// provenance

Sources, edition and scope

This lookup contains 1,143 numbered ISM controls across 23 topics from ASD’s September 2026 ISM, OSCAL v2026.09.4. Its declared OSCAL schema version is 1.1.2. The 49 framework principles in the source are outside this numbered-control lookup.

The official release listing was checked on 2026-10-25 and listed v2026.09.4 first. This is a pinned snapshot. Updates are reviewed before the current pages change; check ASD’s current edition for your assessment.

Authority and provenance

• ISM_catalog.json (2,677,748 bytes)SHA-256: 237ea09362b8449ed5c5ee85de4725a0468ee73d13af7cf61c26d4e6ac47f12d
• oscal_catalog_schema.json (43,204 bytes)SHA-256: 5b069afa4f4ecc38d59914dab56098566d4247d3578a2123c030c80d36fc5104
• ism-mapping.yaml (33,980 bytes)SHA-256: f823681fd71e40e589aae714ef2215dd8dc33722a1ec70b81ded5b2322937470
• provenance.lock.yaml (2,695 bytes)SHA-256: dc88daab6ccc873e5e0cdb37aad248d0293081672bbc2f4e1dc6b39ec1a16b25
• mapping-LICENSE (9,109 bytes)SHA-256: 1b2611d91f59eb4032aaf8c702c16e97629124ea4ab7fe2f9f249fc873d95f33

The complete official catalogue and NIST OSCAL 1.1.2 schema are preserved unchanged in the source repository. The lookup extracts each control’s statement, chapter path, revision, updated date and ASD applicability properties. Website headings come from the catalogue’s section titles; they are not new ASD control titles. Line breaks and escaped brackets are formatted for reading; wording is retained.

NIST’s OSCAL 1.1.2 catalogue model reference describes the source structure. The pinned catalogue validates against that schema.

Implementation guidance

The 23 guides use Latticework Systems’ public ISM Kubernetes controls mapping at 07b348a. The pinned mapping’s statements match this catalogue and all mappings declare partial coverage. Its responsibility allocation is provisional.

Implementation and evidence steps are Latticework’s interpretation. The mapping’s checks, evidence notes and responsibility allocations are Latticework’s original work, reproduced under the repository’s Apache-2.0 licence; the original licence is retained with the source. That licence does not apply to ASD’s control wording, which remains under CC BY 4.0 wherever it appears, including in the mapping file. The lookup does not install policies, run scans or collect system evidence.

Reuse and attribution

Official control wording and applicability are attributed to the Australian Signals Directorate, © Commonwealth of Australia 2026, under CC BY 4.0. See ASD’s copyright conditions and exclusions. No ASD logo or Commonwealth Coat of Arms is used. No ISO standard text is reproduced.