Guidelines for database systems
13 controls · September 2026 edition
- ISM-0393 · Protecting database contents
Databases and their contents are classified based on the sensitivity or classification of data that they contain.
- ISM-1243 · Database register
A database register is developed, implemented, maintained and regularly verified.
- ISM-1255 · Protecting database contents
Database users’ ability to access, insert, modify and remove database contents is restricted based on their duties or functions.
- ISM-1256 · Protecting databases
File-based access controls are applied to database files.
- ISM-1268 · Protecting database contents
The need-to-know principle is enforced for database contents through the application of minimum privileges, database views, database roles and data tokenisation.
- ISM-1269 · Functional separation between database servers and web servers
Database servers and web servers are functionally separated.
- ISM-1270 · Network environment
Database servers are placed on a different network segment to workstations.
- ISM-1271 · Network environment
Network access controls are implemented to restrict database server communications to strictly defined network resources that require access to the database server.
- ISM-1272 · Network environment
If only local access to a database is required, networking functionality of database management system applications is disabled or directed to listen solely to the localhost interface.
- ISM-1273 · Segregation of development, testing, staging and production database servers
Database servers for development, testing, staging and production environments are segregated.
- ISM-1274 · Segregation of development, testing, staging and production databases
Database contents from production environments are not used in non-production environments unless the non-production environment is secured to at least the same level as the production environment.
- ISM-1277 · Communications between database servers and web servers
Data communicated between database servers and web servers is encrypted using Australian Signals Directorate-approved cryptography.
- ISM-1537 · Database event logging
Security-relevant events for databases are centrally logged, including:
Official control wording and applicability: Australian Signals Directorate, © Commonwealth of Australia 2026. September 2026 ISM, OSCAL v2026.09.4, reproduced under CC BY 4.0. Formatting is adapted for this website.
Latticework Systems’ implementation guidance is our interpretation. Provenance and scope.