Australian Information Security Manual

Cabling infrastructure is installed in accordance with relevant Australian Standards, as directed by the Australian Communications and Media Authority.

• Evidence demonstrating: Cabling infrastructure is installed in accordance with relevant Australian Stand
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

SECRET cables, when bundled together or run in conduit, are run exclusively in their own individual cable bundle or conduit.

• Evidence demonstrating: SECRET cables, when bundled together or run in conduit, are run exclusively in t
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

In shared facilities, a visible smear of conduit glue is used to seal all plastic conduit joints and TOP SECRET conduits connected by threaded lock nuts.

• Evidence demonstrating: In shared facilities, a visible smear of conduit glue is used to seal all plasti
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

In shared facilities, uniquely identifiable SCEC-approved tamper-evident seals are used to seal all removable covers on TOP SECRET cable reticulation systems.

• Evidence demonstrating: In shared facilities, uniquely identifiable SCEC-approved tamper-evident seals a
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

When penetrating a TOP SECRET audio secure room, the Australian Security Intelligence Organisation is consulted and all directions provided are complied with.

• Evidence demonstrating: When penetrating a TOP SECRET audio secure room, the Australian Security Intelli
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

Labels for TOP SECRET conduits are a minimum size of 2.5 cm x 1 cm, attached at five-metre intervals and marked as 'TS RUN'.

• Evidence demonstrating: Labels for TOP SECRET conduits are a minimum size of 2.5 cm x 1 cm, attached at
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

Cable labelling processes, and supporting cable labelling procedures, are developed, implemented and maintained.

• Evidence demonstrating: Cable labelling processes, and supporting cable labelling procedures, are develo
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

A cable register contains the following for each cable: - cable identifier - cable colour - sensitivity/classification - source - destination - location - seal numbers (if applicable).

• Evidence demonstrating: A cable register contains the following for each cable: - cable identifier - cab
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

A cable register is developed, implemented, maintained and verified on a regular basis.

• Evidence demonstrating: A cable register is developed, implemented, maintained and verified on a regular
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

SECRET and TOP SECRET cables are terminated on their own individual patch panels.

• Evidence demonstrating: SECRET and TOP SECRET cables are terminated on their own individual patch panels
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

TOP SECRET patch panels are installed in individual TOP SECRET cabinets.

• Evidence demonstrating: TOP SECRET patch panels are installed in individual TOP SECRET cabinets.
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

Where spatial constraints demand non-TOP SECRET patch panels be installed in the same cabinet as a TOP SECRET patch panel: - a physical barrier in the cabinet is provided to separate patch panels - only personnel holding a Positive Vetting security clearance have access to the cabinet - approval from the TOP SECRET system's authorising officer is obtained prior to installation.

• Evidence demonstrating: Where spatial constraints demand non-TOP SECRET patch panels be installed in the
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

If TOP SECRET fibre-optic fly leads exceeding five metres in length are used to connect wall outlet boxes to IT equipment, they are run in a protective and easily inspected pathway that is clearly labelled at the IT equipment end with the wall outlet box's identifier.

• Evidence demonstrating: If TOP SECRET fibre-optic fly leads exceeding five metres in length are used to
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

When an emanation security risk assessment is required, it is sought as early as possible in a system's life cycle.

• Evidence demonstrating: When an emanation security risk assessment is required, it is sought as early as
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

System owners deploying SECRET or TOP SECRET systems in mobile platforms, or as a deployable capability, contact ASD for an emanation security risk assessment.

• Evidence demonstrating: System owners deploying SECRET or TOP SECRET systems in mobile platforms, or as
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

IT equipment meets industry and government standards relating to electromagnetic interference/electromagnetic compatibility.

• Evidence demonstrating: IT equipment meets industry and government standards relating to electromagnetic
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

Non-classified, OFFICIAL: Sensitive and PROTECTED cables are coloured neither salmon pink nor red.

• Evidence demonstrating: Non-classified, OFFICIAL: Sensitive and PROTECTED cables are coloured neither sa
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

Wall outlet boxes denote the systems, cable identifiers and wall outlet box identifier.

• Evidence demonstrating: Wall outlet boxes denote the systems, cable identifiers and wall outlet box iden
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

Cables are labelled at each end with sufficient source and destination details to enable the physical identification and inspection of the cable.

