ASD ISM — incremental change analysis

Release v2022.12.1 (2022-12-01) vs prior v2022.09.15 · 77 days · catalogue 850 controls · ALL-era (NC imputed)

ASD changes summary: not available online (pre-June-2024 or errata release)

Added

Substantive

Clarification

Editorial

Relocated

Scope changes

Removed

1 · Change typology

2 · Classification footprint

Ceiling (highest level reached) / Floor (lowest level reached) — material changes

Level	as ceiling	as floor
TOP SECRET	47	0
SECRET	0	2
PROTECTED	0	0
OFFICIAL: Sensitive	0	0
Non-Classified	0	45

3 · Level-specific material changes

Footprint	Floor	Ceiling	Controls
`S\|TS`	SECRET	TOP SECRET	ISM-0669 ISM-1776

4 · Change location by chapter

5 · Section / topic structure

New sections: 0 · Removed sections: 0 · New topics: 8 · Removed topics: 7. Keyed on case/spelling-normalised chapter › section › topic, so cosmetic retitles do not appear here.

New topics

Chapter	Section	Topic	Controls	Control IDs
Guidelines for Communications Systems	Video conferencing and Internet Protocol telephony	Denial of service response plan	2	ISM-1019 ISM-1805
Guidelines for Networking	Network design and configuration	Default accounts and credentials for network devices	1	ISM-1304
Guidelines for Procurement and Outsourcing	Cyber supply chain risk management	Sourcing applications, ICT equipment and services	3	ISM-1787 ISM-1788 ISM-1789
Guidelines for Procurement and Outsourcing	Managed services and cloud services	Contractual security requirements with service providers	12	ISM-1395 ISM-0072 ISM-1571 ISM-1738 ISM-1804 ISM-0141 ISM-1794 ISM-1451 ISM-1572 ISM-1573 ISM-1574 ISM-1575
Guidelines for Software Development	Web application development	Web application programming interfaces	2	ISM-1817 ISM-1818
Guidelines for System Management	Data backup and restoration	Backup access	4	ISM-1812 ISM-1813 ISM-1705 ISM-1706
Guidelines for System Management	Data backup and restoration	Backup modification and deletion	3	ISM-1814 ISM-1707 ISM-1708
Guidelines for System Monitoring	Event logging and monitoring	Centralised event logging facility	3	ISM-1405 ISM-1815 ISM-0988

Removed topics

Chapter	Section	Topic
Guidelines for Communications Systems	Video conferencing and Internet Protocol telephony	Developing a denial of service response plan
Guidelines for Networking	Network design and configuration	Default accounts for network devices
Guidelines for Procurement and Outsourcing	Cyber supply chain risk management	Purchasing of applications, ICT equipment and services
Guidelines for Procurement and Outsourcing	Managed services and cloud services	Contractual security requirements
Guidelines for System Hardening	Authentication hardening	Setting credentials for service accounts
Guidelines for System Management	Data backup and restoration	Backup access and modification
Guidelines for System Monitoring	Event logging and monitoring	Event logging facility

Changes by section (this release)

