// requirements → implementation → evidence
ISM implementation guides
23 guides grounded in a pinned public mapping. Each pairs implementation suggestions with evidence to retain and the specific limits of the mapped checks.
Every mapping is partial. Kubernetes manifests, admission policies and scanner findings can support an assessment, but cannot prove that a whole ISM control is met. These guides confer no full-control compliance or IRAP certification.
Responsibility must be agreed across the platform, workload and organisation. Managed cloud services do not automatically establish inherited controls; review the provider’s applicable evidence and your system boundary.
- ISM-1182 · Network access controlsRestrict workload traffic and test the actual pathPartial coverage · implementation steps + evidence checklist
- ISM-1246 · Hardening server application configurationsSet and verify workload isolation defaultsPartial coverage · implementation steps + evidence checklist
- ISM-1416 · Software firewallRestrict workload traffic and test the actual pathPartial coverage · implementation steps + evidence checklist
- ISM-1490 · Application controlReview approved images and execution pathsPartial coverage · implementation steps + evidence checklist
- ISM-1501 · Cessation of supportTrack support and patch evidence for every operating-system layerPartial coverage · implementation steps + evidence checklist
- ISM-1511 · Performing and retaining backupsConnect declared backup coverage to a tested recoveryPartial coverage · implementation steps + evidence checklist
- ISM-1604 · Functional separation between operating environmentsSet and verify workload isolation defaultsPartial coverage · implementation steps + evidence checklist
- ISM-1657 · Application controlReview approved images and execution pathsPartial coverage · implementation steps + evidence checklist
- ISM-1685 · Setting credentials for built-in Administrator accounts, break glass accounts, local administrator accounts and service accountsInspect credential issuance, lifetime and sharingPartial coverage · implementation steps + evidence checklist
- ISM-1690 · Mitigating known vulnerabilitiesConnect image admission metadata to a real remediation timelinePartial coverage · implementation steps + evidence checklist
- ISM-1693 · Mitigating known vulnerabilitiesConnect image admission metadata to a real remediation timelinePartial coverage · implementation steps + evidence checklist
- ISM-1694 · Mitigating known vulnerabilitiesTrack support and patch evidence for every operating-system layerPartial coverage · implementation steps + evidence checklist
- ISM-1695 · Mitigating known vulnerabilitiesTrack support and patch evidence for every operating-system layerPartial coverage · implementation steps + evidence checklist
- ISM-1698 · Vulnerability scanningProve scanner freshness and cadence outside admission labelsPartial coverage · implementation steps + evidence checklist
- ISM-1700 · Vulnerability scanningProve scanner freshness and cadence outside admission labelsPartial coverage · implementation steps + evidence checklist
- ISM-1808 · Vulnerability scanningProve scanner freshness and cadence outside admission labelsPartial coverage · implementation steps + evidence checklist
- ISM-1871 · Application controlReview approved images and execution pathsPartial coverage · implementation steps + evidence checklist
- ISM-1876 · Mitigating known vulnerabilitiesConnect image admission metadata to a real remediation timelinePartial coverage · implementation steps + evidence checklist
- ISM-1877 · Mitigating known vulnerabilitiesTrack support and patch evidence for every operating-system layerPartial coverage · implementation steps + evidence checklist
- ISM-1883 · Privileged access to systemsReview privileged human access against dutiesPartial coverage · implementation steps + evidence checklist
- ISM-2128 · Hardening operating system configurationsSet and verify workload isolation defaultsPartial coverage · implementation steps + evidence checklist
- ISM-2141 · Application and workload credentialsInspect credential issuance, lifetime and sharingPartial coverage · implementation steps + evidence checklist
- ISM-2143 · Application and workload credentialsInspect credential issuance, lifetime and sharingPartial coverage · implementation steps + evidence checklist
Coverage gaps
The other 1120 controls have reference pages only. Cloud-provider configuration, human access, organisational processes and runtime effectiveness need evidence beyond these detectors. New September requirements for credential revocation, backup immutability, reproducible builds and AI agent behaviour are not inferred from generic manifest checks.
For example, ISM-1405 has an official reference page, but no guide in this bounded set. The absence of a mapped finding means no conclusion about the control.
Official control wording and applicability: Australian Signals Directorate, © Commonwealth of Australia 2026. September 2026 ISM, OSCAL v2026.09.4, reproduced under CC BY 4.0. Formatting is adapted for this website.
Latticework Systems’ implementation guidance is our interpretation. Provenance and scope.
Need ISM evidence from your Kubernetes platform?
Tell us which controls your assessor is asking about. We'll work out what your cluster can show and what has to come from somewhere else.
Book a free discovery call →