• Evidence demonstrating: Cables are labelled at each end with sufficient source and destination details t
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

SECRET cables are terminated in an individual cabinet; or for small systems, a cabinet with a division plate between any SECRET cables and non-SECRET cables.

• Evidence demonstrating: SECRET cables are terminated in an individual cabinet; or for small systems, a c
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

TOP SECRET cables are terminated in an individual TOP SECRET cabinet.

• Evidence demonstrating: TOP SECRET cables are terminated in an individual TOP SECRET cabinet.
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

In TOP SECRET areas, cable reticulation systems leading into cabinets in server rooms or communications rooms are terminated as close as possible to the cabinet.

• Evidence demonstrating: In TOP SECRET areas, cable reticulation systems leading into cabinets in server
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

Cable reticulation systems leading into cabinets are terminated as close as possible to the cabinet.

• Evidence demonstrating: Cable reticulation systems leading into cabinets are terminated as close as poss
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

In TOP SECRET areas, cable reticulation systems leading into cabinets not in server rooms or communications rooms are terminated at the boundary of the cabinet.

• Evidence demonstrating: In TOP SECRET areas, cable reticulation systems leading into cabinets not in ser
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

SECRET and TOP SECRET wall outlet boxes contain exclusively SECRET or TOP SECRET cables.

• Evidence demonstrating: SECRET and TOP SECRET wall outlet boxes contain exclusively SECRET or TOP SECRET
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

Non-classified, OFFICIAL: Sensitive and PROTECTED wall outlet boxes are coloured neither salmon pink nor red.

• Evidence demonstrating: Non-classified, OFFICIAL: Sensitive and PROTECTED wall outlet boxes are coloured
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

Wall outlet box covers are clear plastic.

• Evidence demonstrating: Wall outlet box covers are clear plastic.
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

Fibre-optic cables are used for cabling infrastructure instead of copper cables.

• Evidence demonstrating: Fibre-optic cables are used for cabling infrastructure instead of copper cables.
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

Cables in non-TOP SECRET areas are inspectable every five metres or less.

• Evidence demonstrating: Cables in non-TOP SECRET areas are inspectable every five metres or less.
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

Cable bundles or conduits sharing a common cable reticulation system have a dividing partition or visible gap between each cable bundle and conduit.

• Evidence demonstrating: Cable bundles or conduits sharing a common cable reticulation system have a divi
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

Cables from cable trays to wall outlet boxes are run in flexible or plastic conduit.

• Evidence demonstrating: Cables from cable trays to wall outlet boxes are run in flexible or plastic cond
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

A visible gap exists between TOP SECRET cabinets and non-TOP SECRET cabinets.

• Evidence demonstrating: A visible gap exists between TOP SECRET cabinets and non-TOP SECRET cabinets.
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

Cables in TOP SECRET areas are fully inspectable for their entire length.

• Evidence demonstrating: Cables in TOP SECRET areas are fully inspectable for their entire length.
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

Where wall penetrations exit a TOP SECRET area into a lower classified area, TOP SECRET cables are encased in conduit with all gaps between the TOP SECRET conduit and the wall filled with an appropriate sealing compound.

• Evidence demonstrating: Where wall penetrations exit a TOP SECRET area into a lower classified area, TOP
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

A power distribution board with a feed from an Uninterruptible Power Supply is used to power all TOP SECRET IT equipment.

• Evidence demonstrating: A power distribution board with a feed from an Uninterruptible Power Supply is u
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

In shared facilities, cables are run in an enclosed cable reticulation system.

• Evidence demonstrating: In shared facilities, cables are run in an enclosed cable reticulation system.
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

In shared facilities, TOP SECRET cables are not run in party walls.

• Evidence demonstrating: In shared facilities, TOP SECRET cables are not run in party walls.
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

System owners deploying SECRET or TOP SECRET systems within fixed facilities contact ASD for an emanation security risk assessment.

• Evidence demonstrating: System owners deploying SECRET or TOP SECRET systems within fixed facilities con
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

In shared facilities, conduits or the front covers of ducts, cable trays in floors and ceilings, and associated fittings are clear plastic.

• Evidence demonstrating: In shared facilities, conduits or the front covers of ducts, cable trays in floo
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

SECRET and TOP SECRET cables with non-conformant cable colouring are banded with the appropriate colour and labelled at inspection points.

