ISM control lookup / Topic

Guidelines for security assurance

36 controls · September 2026 edition

• ISM-0109 · Event log monitoring

  Event logs from workstations are analysed in a timely manner to detect cyber security events.

• ISM-0120 · Event log monitoring

  Cyber security personnel have access to sufficient tools to facilitate the detection of cyber security events and the identification of cyber security incidents.

• ISM-0580 · Security monitoring policy

  A security monitoring policy is developed, implemented and maintained.

• ISM-0585 · Event log details

  For each event logged, the date and time of the event, the relevant user or process, the relevant filename, the event description, and the information technology equipment involved are captured.

• ISM-0988 · Centralised event logging facility

  An accurate and consistent time source is used for event logging.

• ISM-1228 · Event log monitoring

  Cyber security events are analysed in a timely manner to identify cyber security incidents.

• ISM-1405 · Centralised event logging facility

  A centralised event logging facility is implemented.

• ISM-1698 · Vulnerability scanning

  A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online services.

• ISM-1699 · Vulnerability scanning

  A vulnerability scanner is used at least weekly to identify missing patches or updates for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products.

• ISM-1700 · Vulnerability scanning

  A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in applications other than office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products.

• ISM-1701 · Vulnerability scanning

  A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices.

• ISM-1702 · Vulnerability scanning

  A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices.

• ISM-1703 · Vulnerability scanning

  A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in drivers.

• ISM-1752 · Vulnerability scanning

  A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of IT equipment other than workstations, servers and network devices.

• ISM-1807 · Vulnerability scanning

  An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activities.

• ISM-1808 · Vulnerability scanning

  A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities.

• ISM-1815 · Centralised event logging facility

  Event logs are protected from unauthorised modification and deletion.

• ISM-1900 · Vulnerability scanning

  A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in firmware.

• ISM-1906 · Event log monitoring

  Event logs from internet-facing servers are analysed in a timely manner to detect cyber security events.

• ISM-1907 · Event log monitoring

  Event logs from non-internet-facing servers are analysed in a timely manner to detect cyber security events.

• ISM-1921 · Vulnerability scanning

  The likelihood of system compromise is frequently assessed when working exploits exist for unmitigated vulnerabilities.

• ISM-1959 · Event log details

  To the extent possible, event logs are captured and stored in a consistent and structured format.

• ISM-1960 · Event log monitoring

  Event logs from internet-facing network devices are analysed in a timely manner to detect cyber security events.

• ISM-1961 · Event log monitoring

  Event logs from non-internet-facing network devices are analysed in a timely manner to detect cyber security events.

• ISM-1983 · Centralised event logging facility

  Event logs sent to a centralised event logging facility are sent as soon as possible after they occur.

• ISM-1984 · Centralised event logging facility

  Event logs sent to a centralised event logging facility are encrypted in transit using Australian Signals Directorate (ASD)-approved cryptography.

• ISM-1985 · Centralised event logging facility

  Event logs are protected from unauthorised access.

• ISM-1986 · Event log monitoring

  Event logs from critical servers are analysed in a timely manner to detect cyber security events.

• ISM-1987 · Event log monitoring

  Event logs from security products are analysed in a timely manner to detect cyber security events.

• ISM-1988 · Event log retention

  Event logs are retained in a searchable manner for at least 12 months.

• ISM-1989 · Event log retention

  Event logs are retained as per minimum retention requirements for various classes of records as set out by the National Archives of Australia’s Administrative Functions Disposal Authority Express (AFDA Express) Version 2 publication.

• ISM-2116 · Event log monitoring

  Cyber threat intelligence services are used to support the detection of cyber security events and the identification of cyber security incidents.

• ISM-2117 · Event log monitoring

  Suitable AI models are used to augment the detection of cyber security events and the identification of cyber security incidents.

• ISM-2118 · Vulnerability assessments and penetration tests

  Vulnerability assessments and penetration tests are conducted for systems prior to their deployment, including prior to the deployment of significant changes, and at least every six months thereafter.

• ISM-2119 · Vulnerability assessments and penetration tests

  Suitable AI models are used to augment vulnerability assessments and penetration tests.

• ISM-2153 · Threat hunting

  Threat hunting activities, informed by current strategic and sector-specific cyber threat intelligence, are conducted at least every three months.