Chapter	Section	Added	Substantive	Clarification	Editorial	Total
Guidelines for Procurement and Outsourcing	Managed services and cloud services	1	0	13	0	14
Guidelines for System Management	Data backup and restoration	5	3	6	0	14
Guidelines for System Hardening	Operating system hardening	0	5	2	3	10
Guidelines for System Hardening	Authentication hardening	0	3	0	3	6
Guidelines for Personnel Security	Access to systems and their resources	0	6	0	0	6
Guidelines for Procurement and Outsourcing	Cyber supply chain risk management	0	0	5	1	6
Guidelines for System Management	System patching	3	0	2	0	5
Guidelines for Cyber Security Incidents	Managing cyber security incidents	1	2	1	0	4
Guidelines for Networking	Network design and configuration	0	3	1	0	4
Guidelines for Enterprise Mobility	Mobile device usage	0	1	2	1	4
Guidelines for System Hardening	Application hardening	1	1	0	1	3
Guidelines for System Monitoring	Event logging and monitoring	1	0	2	0	3
Guidelines for Software Development	Application development	1	0	2	0	3
Guidelines for Software Development	Web application development	2	1	0	0	3
Guidelines for Communications Infrastructure	Cabling infrastructure	0	0	3	0	3
Guidelines for Data Transfers	Data transfers	0	1	2	0	3
Guidelines for Media	Media usage	0	0	3	0	3
Guidelines for Communications Systems	Video conferencing and Internet Protocol telephony	1	1	0	0	2
Guidelines for Gateways	Web proxies	0	1	1	0	2
Guidelines for ICT Equipment	ICT equipment sanitisation and destruction	0	0	2	0	2
Guidelines for ICT Equipment	ICT equipment usage	0	0	2	0	2
Guidelines for Cyber Security Roles	Chief Information Security Officer	0	0	2	0	2
Guidelines for Database Systems	Databases	0	1	1	0	2
Guidelines for Security Documentation	Development and maintenance of security documentation	0	0	1	0	1
Guidelines for System Management	System administration	0	0	1	0	1
Guidelines for Email	Email usage	0	0	1	0	1
Guidelines for Media	Media sanitisation	0	0	1	0	1
Guidelines for Media	Media destruction	0	0	1	0	1
Guidelines for Media	Media disposal	0	0	1	0	1
Guidelines for Cryptography	Cryptographic fundamentals	0	0	1	0	1
Guidelines for Communications Systems	Fax machines and multifunction devices	0	0	1	0	1
Guidelines for Gateways	Web content filters	0	0	1	0	1
Guidelines for Communications Systems	Telephone systems	0	0	1	0	1
Guidelines for Email	Email gateways and servers	0	0	1	0	1
Guidelines for Enterprise Mobility	Mobile device management	0	0	1	0	1
Guidelines for Physical Security	Facilities and systems	0	0	1	0	1
Guidelines for ICT Equipment	ICT equipment disposal	0	0	1	0	1
Guidelines for Gateways	Gateways	0	1	0	0	1
Guidelines for Gateways	Cross Domain Solutions	0	1	0	0	1

Changes by topic (this release)

