{"schema_version":"1.0.0","snapshot":{"edition":"September 2026","release":"2026.09.4","oscal_version":"1.1.2","verified_at":"2026-10-25T23:08:12.459Z","official_metadata":{"title":"Information security manual","published":"2026-09-03T23:10:47.63884244Z","last_modified":"2026-09-03T23:10:47.63884244Z","version":"2026.09.4","oscal_version":"1.1.2"},"source":{"release_url":"https://www.cyber.gov.au/ism/oscal/v2026.09.4","catalogue_url":"https://www.cyber.gov.au/ism/oscal/v2026.09.4/artifacts/ISM_catalog.json","catalogue_sha256":"237ea09362b8449ed5c5ee85de4725a0468ee73d13af7cf61c26d4e6ac47f12d","mapping_repository":"https://github.com/Latticework-Systems/ism-kubernetes-controls","mapping_revision":"07b348a2952bf2d0e78d9e739f367cb0919ab888","mapping_url":"https://github.com/Latticework-Systems/ism-kubernetes-controls/blob/07b348a2952bf2d0e78d9e739f367cb0919ab888/mapping/ism-mapping.yaml","mapping_sha256":"f823681fd71e40e589aae714ef2215dd8dc33722a1ec70b81ded5b2322937470","files":[{"name":"ISM_catalog.json","url":"https://www.cyber.gov.au/ism/oscal/v2026.09.4/artifacts/ISM_catalog.json","sha256":"237ea09362b8449ed5c5ee85de4725a0468ee73d13af7cf61c26d4e6ac47f12d","bytes":2677748},{"name":"oscal_catalog_schema.json","url":"https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_catalog_schema.json","sha256":"5b069afa4f4ecc38d59914dab56098566d4247d3578a2123c030c80d36fc5104","bytes":43204},{"name":"ism-mapping.yaml","url":"https://raw.githubusercontent.com/Latticework-Systems/ism-kubernetes-controls/07b348a2952bf2d0e78d9e739f367cb0919ab888/mapping/ism-mapping.yaml","sha256":"f823681fd71e40e589aae714ef2215dd8dc33722a1ec70b81ded5b2322937470","bytes":33980},{"name":"provenance.lock.yaml","url":"https://raw.githubusercontent.com/Latticework-Systems/ism-kubernetes-controls/07b348a2952bf2d0e78d9e739f367cb0919ab888/mapping/provenance.lock.yaml","sha256":"dc88daab6ccc873e5e0cdb37aad248d0293081672bbc2f4e1dc6b39ec1a16b25","bytes":2695},{"name":"mapping.json","url":null,"sha256":"250ed4b3dff4a85cab6c18af1726a55ba8cbf41fbbf62e7b5a9716a4c7213c13","bytes":50905},{"name":"mapping-LICENSE","url":"https://raw.githubusercontent.com/Latticework-Systems/ism-kubernetes-controls/07b348a2952bf2d0e78d9e739f367cb0919ab888/LICENSE","sha256":"1b2611d91f59eb4032aaf8c702c16e97629124ea4ab7fe2f9f249fc873d95f33","bytes":9109}]},"rights":{"official":{"attribution":"Australian Signals Directorate, © Commonwealth of Australia 2026","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","conditions_url":"https://www.cyber.gov.au/copyright","repository_notice_url":"https://github.com/AustralianCyberSecurityCentre/ism-oscal/blob/main/README.md","changes":"Statements retain the pinned OSCAL prose verbatim. Metadata is reorganised into this interface. Markdown adds headings, links and attribution. Latticework interpretation is separately labelled. The raw OSCAL metadata has no embedded licence fields; licence provenance comes from ASD’s website and official repository notices."},"mapping":{"attribution":"Latticework Systems — ism-kubernetes-controls","license":"Apache-2.0","license_url":"https://github.com/Latticework-Systems/ism-kubernetes-controls/blob/07b348a2952bf2d0e78d9e739f367cb0919ab888/LICENSE","note":"Applies to copied mapping evidence notes, checks and responsibility allocations. It does not apply to ASD’s control wording, which remains CC BY 4.0."},"editorial":{"attribution":"Latticework Systems","license":null,"note":"Original implementation and evidence suggestions are Latticework interpretation. Public retrieval does not assign a new licence to that editorial content.","content_preference":{"search":"yes","ai_input":"yes","ai_train":"no","scope":"Advisory preference for original Latticework editorial material only. It does not restrict ASD CC BY material or third-party mapping licences, assign a new licence, or guarantee enforcement or the absence of provider logs."}}}},"scope_note":"A pinned reference snapshot, not a compliance assessment. All implementation mappings are partial. Null interpretation means no reviewed guide is published; it does not mean compliant, not applicable or no evidence required. No IRAP certification or DISP membership is conferred.","resource_type":"control","control":{"id":"ISM-2143","url":"https://latticeworksystems.com.au/ism/ism-2143/","json_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2143.json","markdown_url":"https://latticeworksystems.com.au/ism/api/v1/controls/ism-2143.md","official":{"statement":"Applications and workloads use unique credentials that are not shared with other applications or workloads, or across development, testing, staging and production environments.","statement_format":"OSCAL markup-multiline","revision":"0","updated":"Sep-26","applicability":["NC","OS","P","S","TS"],"essential_eight_applicability":[],"section_path":["Guidelines for system access","Credential management","Application and workload credentials"]},"latticework_interpretation":{"title":"Inspect credential issuance, lifetime and sharing","implementation_steps":["Inventory workload and service identities, including credentials held outside Kubernetes. Prefer short-lived projected or dynamically issued credentials and explicitly set the intended audience.","Review legacy service-account token Secrets, default ServiceAccount use and credential sharing across workloads/environments. Test admission policies before rollout; assess existing credentials separately."],"evidence_to_retain":["Keep an identity-to-workload/environment inventory, credential issuer configuration, token lifetime/audience evidence and revocation/rotation records without recording secret values.","Keep policy configuration and admission results, plus a separate existing-credential review. Demonstrate uniqueness and dynamic issuance directly; non-default account names do not establish either."],"responsibility_boundary":"Platform team: token issuer and admission configuration. Workload team: identity allocation and application secrets. Organisation: credential policy, break-glass custody and access reviews.","checks":[{"engine":"kubescape","name":"ism-default-service-accounts"},{"engine":"kyverno","name":"ism-privileged-access-mutate-default-sa"},{"engine":"kyverno","name":"ism-privileged-access-require-dedicated-sa"}],"coverage":"partial","limitations":"Kubescape findings show that scanned namespaces include a non-default ServiceAccount and that the default ServiceAccount disables token automount. Kyverno PolicyReports provide admission-time evidence for the corresponding policies. Neither proves that each workload uses its own account or that credentials are unique across workloads and environments, or says anything about credentials held outside Kubernetes service accounts.","responsibility_allocation":{"eks":"customer-workload","self-managed":"customer-workload","source":"provisional","notes":"Provisional allocation for the detector evidence only. No provider inheritance or whole-control ownership is established until an authorised CSCM and the engagement boundary are reviewed."},"mapping_source":{"repository":"https://github.com/Latticework-Systems/ism-kubernetes-controls","revision":"07b348a2952bf2d0e78d9e739f367cb0919ab888","url":"https://github.com/Latticework-Systems/ism-kubernetes-controls/blob/07b348a2952bf2d0e78d9e739f367cb0919ab888/mapping/ism-mapping.yaml","sha256":"f823681fd71e40e589aae714ef2215dd8dc33722a1ec70b81ded5b2322937470"}}}}