• Evidence demonstrating: SECRET and TOP SECRET cables with non-conformant cable colouring are banded with
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

Building management cables are labelled with their purpose in black writing on a yellow background, with a minimum size of 2.5 cm x 1 cm, and attached at five-metre intervals.

• Evidence demonstrating: Building management cables are labelled with their purpose in black writing on a
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

Cables for foreign systems installed in Australian facilities are labelled at inspection points.

• Evidence demonstrating: Cables for foreign systems installed in Australian facilities are labelled at in
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

Floor plan diagrams are developed, implemented, maintained and verified on a regular basis.

• Evidence demonstrating: Floor plan diagrams are developed, implemented, maintained and verified on a reg
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

Floor plan diagrams contain the following: - cable paths (including ingress and egress points between floors) - cable reticulation system and conduit paths - floor concentration boxes - wall outlet boxes - network cabinets.

• Evidence demonstrating: Floor plan diagrams contain the following: - cable paths (including ingress and
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

SECRET cables are coloured salmon pink.

• Evidence demonstrating: SECRET cables are coloured salmon pink.
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

TOP SECRET cables are coloured red.

• Evidence demonstrating: TOP SECRET cables are coloured red.
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

SECRET wall outlet boxes are coloured salmon pink.

• Evidence demonstrating: SECRET wall outlet boxes are coloured salmon pink.
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

TOP SECRET wall outlet boxes are coloured red.

• Evidence demonstrating: TOP SECRET wall outlet boxes are coloured red.
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

Cables for individual systems use a consistent colour.

• Evidence demonstrating: Cables for individual systems use a consistent colour.
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

TOP SECRET cables, when bundled together or run in conduit, are run exclusively in their own individual cable bundle or conduit.

• Evidence demonstrating: TOP SECRET cables, when bundled together or run in conduit, are run exclusively
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

Wall outlet boxes for individual systems use a consistent colour.

• Evidence demonstrating: Wall outlet boxes for individual systems use a consistent colour.
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

Emanation security doctrine produced by ASD for the management of emanation security matters is complied with.

• Evidence demonstrating: Emanation security doctrine produced by ASD for the management of emanation secu
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

Recommended actions contained within emanation security mitigation advice issued for systems are implemented by system owners.

• Evidence demonstrating: Recommended actions contained within emanation security mitigation advice issued
• Cabling records and standards compliance
• Emanation security assessments
• Cable labelling/inspection records

• Cabling not installed to standard
• No emanation security consideration

Personnel are advised of the permitted sensitivity or classification of information that can be discussed over internal and external telephone systems.

• Evidence demonstrating: Personnel are advised of the permitted sensitivity or classification of informat
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

Personnel are advised of security risks posed by non-secure telephone systems in areas where sensitive or classified conversations can occur.

• Evidence demonstrating: Personnel are advised of security risks posed by non-secure telephone systems in
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

When using cryptographic equipment to permit different levels of conversation for different kinds of connections, telephone systems give a visual indication of what kind of connection has been made.

• Evidence demonstrating: When using cryptographic equipment to permit different levels of conversation fo
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

Telephone systems used for sensitive or classified conversations encrypt all traffic that passes over external systems.

• Evidence demonstrating: Telephone systems used for sensitive or classified conversations encrypt all tra
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

Cordless telephone handsets and headsets are not used for sensitive or classified conversations unless all communications are encrypted.

• Evidence demonstrating: Cordless telephone handsets and headsets are not used for sensitive or classifie
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

Speakerphones are not used on telephone systems in TOP SECRET areas unless the telephone system is located in an audio secure room, the room is audio secure during conversations and only personnel involved in conversations are present in the room.

• Evidence demonstrating: Speakerphones are not used on telephone systems in TOP SECRET areas unless the t
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

Off-hook audio protection features are used on telephone systems in areas where background conversations may exceed the sensitivity or classification that the telephone system is authorised for communicating.

• Evidence demonstrating: Off-hook audio protection features are used on telephone systems in areas where
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

MFDs are not connected to digital telephone systems.

• Evidence demonstrating: MFDs are not connected to digital telephone systems.
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

When video conferencing or IP telephony traffic passes through a gateway containing a firewall or proxy, a video-aware or voice-aware firewall or proxy is used.

• Evidence demonstrating: When video conferencing or IP telephony traffic passes through a gateway contain
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

Video conferencing and IP telephony calls are conducted using a secure real-time transport protocol.