Chapter	Section	Topic	Added	Substantive	Clarification	Editorial	Total
Guidelines for Procurement and Outsourcing	Managed services and cloud services	Contractual security requirements with service providers	1	0	11	0	12
Guidelines for System Management	Data backup and restoration	Backup access	2	1	1	0	4
Guidelines for Personnel Security	Access to systems and their resources	Privileged access to systems	0	4	0	0	4
Guidelines for System Hardening	Operating system hardening	Application control	0	1	0	3	4
Guidelines for System Management	Data backup and restoration	Performing and retaining backups	2	0	1	0	3
Guidelines for System Management	Data backup and restoration	Backup modification and deletion	1	1	1	0	3
Guidelines for Procurement and Outsourcing	Cyber supply chain risk management	Sourcing applications, ICT equipment and services	0	0	2	1	3
Guidelines for Cyber Security Incidents	Managing cyber security incidents	Cyber security incident register	1	1	0	0	2
Guidelines for Communications Systems	Video conferencing and Internet Protocol telephony	Denial of service response plan	1	1	0	0	2
Guidelines for System Management	System patching	Scanning for missing patches or updates	2	0	0	0	2
Guidelines for System Monitoring	Event logging and monitoring	Centralised event logging facility	1	0	1	0	2
Guidelines for Software Development	Web application development	Web application programming interfaces	2	0	0	0	2
Guidelines for System Hardening	Authentication hardening	Protecting credentials	0	1	0	1	2
Guidelines for Data Transfers	Data transfers	Data transfer processes and procedures	0	0	2	0	2
Guidelines for Enterprise Mobility	Mobile device usage	After travelling overseas with mobile devices	0	1	0	1	2
Guidelines for System Hardening	Operating system hardening	Operating system releases and versions	0	1	1	0	2
Guidelines for System Management	Data backup and restoration	Data backup and restoration processes and procedures	0	0	2	0	2
Guidelines for System Hardening	Operating system hardening	PowerShell	0	1	1	0	2
Guidelines for System Hardening	Application hardening	Microsoft Office macros	0	1	0	1	2
Guidelines for System Hardening	Authentication hardening	Multi-factor authentication	0	1	0	1	2
Guidelines for Software Development	Application development	Vulnerability disclosure program	0	0	2	0	2
Guidelines for Procurement and Outsourcing	Cyber supply chain risk management	Supplier relationship management	0	0	2	0	2
Guidelines for System Hardening	Application hardening	Hardening application configurations	1	0	0	0	1
Guidelines for System Management	System patching	Cessation of support	1	0	0	0	1
Guidelines for Software Development	Application development	Development, testing and production environments	1	0	0	0	1
Guidelines for Security Documentation	Development and maintenance of security documentation	Cyber security strategy	0	0	1	0	1
Guidelines for System Management	System administration	System administration processes and procedures	0	0	1	0	1
Guidelines for Communications Infrastructure	Cabling infrastructure	Cable labelling processes and procedures	0	0	1	0	1
Guidelines for Communications Infrastructure	Cabling infrastructure	Cable register	0	0	1	0	1
Guidelines for Gateways	Web proxies	Web usage policy	0	0	1	0	1
Guidelines for Email	Email usage	Email usage policy	0	0	1	0	1
Guidelines for ICT Equipment	ICT equipment sanitisation and destruction	ICT equipment sanitisation processes and procedures	0	0	1	0	1
Guidelines for ICT Equipment	ICT equipment usage	ICT equipment register	0	0	1	0	1
Guidelines for Media	Media sanitisation	Media sanitisation processes and procedures	0	0	1	0	1
Guidelines for Media	Media destruction	Media destruction processes and procedures	0	0	1	0	1
Guidelines for Media	Media disposal	Media disposal processes and procedures	0	0	1	0	1
Guidelines for System Hardening	Operating system hardening	Hardening operating system configurations	0	1	0	0	1
Guidelines for System Hardening	Authentication hardening	Session and screen locking	0	0	0	1	1
Guidelines for Cryptography	Cryptographic fundamentals	Cryptographic key management processes and procedures	0	0	1	0	1
Guidelines for Networking	Network design and configuration	Network documentation	0	1	0	0	1
Guidelines for Cyber Security Incidents	Managing cyber security incidents	Incident management policy	0	1	0	0	1
Guidelines for System Monitoring	Event logging and monitoring	Event logging policy	0	0	1	0	1
Guidelines for Communications Systems	Fax machines and multifunction devices	Fax machine and multifunction device usage policy	0	0	1	0	1
Guidelines for Data Transfers	Data transfers	Manual export of data	0	1	0	0	1
Guidelines for Enterprise Mobility	Mobile device usage	Mobile device emergency sanitisation processes and procedures	0	0	1	0	1
Guidelines for Cyber Security Roles	Chief Information Security Officer	Developing a cyber security communications strategy	0	0	1	0	1
Guidelines for Cyber Security Roles	Chief Information Security Officer	Overseeing cyber security awareness raising	0	0	1	0	1
Guidelines for Gateways	Web content filters	Using web content filters	0	0	1	0	1
Guidelines for Communications Systems	Telephone systems	Telephone system usage policy	0	0	1	0	1
Guidelines for Enterprise Mobility	Mobile device usage	Mobile device usage policy	0	0	1	0	1
Guidelines for System Management	System patching	Patch management processes and procedures	0	0	1	0	1
Guidelines for Email	Email gateways and servers	Email content filtering	0	0	1	0	1
Guidelines for Database Systems	Databases	Database register	0	0	1	0	1
Guidelines for Networking	Network design and configuration	Default accounts and credentials for network devices	0	1	0	0	1
Guidelines for Networking	Network design and configuration	Use of Simple Network Management Protocol	0	0	1	0	1
Guidelines for Media	Media usage	Removable media usage policy	0	0	1	0	1
Guidelines for System Management	System patching	Software register	0	0	1	0	1
Guidelines for System Management	Data backup and restoration	Digital preservation policy	0	0	1	0	1
Guidelines for System Management	Data backup and restoration	Testing restoration of backups	0	1	0	0	1
Guidelines for Enterprise Mobility	Mobile device management	Mobile device management policy	0	0	1	0	1
Guidelines for Physical Security	Facilities and systems	Bringing Radio Frequency and infrared devices into facilities	0	0	1	0	1
Guidelines for Media	Media usage	Media management policy	0	0	1	0	1
Guidelines for ICT Equipment	ICT equipment disposal	ICT equipment disposal processes and procedures	0	0	1	0	1
Guidelines for ICT Equipment	ICT equipment usage	ICT equipment management policy	0	0	1	0	1
Guidelines for System Hardening	Authentication hardening	Setting credentials for user accounts	0	1	0	0	1
Guidelines for Cyber Security Incidents	Managing cyber security incidents	Trusted insider program	0	0	1	0	1
Guidelines for Procurement and Outsourcing	Cyber supply chain risk management	Cyber supply chain risk management activities	0	0	1	0	1
Guidelines for Procurement and Outsourcing	Managed services and cloud services	Outsourced cloud services	0	0	1	0	1
Guidelines for Communications Infrastructure	Cabling infrastructure	Floor plan diagrams	0	0	1	0	1
Guidelines for Media	Media usage	Removable media register	0	0	1	0	1
Guidelines for Personnel Security	Access to systems and their resources	Unprivileged access to systems	0	1	0	0	1
Guidelines for Personnel Security	Access to systems and their resources	Emergency access to systems	0	1	0	0	1
Guidelines for Procurement and Outsourcing	Managed services and cloud services	Managed services	0	0	1	0	1
Guidelines for ICT Equipment	ICT equipment sanitisation and destruction	ICT equipment destruction processes and procedures	0	0	1	0	1
Guidelines for System Hardening	Operating system hardening	Operating system event logging	0	1	0	0	1
Guidelines for Software Development	Web application development	Web application event logging	0	1	0	0	1
Guidelines for Database Systems	Databases	Database event logging	0	1	0	0	1
Guidelines for Gateways	Gateways	Gateway event logging and alerting	0	1	0	0	1
Guidelines for Gateways	Cross Domain Solutions	Cross Domain Solution event logging	0	1	0	0	1
Guidelines for Gateways	Web proxies	Web proxy event logging	0	1	0	0	1
Guidelines for Networking	Network design and configuration	Protective Domain Name System Services	0	1	0	0	1

