence only. No provider inheritance or whole-control ownership is established until an authorised CSCM and the engagement boundary are reviewed."},"mapping_source":{"repository":"https://github.com/Latticework-Systems/ism-kubernetes-controls","revision":"07b348a2952bf2d0e78d9e739f367cb0919ab888","url":"https://github.com/Latticework-Systems/ism-kubernetes-controls/blob/07b348a2952bf2d0e78d9e739f367cb0919ab888/mapping/ism-mapping.yaml","sha256":"f823681fd71e40e589aae714ef2215dd8dc33722a1ec70b81ded5b2322937470"}}},{"id":"ISM-2142","url":"https://latticeworksystems.com.au/ism/ism-2142/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2142.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2142.md","official":{"statement":"Static credentials used by applications and workloads are centrally managed using a credential or secrets management solution.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Application and workload credentials"]},"latticework_interpretation":null},{"id":"ISM-2143","url":"https://latticeworksystems.com.au/ism/ism-2143/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2143.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2143.md","official":{"statement":"Applications and workloads use unique credentials that are not shared with other applications or workloads, or across development, testing, staging and production environments.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Application and workload credentials"]},"latticework_interpretation":{"title":"Inspect credential issuance, lifetime and sharing","implementation_steps":["Inventory workload and service identities, including credentials held outside Kubernetes. Prefer short-lived projected or dynamically issued credentials and explicitly set the intended audience.","Review legacy service-account token Secrets, default ServiceAccount use and credential sharing across workloads/environments. Test admission policies before rollout; assess existing credentials separately."],"evidence_to_retain":["Keep an identity-to-workload/environment inventory, credential issuer configuration, token lifetime/audience evidence and revocation/rotation records without recording secret values.","Keep policy configuration and admission results, plus a separate existing-credential review. Demonstrate uniqueness and dynamic issuance directly; non-default account names do not establish either."],"responsibility_boundary":"Platform team: token issuer and admission configuration. Workload team: identity allocation and application secrets. Organisation: credential policy, break-glass custody and access reviews.","checks":[{"engine":"kubescape","name":"ism-default-service-accounts"},{"engine":"kyverno","name":"ism-privileged-access-mutate-default-sa"},{"engine":"kyverno","name":"ism-privileged-access-require-dedicated-sa"}],"coverage":"partial","limitations":"Kubescape findings show that scanned namespaces include a non-default ServiceAccount and that the default ServiceAccount disables token automount. Kyverno PolicyReports provide admission-time evidence for the corresponding policies. Neither proves that each workload uses its own account or that credentials are unique across workloads and environments, or says anything about credentials held outside Kubernetes service accounts.","responsibility_allocation":{"eks":"customer-workload","self-managed":"customer-workload","source":"provisional","notes":"Provisional allocation for the detector evidence only. No provider inheritance or whole-control ownership is established until an authorised CSCM and the engagement boundary are reviewed."},"mapping_source":{"repository":"https://github.com/Latticework-Systems/ism-kubernetes-controls","revision":"07b348a2952bf2d0e78d9e739f367cb0919ab888","url":"https://github.com/Latticework-Systems/ism-kubernetes-controls/blob/07b348a2952bf2d0e78d9e739f367cb0919ab888/mapping/ism-mapping.yaml","sha256":"f823681fd71e40e589aae714ef2215dd8dc33722a1ec70b81ded5b2322937470"}}},{"id":"ISM-2144","url":"https://latticeworksystems.com.au/ism/ism-2144/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2144.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2144.md","official":{"statement":"Static credentials used by applications and workloads are changed if:\n\n- they are compromised or suspected of being compromised\n- they are discovered stored on systems in the clear\n- they are discovered being transferred across networks in the clear.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Changing credentials"]},"latticework_interpretation":null},{"id":"ISM-2145","url":"https://latticeworksystems.com.au/ism/ism-2145/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2145.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2145.md","official":{"statement":"Credentials for user accounts are revoked when they are no longer required.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Revoking credentials"]},"latticework_interpretation":null},{"id":"ISM-2146","url":"https://latticeworksystems.com.au/ism/ism-2146/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2146.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2146.md","official":{"statement":"Static credentials used by applications and workloads are revoked when they are no longer required.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Revoking credentials"]},"latticework_interpretation":null},{"id":"ISM-2147","url":"https://latticeworksystems.com.au/ism/ism-2147/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2147.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2147.md","official":{"statement":"Authentication tokens, session cookies and refresh tokens are cryptographically bound to the device on which they were issued.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Protecting authentication artefacts"]},"latticework_interpretation":null},{"id":"ISM-2148","url":"https://latticeworksystems.com.au/ism/ism-2148/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2148.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2148.md","official":{"statement":"Active sessions, refresh tokens and other authentication artefacts are revoked when credentials are reset or re-enrolled, when credentials are compromised or suspected of being compromised, when a device no longer meets compliance requirements, or when high-risk sign-in activity is detected.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Protecting authentication artefacts"]},"latticework_interpretation":null},{"id":"ISM-2149","url":"https://latticeworksystems.com.au/ism/ism-2149/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2149.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2149.md","official":{"statement":"A list of authorised RMM tools and remote access tools is developed, enforced and maintained.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system management","System administration","Administrative tools"]},"latticework_interpretation":null},{"id":"ISM-2150","url":"https://latticeworksystems.com.au/ism/ism-2150/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2150.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2150.md","official":{"statement":"Network connections for unauthorised RMM tools and remote access tools are blocked at gateways.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system management","System administration","Administrative tools"]},"latticework_interpretation":null},{"id":"ISM-2151","url":"https://latticeworksystems.com.au/ism/ism-2151/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2151.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2151.md","official":{"statement":"Backups are stored using a technically enforced immutability mechanism that prevents their modification or deletion for the duration of their retention period.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system management","Data backup and restoration","Backup modification and deletion"]},"latticework_interpretation":null},{"id":"ISM-2152","url":"https://latticeworksystems.com.au/ism/ism-2152/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2152.