• Evidence demonstrating: Video conferencing and IP telephony calls are conducted using a secure real-time
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

Video conferencing and IP telephony calls are established using a secure session initiation protocol.

• Evidence demonstrating: Video conferencing and IP telephony calls are established using a secure session
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

Video conferencing and IP telephony traffic is separated physically or logically from other data traffic.

• Evidence demonstrating: Video conferencing and IP telephony traffic is separated physically or logically
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

IP telephony is configured such that: - IP phones authenticate themselves to the call controller upon registration - auto-registration is disabled and only authorised devices are allowed to access the network - unauthorised devices are blocked by default - all unused and prohibited functionality is disabled.

• Evidence demonstrating: IP telephony is configured such that: - IP phones authenticate themselves to the
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

Authentication and authorisation is used for all actions on a video conferencing network, including call setup and changing settings.

• Evidence demonstrating: Authentication and authorisation is used for all actions on a video conferencing
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

An encrypted and non-replayable two-way authentication scheme is used for call authentication and authorisation.

• Evidence demonstrating: An encrypted and non-replayable two-way authentication scheme is used for call a
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

Authentication and authorisation is used for all actions on an IP telephony network, including registering a new IP phone, changing phone users, changing settings and accessing voicemail.

• Evidence demonstrating: Authentication and authorisation is used for all actions on an IP telephony netw
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

Workstations are not connected to video conferencing units or IP phones unless the workstation or the device uses Virtual Local Area Networks or similar mechanisms to maintain separation between video conferencing, IP telephony and other data traffic.

• Evidence demonstrating: Workstations are not connected to video conferencing units or IP phones unless t
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

IP phones used in public areas do not have the ability to access data networks, voicemail and directory services.

• Evidence demonstrating: IP phones used in public areas do not have the ability to access data networks,
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

Microphones (including headsets and USB handsets) and webcams are not used with non-SECRET workstations in SECRET areas.

• Evidence demonstrating: Microphones (including headsets and USB handsets) and webcams are not used with
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

An MFD usage policy is developed, implemented and maintained.

• Evidence demonstrating: An MFD usage policy is developed, implemented and maintained.
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

MFDs are not used to scan or copy documents above the sensitivity or classification of networks they are connected to.

• Evidence demonstrating: MFDs are not used to scan or copy documents above the sensitivity or classificat
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

Authentication measures for MFDs are the same strength as those used for workstations on networks they are connected to.

• Evidence demonstrating: Authentication measures for MFDs are the same strength as those used for worksta
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

In SECRET and TOP SECRET areas, push-to-talk handsets or push-to-talk headsets are used to meet any off-hook audio protection requirements.

• Evidence demonstrating: In SECRET and TOP SECRET areas, push-to-talk handsets or push-to-talk headsets a
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

Individual logins are implemented for IP phones used for SECRET or TOP SECRET conversations.

• Evidence demonstrating: Individual logins are implemented for IP phones used for SECRET or TOP SECRET co
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

A denial of service response plan for video conferencing and IP telephony services is developed, implemented and maintained.

• Evidence demonstrating: A denial of service response plan for video conferencing and IP telephony servic
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

MFDs are located in areas where their use can be observed.

• Evidence demonstrating: MFDs are located in areas where their use can be observed.
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

A telephone system usage policy is developed, implemented and maintained.

• Evidence demonstrating: A telephone system usage policy is developed, implemented and maintained.
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

Microphones (including headsets and USB handsets) and webcams are not used with non-TOP SECRET workstations in TOP SECRET areas.

• Evidence demonstrating: Microphones (including headsets and USB handsets) and webcams are not used with
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

Video conferencing and IP telephony infrastructure is hardened.

• Evidence demonstrating: Video conferencing and IP telephony infrastructure is hardened.
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

A denial of service response plan for video conferencing and IP telephony services contains the following: - how to identify signs of a denial-of-service attack - how to identify the source of a denial-of-service attack - how capabilities can be maintained during a denial-of-service attack - what actions can be taken to respond to a denial-of-service attack.

• Evidence demonstrating: A denial of service response plan for video conferencing and IP telephony servic
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

Users authenticate to MFDs before they can print, scan or copy documents.

• Evidence demonstrating: Users authenticate to MFDs before they can print, scan or copy documents.
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

Use of MFDs for printing, scanning and copying purposes, including the capture of shadow copies of documents, are centrally logged.