6 · Control call-outs by category

Added — new controls (16)

Control	Footprint	Location	Statement (excerpt)
ISM-1803	`NC\|OS\|P\|S\|TS`	Guidelines for Cyber Security Incidents › Cyber security incident register	A cyber security incident register contains the following for each cyber security incident: * the date the cyber security incident occurred * the date…
ISM-1804	`NC\|OS\|P\|S\|TS`	Guidelines for Procurement and Outsourcing › Contractual security requirements with service providers	Break clauses associated with failure to meet security requirements are documented in contractual arrangements with service providers.
ISM-1805	`NC\|OS\|P\|S\|TS`	Guidelines for Communications Systems › Denial of service response plan	A denial of service response plan for video conferencing and IP telephony services contains the following: * how to identify signs of a denial-of-serv…
ISM-1806	`NC\|OS\|P\|S\|TS`	Guidelines for System Hardening › Hardening application configurations	Default accounts or credentials for applications, including for any pre-configured accounts, are changed.
ISM-1807	`NC\|OS\|P\|S\|TS`	Guidelines for System Management › Scanning for missing patches or updates	An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activitie…
ISM-1808	`NC\|OS\|P\|S\|TS`	Guidelines for System Management › Scanning for missing patches or updates	A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities.
ISM-1809	`NC\|OS\|P\|S\|TS`	Guidelines for System Management › Cessation of support	When applications, operating systems, network devices or other ICT equipment that are no longer supported by vendors cannot be immediately removed or …
ISM-1810	`NC\|OS\|P\|S\|TS`	Guidelines for System Management › Performing and retaining backups	Backups of important data, software and configuration settings are synchronised to enable restoration to a common point in time.
ISM-1811	`NC\|OS\|P\|S\|TS`	Guidelines for System Management › Performing and retaining backups	Backups of important data, software and configuration settings are retained in a secure and resilient manner.
ISM-1812	`NC\|OS\|P\|S\|TS`	Guidelines for System Management › Backup access	Unprivileged accounts cannot access backups belonging to other accounts.
ISM-1813	`NC\|OS\|P\|S\|TS`	Guidelines for System Management › Backup access	Unprivileged accounts cannot access their own backups.
ISM-1814	`NC\|OS\|P\|S\|TS`	Guidelines for System Management › Backup modification and deletion	Unprivileged accounts are prevented from modifying and deleting backups.
ISM-1815	`NC\|OS\|P\|S\|TS`	Guidelines for System Monitoring › Centralised event logging facility	Event logs stored within a centralised event logging facility are protected from unauthorised modification and deletion.
ISM-1816	`NC\|OS\|P\|S\|TS`	Guidelines for Software Development › Development, testing and production environments	Unauthorised modification of the authoritative source for software is prevented.
ISM-1817	`NC\|OS\|P\|S\|TS`	Guidelines for Software Development › Web application programming interfaces	Clients are authenticated when calling web APIs that facilitate access to data not authorised for release into the public domain.
ISM-1818	`NC\|OS\|P\|S\|TS`	Guidelines for Software Development › Web application programming interfaces	Clients are authenticated when calling web APIs that facilitate modification of data.

