ISM control lookup / Topic

Guidelines for system management

61 controls · September 2026 edition

• ISM-0042 · System administration processes and procedures

  System administration processes, and supporting system administration procedures, are developed, implemented and maintained.

• ISM-0298 · Patch management processes and procedures

  A centralised and managed approach that maintains the integrity of patches or updates, and confirms that they have been applied successfully, is used to patch or update applications, operating systems, drivers and firmware.

• ISM-0300 · Mitigating known vulnerabilities

  Patches, updates or other vendor mitigations for vulnerabilities in high assurance IT equipment are applied only when approved by ASD, and in doing so, using methods and timeframes prescribed by ASD.

• ISM-0304 · Cessation of support

  Applications other than office productivity suites, web browsers and their extensions, email clients, PDF applications, Adobe Flash Player, and security products that are no longer supported by vendors are removed.

• ISM-1143 · Patch management processes and procedures

  Patch management processes, and supporting patch management procedures, are developed, implemented and maintained.

• ISM-1211 · System administration processes and procedures

  System administration activities are performed in accordance with the system’s change and configuration management plan.

• ISM-1380 · Separate privileged operating environments

  Privileged human users use separate privileged and unprivileged operating environments.

• ISM-1385 · Administrative infrastructure

  Administrative infrastructure is segregated from the wider network and the internet.

• ISM-1386 · Administrative infrastructure

  Network management traffic can only originate from administrative infrastructure.

• ISM-1387 · Administrative infrastructure

  Administrative activities are conducted through jump servers.

• ISM-1493 · Software registers

  Software registers for workstations, servers, network devices and networked IT equipment are developed, implemented, maintained and regularly verified.

• ISM-1501 · Cessation of support

  Operating systems that are no longer supported by vendors are replaced.

• ISM-1510 · Digital preservation policy

  A digital preservation policy is developed, implemented and maintained.

• ISM-1511 · Performing and retaining backups

  Backups of data, applications and settings are performed and retained in accordance with business criticality and business continuity requirements.

• ISM-1515 · Testing restoration of backups

  Restoration of data, applications and settings from backups to a common point in time is tested as part of disaster recovery exercises.

• ISM-1547 · Data backup and restoration processes and procedures

  Data backup processes, and supporting data backup procedures, are developed, implemented and maintained.

• ISM-1548 · Data backup and restoration processes and procedures

  Data restoration processes, and supporting data restoration procedures, are developed, implemented and maintained.

• ISM-1643 · Software registers

  Software registers contain versions and patch histories of applications, drivers, operating systems and firmware.

• ISM-1687 · Separate privileged operating environments

  Privileged operating environments are not virtualised within unprivileged operating environments.

• ISM-1688 · Separate privileged operating environments

  Unprivileged user accounts cannot be used to log on to privileged operating environments.

• ISM-1689 · Separate privileged operating environments

  Privileged user accounts (excluding local administrator accounts) cannot be used to log on to unprivileged operating environments.

• ISM-1690 · Mitigating known vulnerabilities

  Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.

• ISM-1691 · Mitigating known vulnerabilities

  Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release.

• ISM-1692 · Mitigating known vulnerabilities

  Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.

• ISM-1693 · Mitigating known vulnerabilities

  Patches, updates or other vendor mitigations for vulnerabilities in applications other than office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within one month of release.

• ISM-1694 · Mitigating known vulnerabilities

  Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.

• ISM-1695 · Mitigating known vulnerabilities

  Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release.

• ISM-1696 · Mitigating known vulnerabilities

  Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.

• ISM-1697 · Mitigating known vulnerabilities

  Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.

• ISM-1704 · Cessation of support

  Office productivity suites, web browsers and their extensions, email clients, PDF applications, Adobe Flash Player, and security products that are no longer supported by vendors are removed.

• ISM-1705 · Backup access

  Privileged user accounts (excluding backup administrator accounts) cannot access backups belonging to other user accounts.

• ISM-1706 · Backup access

  Privileged user accounts (excluding backup administrator accounts) cannot access their own backups.

• ISM-1707 · Backup modification and deletion

  Privileged user accounts (excluding backup administrator accounts) are prevented from modifying and deleting backups.

• ISM-1708 · Backup modification and deletion

  Backup administrator accounts are prevented from modifying and deleting backups during their retention period.

• ISM-1750 · Administrative infrastructure

  Administrative infrastructure for critical servers, high-value servers and regular servers is segregated from each other.

• ISM-1751 · Mitigating known vulnerabilities

  Patches, updates or other vendor mitigations for vulnerabilities in operating systems of IT equipment other than workstations, servers and network devices are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.

• ISM-1753 · Cessation of support

  Internet-facing network devices that are no longer supported by vendors are replaced.

• ISM-1809 · Cessation of support

  When applications, operating systems, network devices or networked IT equipment that are no longer supported by vendors cannot be immediately removed or replaced, compensating security controls are implemented until such time that they can be removed or replaced.

• ISM-1810 · Performing and retaining backups

  Backups of data, applications and settings are synchronised to enable restoration to a common point in time.

• ISM-1811 · Performing and retaining backups

  Backups of data, applications and settings are retained in a secure and resilient manner.

• ISM-1812 · Backup access

  Unprivileged user accounts cannot access backups belonging to other user accounts.

• ISM-1813 · Backup access

  Unprivileged user accounts cannot access their own backups.

• ISM-1814 · Backup modification and deletion

  Unprivileged user accounts are prevented from modifying and deleting backups.

• ISM-1876 · Mitigating known vulnerabilities

  Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.

• ISM-1877 · Mitigating known vulnerabilities

  Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.

• ISM-1878 · Mitigating known vulnerabilities

  Patches, updates or other vendor mitigations for vulnerabilities in operating systems of IT equipment other than workstations, servers and network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.

• ISM-1879 · Mitigating known vulnerabilities

  Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.

• ISM-1898 · Separate privileged operating environments

  Secure Admin Workstations are used in the performance of administrative activities.

• ISM-1899 · Administrative infrastructure

  Network devices that do not belong to administrative infrastructure cannot initiate connections with administrative infrastructure.

• ISM-1901 · Mitigating known vulnerabilities

  Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.

• ISM-1902 · Mitigating known vulnerabilities

  Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.

• ISM-1903 · Mitigating known vulnerabilities

  Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.

• ISM-1904 · Mitigating known vulnerabilities

  Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.

• ISM-1905 · Cessation of support

  Online services that are no longer supported by vendors are removed.

• ISM-1958 · Separate privileged operating environments

  User accounts with DCSync permissions cannot be used to log on to unprivileged operating environments.

• ISM-1981 · Cessation of support

  Non-internet-facing network devices that are no longer supported by vendors are replaced.

• ISM-1982 · Cessation of support

  Networked IT equipment that is no longer supported by vendors is replaced.

• ISM-2149 · Administrative tools

  A list of authorised RMM tools and remote access tools is developed, enforced and maintained.

• ISM-2150 · Administrative tools

  Network connections for unauthorised RMM tools and remote access tools are blocked at gateways.

• ISM-2151 · Backup modification and deletion

  Backups are stored using a technically enforced immutability mechanism that prevents their modification or deletion for the duration of their retention period.

• ISM-2152 · Backup modification and deletion

  Backup infrastructure, including backup servers, repositories and management consoles, is segregated from production environments and uses a separate authentication mechanism for administrative access.