• Evidence demonstrating: Use of MFDs for printing, scanning and copying purposes, including the capture o
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

Fax machines, and online fax services, are not used for sending or receiving fax messages.

• Evidence demonstrating: Fax machines, and online fax services, are not used for sending or receiving fax
• Telephone/video/fax usage policies
• Classification/marking of communications
• Configuration records

• No usage policy
• Classification not enforced on communications

The compromise or suspected compromise of cryptographic equipment or associated keying material is reported to the chief information security officer, or one of their delegates, as soon as possible after it occurs.

• Evidence demonstrating: The compromise or suspected compromise of cryptographic equipment or associated
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

Where practical, cryptographic equipment, applications and libraries provide a means of data recovery to allow for circumstances where the encryption key is unavailable due to loss, damage or failure.

• Evidence demonstrating: Where practical, cryptographic equipment, applications and libraries provide a m
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

Cryptographic equipment, applications or libraries that have completed a Common Criteria evaluation against an ASD-endorsed Protection Profile are used when encrypting media that contains OFFICIAL: Sensitive or PROTECTED data.

• Evidence demonstrating: Cryptographic equipment, applications or libraries that have completed a Common
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

Full disk encryption, or partial encryption where access controls will only allow writing to the encrypted partition, is implemented when encrypting data at rest.

• Evidence demonstrating: Full disk encryption, or partial encryption where access controls will only allo
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

HACE is used when encrypting media that contains SECRET or TOP SECRET data.

• Evidence demonstrating: HACE is used when encrypting media that contains SECRET or TOP SECRET data.
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

When a user authenticates to the encryption functionality of IT equipment or media, it is treated in accordance with its original sensitivity or classification until the user deauthenticates from the encryption functionality.

• Evidence demonstrating: When a user authenticates to the encryption functionality of IT equipment or med
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

Cryptographic equipment, applications or libraries that have completed a Common Criteria evaluation against an ASD-endorsed Protection Profile are used to protect OFFICIAL: Sensitive or PROTECTED data when communicated over insufficiently secure networks, outside of appropriately secure areas or via public network infrastructure.

• Evidence demonstrating: Cryptographic equipment, applications or libraries that have completed a Common
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

HACE is used to protect SECRET and TOP SECRET data when communicated over insufficiently secure networks, outside of appropriately secure areas or via public network infrastructure.

• Evidence demonstrating: HACE is used to protect SECRET and TOP SECRET data when communicated over insuff
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

An ASD-Approved Cryptographic Protocol (AACP) or high assurance cryptographic protocol is used to protect data when communicated over network infrastructure.

• Evidence demonstrating: An ASD-Approved Cryptographic Protocol (AACP) or high assurance cryptographic pr
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

Only AACAs or high assurance cryptographic algorithms are used by cryptographic equipment, applications and libraries.

• Evidence demonstrating: Only AACAs or high assurance cryptographic algorithms are used by cryptographic
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

When using DH for agreeing on encryption session keys, a modulus of at least 2048 bits is used, preferably 3072 bits.

• Evidence demonstrating: When using DH for agreeing on encryption session keys, a modulus of at least 204
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

When using ECDH for agreeing on encryption session keys, a base point order and key size of at least 224 bits is used, preferably the NIST P-384 curve.

• Evidence demonstrating: When using ECDH for agreeing on encryption session keys, a base point order and
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

When using ECDSA for digital signatures, a base point order and key size of at least 224 bits is used, preferably the P-384 curve.

• Evidence demonstrating: When using ECDSA for digital signatures, a base point order and key size of at l
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

When using RSA for digital signatures, and transporting encryption session keys (and similar keys), a modulus of at least 2048 bits is used, preferably 3072 bits.

• Evidence demonstrating: When using RSA for digital signatures, and transporting encryption session keys
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

When using RSA for digital signatures, and for transporting encryption session keys (and similar keys), a different key pair is used for digital signatures and transporting encryption session keys.

• Evidence demonstrating: When using RSA for digital signatures, and for transporting encryption session k
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

Symmetric cryptographic algorithms are not used in Electronic Codebook Mode.

• Evidence demonstrating: Symmetric cryptographic algorithms are not used in Electronic Codebook Mode.
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

Only AACPs or high assurance cryptographic protocols are used by cryptographic equipment, applications and libraries.