Substantive amendments (31)

Control	Edit dist	Location	Statement (excerpt)
ISM-0125	0.76	Guidelines for Cyber Security Incidents › Cyber security incident register	A cyber security incident register is developed, implemented and maintained.
ISM-1776	0.74	Guidelines for Gateways › Cross Domain Solution event logging	CDS event logs are stored centrally.
ISM-1775	0.71	Guidelines for Gateways › Gateway event logging and alerting	Gateway event logs are stored centrally.
ISM-1758	0.70	Guidelines for Database Systems › Database event logging	Database event logs are stored centrally.
ISM-1777	0.70	Guidelines for Gateways › Web proxy event logging	Web proxy event logs are stored centrally.
ISM-1665	0.69	Guidelines for System Hardening › PowerShell	PowerShell event logs are stored centrally.
ISM-1715	0.69	Guidelines for Personnel Security › Emergency access to systems	Break glass event logs are stored centrally.
ISM-1757	0.66	Guidelines for Software Development › Web application event logging	Web application event logs are stored centrally.
ISM-1747	0.66	Guidelines for System Hardening › Operating system event logging	Operating system event logs are stored centrally.
ISM-1651	0.65	Guidelines for Personnel Security › Privileged access to systems	Privileged access event logs are stored centrally.
ISM-1663	0.64	Guidelines for System Hardening › Application control	Application control event logs are stored centrally.
ISM-1714	0.64	Guidelines for Personnel Security › Unprivileged access to systems	Unprivileged access event logs are stored centrally.
ISM-0518	0.63	Guidelines for Networking › Network documentation	Network documentation is developed, implemented, maintained.
ISM-1678	0.63	Guidelines for System Hardening › Microsoft Office macros	Microsoft Office macro event logs are stored centrally.
ISM-1684	0.60	Guidelines for System Hardening › Multi-factor authentication	Multi-factor authentication event logs are stored centrally.
ISM-1652	0.59	Guidelines for Personnel Security › Privileged access to systems	Privileged account and group management event logs are stored centrally.
ISM-1019	0.58	Guidelines for Communications Systems › Denial of service response plan	A denial of service response plan for video conferencing and IP telephony services is developed, implemented and maintained.
ISM-1304	0.51	Guidelines for Networking › Default accounts and credentials for network devices	Default accounts or credentials for network devices including for any pre-configured accounts, are changed.
ISM-0418	0.49	Guidelines for System Hardening › Protecting credentials	Credentials are kept separate from systems they are used to authenticate to, except for when performing authentication activities.
ISM-1596	0.44	Guidelines for System Hardening › Setting credentials for user accounts	Credentials, in the form of memorised secrets, are not reused by users across different systems.
ISM-1708	0.39	Guidelines for System Management › Backup modification and deletion	Privileged accounts (including backup administrator accounts) are prevented from modifying and deleting backups during their retention period.
ISM-1782	0.39	Guidelines for Networking › Protective Domain Name System Services	A protective DNS service is used to block access to known malicious domain names.
ISM-1300	0.36	Guidelines for Enterprise Mobility › After travelling overseas with mobile devices	Upon returning from travelling overseas with mobile devices, personnel take the following actions: * sanitise and reset mobile devices, including all …
ISM-0576	0.35	Guidelines for Cyber Security Incidents › Incident management policy	An incident management policy, and associated incident response plan, is developed, implemented and maintained.
ISM-1408	0.35	Guidelines for System Hardening › Operating system releases and versions	Where supported, 64-bit versions of operating systems are used.
ISM-1515	0.33	Guidelines for System Management › Testing restoration of backups	Restoration of important data, software and configuration settings from backups to a common point of time is tested as part of disaster recovery exerc…
ISM-0383	0.29	Guidelines for System Hardening › Hardening operating system configurations	Default accounts or credentials for operating systems, including for any pre-configured accounts, are changed.
ISM-0669	0.29	Guidelines for Data Transfers › Manual export of data	When manually exporting data from SECRET and TOP SECRET systems, digital signatures are validated and keyword checks are performed within all textual …
ISM-1705	0.29	Guidelines for System Management › Backup access	Privileged accounts (excluding backup administrator accounts) cannot access backups belonging to other accounts.
ISM-1650	0.28	Guidelines for Personnel Security › Privileged access to systems	Privileged account and group management events are logged.
ISM-1509	0.27	Guidelines for Personnel Security › Privileged access to systems	Privileged access events are logged.

