ASD ISM — incremental change analysis

Release v2022.12.1 (2022-12-01) vs prior v2022.09.15 · 77 days · catalogue 850 controls · ALL-era (NC imputed)

ASD changes summary: not available online (pre-June-2024 or errata release)

Added

Substantive

Clarification

Editorial

Relocated

Scope changes

Removed

1 · Change typology

2 · Classification footprint

Ceiling (highest level reached) / Floor (lowest level reached) — material changes

Level	as ceiling	as floor
TOP SECRET	47	0
SECRET	0	2
PROTECTED	0	0
OFFICIAL: Sensitive	0	0
Non-Classified	0	45

3 · Level-specific material changes

Footprint	Floor	Ceiling	Controls
`S\|TS`	SECRET	TOP SECRET	ISM-0669 ISM-1776

4 · Change location by chapter

5 · Control call-outs by category

Added — new controls (16)

Control	Footprint	Location	Statement (excerpt)
ISM-1803	`NC\|OS\|P\|S\|TS`	Guidelines for Cyber Security Incidents › Cyber security incident register	A cyber security incident register contains the following for each cyber security incident: * the date the cyber security incident occurred * the date…
ISM-1804	`NC\|OS\|P\|S\|TS`	Guidelines for Procurement and Outsourcing › Contractual security requirements with service providers	Break clauses associated with failure to meet security requirements are documented in contractual arrangements with service providers.
ISM-1805	`NC\|OS\|P\|S\|TS`	Guidelines for Communications Systems › Denial of service response plan	A denial of service response plan for video conferencing and IP telephony services contains the following: * how to identify signs of a denial-of-serv…
ISM-1806	`NC\|OS\|P\|S\|TS`	Guidelines for System Hardening › Hardening application configurations	Default accounts or credentials for applications, including for any pre-configured accounts, are changed.
ISM-1807	`NC\|OS\|P\|S\|TS`	Guidelines for System Management › Scanning for missing patches or updates	An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activitie…
ISM-1808	`NC\|OS\|P\|S\|TS`	Guidelines for System Management › Scanning for missing patches or updates	A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities.
ISM-1809	`NC\|OS\|P\|S\|TS`	Guidelines for System Management › Cessation of support	When applications, operating systems, network devices or other ICT equipment that are no longer supported by vendors cannot be immediately removed or …
ISM-1810	`NC\|OS\|P\|S\|TS`	Guidelines for System Management › Performing and retaining backups	Backups of important data, software and configuration settings are synchronised to enable restoration to a common point in time.
ISM-1811	`NC\|OS\|P\|S\|TS`	Guidelines for System Management › Performing and retaining backups	Backups of important data, software and configuration settings are retained in a secure and resilient manner.
ISM-1812	`NC\|OS\|P\|S\|TS`	Guidelines for System Management › Backup access	Unprivileged accounts cannot access backups belonging to other accounts.
ISM-1813	`NC\|OS\|P\|S\|TS`	Guidelines for System Management › Backup access	Unprivileged accounts cannot access their own backups.
ISM-1814	`NC\|OS\|P\|S\|TS`	Guidelines for System Management › Backup modification and deletion	Unprivileged accounts are prevented from modifying and deleting backups.
ISM-1815	`NC\|OS\|P\|S\|TS`	Guidelines for System Monitoring › Centralised event logging facility	Event logs stored within a centralised event logging facility are protected from unauthorised modification and deletion.
ISM-1816	`NC\|OS\|P\|S\|TS`	Guidelines for Software Development › Development, testing and production environments	Unauthorised modification of the authoritative source for software is prevented.
ISM-1817	`NC\|OS\|P\|S\|TS`	Guidelines for Software Development › Web application programming interfaces	Clients are authenticated when calling web APIs that facilitate access to data not authorised for release into the public domain.
ISM-1818	`NC\|OS\|P\|S\|TS`	Guidelines for Software Development › Web application programming interfaces	Clients are authenticated when calling web APIs that facilitate modification of data.