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2152.md","official":{"statement":"Backup infrastructure, including backup servers, repositories and management consoles, is segregated from production environments and uses a separate authentication mechanism for administrative access.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system management","Data backup and restoration","Backup modification and deletion"]},"latticework_interpretation":null},{"id":"ISM-2153","url":"https://latticeworksystems.com.au/ism/ism-2153/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2153.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2153.md","official":{"statement":"Threat hunting activities, informed by current strategic and sector-specific cyber threat intelligence, are conducted at least every three months.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for security assurance","Security monitoring","Threat hunting"]},"latticework_interpretation":null},{"id":"ISM-2154","url":"https://latticeworksystems.com.au/ism/ism-2154/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2154.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2154.md","official":{"statement":"Software artefact dependencies are pinned to approved versions in source code.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Software artefacts"]},"latticework_interpretation":null},{"id":"ISM-2155","url":"https://latticeworksystems.com.au/ism/ism-2155/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2155.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2155.md","official":{"statement":"Software is built using reproducible build practices that enable independent verification that release artefacts were produced from the stated source code.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Software development fundamentals","Build solution"]},"latticework_interpretation":null},{"id":"ISM-2156","url":"https://latticeworksystems.com.au/ism/ism-2156/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2156.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2156.md","official":{"statement":"Agentic AI applications are restricted to the minimum set of tools, functions and permissions required for their intended purpose.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Artificial intelligence application development","Excessive agency"]},"latticework_interpretation":null},{"id":"ISM-2157","url":"https://latticeworksystems.com.au/ism/ism-2157/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2157.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2157.md","official":{"statement":"Tools invoked by agentic AI applications are subject to both the access controls of the invoking user and agent-specific, task-scoped authorisation, with effective permissions limited to the minimum permitted by both.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Artificial intelligence application development","Excessive agency"]},"latticework_interpretation":null},{"id":"ISM-2158","url":"https://latticeworksystems.com.au/ism/ism-2158/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2158.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2158.md","official":{"statement":"External content retrieved by agentic AI applications is treated as untrusted data throughout processing, is clearly delimited from system instructions, is subject to validation and sanitisation measures applied to other untrusted input, remains untrusted following such processing, and is prevented from modifying or overriding system instructions, security policies, access controls, tool permissions or human approval requirements.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Artificial intelligence application development","Excessive agency"]},"latticework_interpretation":null},{"id":"ISM-2159","url":"https://latticeworksystems.com.au/ism/ism-2159/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2159.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2159.md","official":{"statement":"All tool invocations, external requests and outputs generated by agentic AI applications are centrally logged with sufficient detail to support cyber security incident investigations.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for software development","Artificial intelligence application development","Excessive agency"]},"latticework_interpretation":null},{"id":"ISM-2160","url":"https://latticeworksystems.com.au/ism/ism-2160/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2160.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2160.md","official":{"statement":"Networked management interfaces for IT equipment are only accessible from a dedicated management network that is segregated from the wider network and the internet.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Networked management interfaces"]},"latticework_interpretation":null},{"id":"ISM-2161","url":"https://latticeworksystems.com.au/ism/ism-2161/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2161.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2161.md","official":{"statement":"The integrity of network device firmware and running configurations is verified against an approved known-good baseline following patching, on detection of anomalous behaviour and at least monthly.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Network device integrity"]},"latticework_interpretation":null},{"id":"ISM-2162","url":"https://latticeworksystems.com.au/ism/ism-2162/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2162.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2162.md","official":{"statement":"Unneeded components, services and functionality of network devices are disabled or removed.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Network design and configuration","Network device hardening"]},"latticework_interpretation":null},{"id":"ISM-2163","url":"https://latticeworksystems.com.au/ism/ism-2163/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2163.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2163.md","official":{"statement":"When using MACsec, confidentiality protection mode is enabled using GCM-AES-128, GCM-AES-256, GCM-AES-XPN-128 or GCM-AES-XPN-256, preferably GCM-AES-256 or GCM-AES-XPN-256.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Wired networks","Media Access Control Security"]},"latticework_interpretation":null},{"id":"ISM-2164","url":"https://latticeworksystems.com.au/ism/ism-2164/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2164.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2164.md","official":{"statement":"A connectivity association lifetime of less than 24 hours (86400 seconds) is used for MACsec connections.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Wired networks","Media Access Control Security"]},"latticework_interpretation":null},{"id":"ISM-2165","url":"https://latticeworksystems.com.au/ism/ism-2165/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2165.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2165.md","official":{"statement":"When using EAP-TLS, each device performs a fresh EAP-TLS authentication each time a new Connectivity Association Key is required.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Wired networks","Media Access Control Security"]},"latticework_interpretation":null},{"id":"ISM-2166","url":"https://latticeworksystems.com.au/ism/ism-2166/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2166.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2166.md","official":{"statement":"A secure association lifetime of less than four hours (14400 seconds) is used for MACsec connections.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Wired networks","Media Access Control Security"]},"latticework_interpretation":null},{"id":"ISM-2167","url":"https://latticeworksystems.com.au/ism/ism-2167/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2167.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2167.md","official":{"statement":"The use of a Pre-Shared Key as a fallback authentication method for MACsec is disabled.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for networking","Wired networks","Media Access Control Security"]},"latticework_interpretation":null}]}