Clarifications (66)

Control	Edit dist	Location
ISM-1407	0.23	Guidelines for System Hardening › Operating system releases and versions
ISM-1706	0.22	Guidelines for System Management › Backup access
ISM-0072	0.21	Guidelines for Procurement and Outsourcing › Contractual security requirements with service providers
ISM-1234	0.20	Guidelines for Email › Email content filtering
ISM-1543	0.20	Guidelines for Physical Security › Bringing Radio Frequency and infrared devices into facilities
ISM-1493	0.19	Guidelines for System Management › Software register
ISM-0258	0.19	Guidelines for Gateways › Web usage policy
ISM-1405	0.18	Guidelines for System Monitoring › Centralised event logging facility
ISM-1707	0.18	Guidelines for System Management › Backup modification and deletion
ISM-0264	0.18	Guidelines for Email › Email usage policy
ISM-1794	0.17	Guidelines for Procurement and Outsourcing › Contractual security requirements with service providers
ISM-0580	0.17	Guidelines for System Monitoring › Event logging policy
ISM-0039	0.16	Guidelines for Security Documentation › Cyber security strategy
ISM-1549	0.16	Guidelines for Media › Media management policy
ISM-1625	0.16	Guidelines for Cyber Security Incidents › Trusted insider program
ISM-1786	0.16	Guidelines for Procurement and Outsourcing › Supplier relationship management
ISM-0211	0.16	Guidelines for Communications Infrastructure › Cable register
ISM-1631	0.16	Guidelines for Procurement and Outsourcing › Cyber supply chain risk management activities
ISM-1082	0.16	Guidelines for Enterprise Mobility › Mobile device usage policy
ISM-1243	0.15	Guidelines for Database Systems › Database register
ISM-1510	0.15	Guidelines for System Management › Digital preservation policy
ISM-1645	0.15	Guidelines for Communications Infrastructure › Floor plan diagrams
ISM-1359	0.15	Guidelines for Media › Removable media usage policy
ISM-1078	0.15	Guidelines for Communications Systems › Telephone system usage policy
ISM-1533	0.14	Guidelines for Enterprise Mobility › Mobile device management policy
ISM-1755	0.14	Guidelines for Software Development › Vulnerability disclosure program
ISM-0336	0.14	Guidelines for ICT Equipment › ICT equipment register
ISM-0588	0.14	Guidelines for Communications Systems › Fax machine and multifunction device usage policy
ISM-1551	0.14	Guidelines for ICT Equipment › ICT equipment management policy
ISM-1713	0.14	Guidelines for Media › Removable media register
ISM-1736	0.14	Guidelines for Procurement and Outsourcing › Managed services
ISM-1451	0.13	Guidelines for Procurement and Outsourcing › Contractual security requirements with service providers
ISM-1785	0.13	Guidelines for Procurement and Outsourcing › Supplier relationship management
ISM-1637	0.13	Guidelines for Procurement and Outsourcing › Outsourced cloud services
ISM-1311	0.12	Guidelines for Networking › Use of Simple Network Management Protocol
ISM-1395	0.12	Guidelines for Procurement and Outsourcing › Contractual security requirements with service providers
ISM-0735	0.12	Guidelines for Cyber Security Roles › Overseeing cyber security awareness raising
ISM-0963	0.11	Guidelines for Gateways › Using web content filters
ISM-1511	0.11	Guidelines for System Management › Performing and retaining backups
ISM-1571	0.10	Guidelines for Procurement and Outsourcing › Contractual security requirements with service providers
ISM-1547	0.10	Guidelines for System Management › Data backup and restoration processes and procedures
ISM-1535	0.10	Guidelines for Data Transfers › Data transfer processes and procedures
ISM-0663	0.10	Guidelines for Data Transfers › Data transfer processes and procedures
ISM-0374	0.10	Guidelines for Media › Media disposal processes and procedures
ISM-1573	0.10	Guidelines for Procurement and Outsourcing › Contractual security requirements with service providers
ISM-0206	0.09	Guidelines for Communications Infrastructure › Cable labelling processes and procedures
ISM-1143	0.09	Guidelines for System Management › Patch management processes and procedures
ISM-1548	0.09	Guidelines for System Management › Data backup and restoration processes and procedures
ISM-0363	0.09	Guidelines for Media › Media destruction processes and procedures
ISM-0348	0.09	Guidelines for Media › Media sanitisation processes and procedures
ISM-0042	0.08	Guidelines for System Management › System administration processes and procedures
ISM-1550	0.08	Guidelines for ICT Equipment › ICT equipment disposal processes and procedures
ISM-1572	0.08	Guidelines for Procurement and Outsourcing › Contractual security requirements with service providers
ISM-1756	0.08	Guidelines for Software Development › Vulnerability disclosure program
ISM-1741	0.08	Guidelines for ICT Equipment › ICT equipment destruction processes and procedures
ISM-0313	0.08	Guidelines for ICT Equipment › ICT equipment sanitisation processes and procedures
ISM-1788	0.08	Guidelines for Procurement and Outsourcing › Sourcing applications, ICT equipment and services
ISM-0507	0.08	Guidelines for Cryptography › Cryptographic key management processes and procedures
ISM-1575	0.08	Guidelines for Procurement and Outsourcing › Contractual security requirements with service providers
ISM-1738	0.08	Guidelines for Procurement and Outsourcing › Contractual security requirements with service providers
ISM-1789	0.07	Guidelines for Procurement and Outsourcing › Sourcing applications, ICT equipment and services
ISM-0701	0.07	Guidelines for Enterprise Mobility › Mobile device emergency sanitisation processes and procedures
ISM-1574	0.06	Guidelines for Procurement and Outsourcing › Contractual security requirements with service providers
ISM-0720	0.06	Guidelines for Cyber Security Roles › Developing a cyber security communications strategy
ISM-1664	0.06	Guidelines for System Hardening › PowerShell
ISM-0141	0.05	Guidelines for Procurement and Outsourcing › Contractual security requirements with service providers