Substantive amendments (31)

Control	Edit dist	Location	Statement (excerpt)
ISM-0125	0.76	Guidelines for Cyber Security Incidents › Cyber security incident register	A cyber security incident register is developed, implemented and maintained.
ISM-1776	0.74	Guidelines for Gateways › Cross Domain Solution event logging	CDS event logs are stored centrally.
ISM-1775	0.71	Guidelines for Gateways › Gateway event logging and alerting	Gateway event logs are stored centrally.
ISM-1758	0.70	Guidelines for Database Systems › Database event logging	Database event logs are stored centrally.
ISM-1777	0.70	Guidelines for Gateways › Web proxy event logging	Web proxy event logs are stored centrally.
ISM-1665	0.69	Guidelines for System Hardening › PowerShell	PowerShell event logs are stored centrally.
ISM-1715	0.69	Guidelines for Personnel Security › Emergency access to systems	Break glass event logs are stored centrally.
ISM-1757	0.66	Guidelines for Software Development › Web application event logging	Web application event logs are stored centrally.
ISM-1747	0.66	Guidelines for System Hardening › Operating system event logging	Operating system event logs are stored centrally.
ISM-1651	0.65	Guidelines for Personnel Security › Privileged access to systems	Privileged access event logs are stored centrally.
ISM-1663	0.64	Guidelines for System Hardening › Application control	Application control event logs are stored centrally.
ISM-1714	0.64	Guidelines for Personnel Security › Unprivileged access to systems	Unprivileged access event logs are stored centrally.
ISM-0518	0.63	Guidelines for Networking › Network documentation	Network documentation is developed, implemented, maintained.
ISM-1678	0.63	Guidelines for System Hardening › Microsoft Office macros	Microsoft Office macro event logs are stored centrally.
ISM-1684	0.60	Guidelines for System Hardening › Multi-factor authentication	Multi-factor authentication event logs are stored centrally.
ISM-1652	0.59	Guidelines for Personnel Security › Privileged access to systems	Privileged account and group management event logs are stored centrally.
ISM-1019	0.58	Guidelines for Communications Systems › Denial of service response plan	A denial of service response plan for video conferencing and IP telephony services is developed, implemented and maintained.
ISM-1304	0.51	Guidelines for Networking › Default accounts and credentials for network devices	Default accounts or credentials for network devices including for any pre-configured accounts, are changed.
ISM-0418	0.49	Guidelines for System Hardening › Protecting credentials	Credentials are kept separate from systems they are used to authenticate to, except for when performing authentication activities.
ISM-1596	0.44	Guidelines for System Hardening › Setting credentials for user accounts	Credentials, in the form of memorised secrets, are not reused by users across different systems.
ISM-1708	0.39	Guidelines for System Management › Backup modification and deletion	Privileged accounts (including backup administrator accounts) are prevented from modifying and deleting backups during their retention period.
ISM-1782	0.39	Guidelines for Networking › Protective Domain Name System Services	A protective DNS service is used to block access to known malicious domain names.
ISM-1300	0.36	Guidelines for Enterprise Mobility › After travelling overseas with mobile devices	Upon returning from travelling overseas with mobile devices, personnel take the following actions: * sanitise and reset mobile devices, including all …
ISM-0576	0.35	Guidelines for Cyber Security Incidents › Incident management policy	An incident management policy, and associated incident response plan, is developed, implemented and maintained.
ISM-1408	0.35	Guidelines for System Hardening › Operating system releases and versions	Where supported, 64-bit versions of operating systems are used.
ISM-1515	0.33	Guidelines for System Management › Testing restoration of backups	Restoration of important data, software and configuration settings from backups to a common point of time is tested as part of disaster recovery exerc…
ISM-0383	0.29	Guidelines for System Hardening › Hardening operating system configurations	Default accounts or credentials for operating systems, including for any pre-configured accounts, are changed.
ISM-0669	0.29	Guidelines for Data Transfers › Manual export of data	When manually exporting data from SECRET and TOP SECRET systems, digital signatures are validated and keyword checks are performed within all textual …
ISM-1705	0.29	Guidelines for System Management › Backup access	Privileged accounts (excluding backup administrator accounts) cannot access backups belonging to other accounts.
ISM-1650	0.28	Guidelines for Personnel Security › Privileged access to systems	Privileged account and group management events are logged.
ISM-1509	0.27	Guidelines for Personnel Security › Privileged access to systems	Privileged access events are logged.