Editorial / grammatical (9)

Cosmetic edits (normalised edit distance < 0.05). ISM-0428, ISM-1556, ISM-1660, ISM-1661, ISM-1662, ISM-1677, ISM-1683, ISM-1685, ISM-1787

Relocated (24)

0 cross-chapter moves (listed) · 24 intra-chapter section/topic reshuffles (count only).

Scope / applicability changes (1)

Control	Direction	Footprint before → after	Location
ISM-1776	narrowed	`NC\|OS\|P\|S\|TS` → `S\|TS`	Cross Domain Solution event logging

Removed (3)

Control	Footprint	Former location	Statement (excerpt)
ISM-0658	`S\|TS`	Guidelines for Data Transfers	When manually importing data to SECRET and TOP SECRET systems, the data undergoes data formatting checks.
ISM-1709	`NC\|OS\|P\|S\|TS`	Guidelines for Networking	Default accounts and credentials of wireless access points are changed.
ISM-1744	`NC\|OS\|P\|S\|TS`	Guidelines for System Hardening	The latest release, or the previous release, of operating systems are used for other ICT equipment.

Method. Controls only (ISM-principles excluded). A content modification requires ASD's native revision/updated stamp to move (0 prose-only re-renders excluded as format noise). Relocation compares case/spelling-normalised chapter›section›topic paths. Nature = normalised edit distance (editorial <0.05, clarification <0.25, substantive ≥0.25 — uncalibrated). Footprints normalised across schemes (O→OS, ALL→NC|OS|P|S|TS); pre-Dec-2024 NC imputed.

Generated by ISMexplorer v1.0.0 — longitudinal and per-release analysis of ASD Information Security Manual control changes.

Information Security Manual (ISM) published by Australian Signals Directorate / Australian Cyber Security Centre and © Commonwealth of Australia 2022-2026;
ISMexplorer analysis tool and publication © Baden Hughes, 2022-2026