Clarifications (66)

Control	Edit dist	Location
ISM-1407	0.23	Guidelines for System Hardening › Operating system releases and versions
ISM-1706	0.22	Guidelines for System Management › Backup access
ISM-0072	0.21	Guidelines for Procurement and Outsourcing › Contractual security requirements with service providers
ISM-1234	0.20	Guidelines for Email › Email content filtering
ISM-1543	0.20	Guidelines for Physical Security › Bringing Radio Frequency and infrared devices into facilities
ISM-1493	0.19	Guidelines for System Management › Software register
ISM-0258	0.19	Guidelines for Gateways › Web usage policy
ISM-1405	0.18	Guidelines for System Monitoring › Centralised event logging facility
ISM-1707	0.18	Guidelines for System Management › Backup modification and deletion
ISM-0264	0.18	Guidelines for Email › Email usage policy
ISM-1794	0.17	Guidelines for Procurement and Outsourcing › Contractual security requirements with service providers
ISM-0580	0.17	Guidelines for System Monitoring › Event logging policy
ISM-0039	0.16	Guidelines for Security Documentation › Cyber security strategy
ISM-1549	0.16	Guidelines for Media › Media management policy
ISM-1625	0.16	Guidelines for Cyber Security Incidents › Trusted insider program
ISM-1786	0.16	Guidelines for Procurement and Outsourcing › Supplier relationship management
ISM-0211	0.16	Guidelines for Communications Infrastructure › Cable register
ISM-1631	0.16	Guidelines for Procurement and Outsourcing › Cyber supply chain risk management activities
ISM-1082	0.16	Guidelines for Enterprise Mobility › Mobile device usage policy
ISM-1243	0.15	Guidelines for Database Systems › Database register
ISM-1510	0.15	Guidelines for System Management › Digital preservation policy
ISM-1645	0.15	Guidelines for Communications Infrastructure › Floor plan diagrams
ISM-1359	0.15	Guidelines for Media › Removable media usage policy
ISM-1078	0.15	Guidelines for Communications Systems › Telephone system usage policy
ISM-1533	0.14	Guidelines for Enterprise Mobility › Mobile device management policy
ISM-1755	0.14	Guidelines for Software Development › Vulnerability disclosure program
ISM-0336	0.14	Guidelines for ICT Equipment › ICT equipment register
ISM-0588	0.14	Guidelines for Communications Systems › Fax machine and multifunction device usage policy
ISM-1551	0.14	Guidelines for ICT Equipment › ICT equipment management policy
ISM-1713	0.14	Guidelines for Media › Removable media register
ISM-1736	0.14	Guidelines for Procurement and Outsourcing › Managed services
ISM-1451	0.13	Guidelines for Procurement and Outsourcing › Contractual security requirements with service providers
ISM-1785	0.13	Guidelines for Procurement and Outsourcing › Supplier relationship management
ISM-1637	0.13	Guidelines for Procurement and Outsourcing › Outsourced cloud services
ISM-1311	0.12	Guidelines for Networking › Use of Simple Network Management Protocol
ISM-1395	0.12	Guidelines for Procurement and Outsourcing › Contractual security requirements with service providers
ISM-0735	0.12	Guidelines for Cyber Security Roles › Overseeing cyber security awareness raising
ISM-0963	0.11	Guidelines for Gateways › Using web content filters
ISM-1511	0.11	Guidelines for System Management › Performing and retaining backups
ISM-1571	0.10	Guidelines for Procurement and Outsourcing › Contractual security requirements with service providers
ISM-1547	0.10	Guidelines for System Management › Data backup and restoration processes and procedures
ISM-1535	0.10	Guidelines for Data Transfers › Data transfer processes and procedures
ISM-0663	0.10	Guidelines for Data Transfers › Data transfer processes and procedures
ISM-0374	0.10	Guidelines for Media › Media disposal processes and procedures
ISM-1573	0.10	Guidelines for Procurement and Outsourcing › Contractual security requirements with service providers
ISM-0206	0.09	Guidelines for Communications Infrastructure › Cable labelling processes and procedures
ISM-1143	0.09	Guidelines for System Management › Patch management processes and procedures
ISM-1548	0.09	Guidelines for System Management › Data backup and restoration processes and procedures
ISM-0363	0.09	Guidelines for Media › Media destruction processes and procedures
ISM-0348	0.09	Guidelines for Media › Media sanitisation processes and procedures
ISM-0042	0.08	Guidelines for System Management › System administration processes and procedures
ISM-1550	0.08	Guidelines for ICT Equipment › ICT equipment disposal processes and procedures
ISM-1572	0.08	Guidelines for Procurement and Outsourcing › Contractual security requirements with service providers
ISM-1756	0.08	Guidelines for Software Development › Vulnerability disclosure program
ISM-1741	0.08	Guidelines for ICT Equipment › ICT equipment destruction processes and procedures
ISM-0313	0.08	Guidelines for ICT Equipment › ICT equipment sanitisation processes and procedures
ISM-1788	0.08	Guidelines for Procurement and Outsourcing › Sourcing applications, ICT equipment and services
ISM-0507	0.08	Guidelines for Cryptography › Cryptographic key management processes and procedures
ISM-1575	0.08	Guidelines for Procurement and Outsourcing › Contractual security requirements with service providers
ISM-1738	0.08	Guidelines for Procurement and Outsourcing › Contractual security requirements with service providers
ISM-1789	0.07	Guidelines for Procurement and Outsourcing › Sourcing applications, ICT equipment and services
ISM-0701	0.07	Guidelines for Enterprise Mobility › Mobile device emergency sanitisation processes and procedures
ISM-1574	0.06	Guidelines for Procurement and Outsourcing › Contractual security requirements with service providers
ISM-0720	0.06	Guidelines for Cyber Security Roles › Developing a cyber security communications strategy
ISM-1664	0.06	Guidelines for System Hardening › PowerShell
ISM-0141	0.05	Guidelines for Procurement and Outsourcing › Contractual security requirements with service providers

Editorial / grammatical (9)

Cosmetic edits (normalised edit distance < 0.05). ISM-0428, ISM-1556, ISM-1660, ISM-1661, ISM-1662, ISM-1677, ISM-1683, ISM-1685, ISM-1787

Relocated (24)

0 cross-chapter moves (listed) · 24 intra-chapter section/topic reshuffles (count only).

Scope / applicability changes (1)

Control	Direction	Footprint before → after	Location
ISM-1776	narrowed	`NC\|OS\|P\|S\|TS` → `S\|TS`	Cross Domain Solution event logging

Removed (3)

Control	Footprint	Former location	Statement (excerpt)
ISM-0658	`S\|TS`	Guidelines for Data Transfers	When manually importing data to SECRET and TOP SECRET systems, the data undergoes data formatting checks.
ISM-1709	`NC\|OS\|P\|S\|TS`	Guidelines for Networking	Default accounts and credentials of wireless access points are changed.
ISM-1744	`NC\|OS\|P\|S\|TS`	Guidelines for System Hardening	The latest release, or the previous release, of operating systems are used for other ICT equipment.

Method. Controls only (ISM-principles excluded). A content modification requires ASD's native revision/updated stamp to move (0 prose-only re-renders excluded as format noise). Relocation compares case/spelling-normalised chapter›section›topic paths. Nature = normalised edit distance (editorial <0.05, clarification <0.25, substantive ≥0.25 — uncalibrated). Footprints normalised across schemes (O→OS, ALL→NC|OS|P|S|TS); pre-Dec-2024 NC imputed.

Generated by ISMexplorer v1.0.0 — longitudinal and per-release analysis of ASD Information Security Manual control changes.

Information Security Manual (ISM) published by Australian Signals Directorate / Australian Cyber Security Centre and © Commonwealth of Australia 2022-2026;
ISMexplorer analysis tool and publication © Baden Hughes, 2022-2026