• Evidence demonstrating: Only AACPs or high assurance cryptographic protocols are used by cryptographic e
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

The SSH daemon is configured to: - only listen on the required interfaces (ListenAddress xxx.xxx.xxx.xxx) - have a suitable login banner (Banner x) - have a login authentication timeout of no more than 60 seconds (LoginGraceTime 60) - disable host-based authentication (HostbasedAuthentication no) - disable rhosts-based authentication (IgnoreRhosts yes) - disable the ability to login directly as root (PermitRootLogin no) - disable empty passwords (PermitEmptyPasswords no) - disable connection forwarding (AllowTCPForwarding no) - disable gateway ports (GatewayPorts no) - disable X11 forwarding (X11Forwarding no).

• Evidence demonstrating: The SSH daemon is configured to: - only listen on the required interfaces (Liste
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

Public key-based authentication is used for SSH connections.

• Evidence demonstrating: Public key-based authentication is used for SSH connections.
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

When using logins without a password for SSH connections, the following are disabled: - access from IP addresses that do not require access - port forwarding - agent credential forwarding - X11 forwarding - console access.

• Evidence demonstrating: When using logins without a password for SSH connections, the following are disa
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

If using remote access without the use of a password for SSH connections, the 'forced command' option is used to specify what command is executed and parameter checking is enabled.

• Evidence demonstrating: If using remote access without the use of a password for SSH connections, the 'f
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

When SSH-agent or similar key caching applications are used, it is limited to workstations and servers with screen locks and key caches that are set to expire within four hours of inactivity.

• Evidence demonstrating: When SSH-agent or similar key caching applications are used, it is limited to wo
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

Versions of S/MIME earlier than S/MIME version 3.0 are not used for S/MIME connections.

• Evidence demonstrating: Versions of S/MIME earlier than S/MIME version 3.0 are not used for S/MIME conne
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

Tunnel mode is used for IPsec connections; however, if using transport mode, an IP tunnel is used.

• Evidence demonstrating: Tunnel mode is used for IPsec connections; however, if using transport mode, an
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

The ESP protocol is used for authentication and encryption of IPsec connections.

• Evidence demonstrating: The ESP protocol is used for authentication and encryption of IPsec connections.
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

A security association lifetime of less than four hours (14400 seconds) is used for IPsec connections.

• Evidence demonstrating: A security association lifetime of less than four hours (14400 seconds) is used
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

Communications security doctrine and policy produced by ASD for the management and operation of HACE is complied with.

• Evidence demonstrating: Communications security doctrine and policy produced by ASD for the management a
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

Keyed cryptographic equipment is transported based on the sensitivity or classification of its keying material.

• Evidence demonstrating: Keyed cryptographic equipment is transported based on the sensitivity or classif
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

Cryptographic key management processes, and supporting cryptographic key management procedures, are developed, implemented and maintained.

• Evidence demonstrating: Cryptographic key management processes, and supporting cryptographic key managem
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

ECDH is used in preference to DH.

• Evidence demonstrating: ECDH is used in preference to DH.
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

AUTH_HMAC_SHA2_256_128, AUTH_HMAC_SHA2_384_192, AUTH_HMAC_SHA2_512_256 or NONE (only with AES-GCM) is used for authenticating IPsec connections, preferably NONE.

• Evidence demonstrating: AUTH HMAC SHA2 256 128, AUTH HMAC SHA2 384 192, AUTH HMAC SHA2 512 256 or NONE (
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

DH or ECDH is used for key establishment of IPsec connections, preferably 384-bit random ECP group, 3072-bit MODP Group or 4096-bit MODP Group.

• Evidence demonstrating: DH or ECDH is used for key establishment of IPsec connections, preferably 384-bi
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

PFS is used for IPsec connections.

• Evidence demonstrating: PFS is used for IPsec connections.
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

An ASD-Approved Cryptographic Algorithm (AACA) or high assurance cryptographic algorithm is used when encrypting media.

• Evidence demonstrating: An ASD-Approved Cryptographic Algorithm (AACA) or high assurance cryptographic a
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

Keying material is changed when compromised or suspected of being compromised.

• Evidence demonstrating: Keying material is changed when compromised or suspected of being compromised.
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

Only the latest version of TLS is used for TLS connections.

• Evidence demonstrating: Only the latest version of TLS is used for TLS connections.
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

IKE version 2 is used for key exchange when establishing IPsec connections.

• Evidence demonstrating: IKE version 2 is used for key exchange when establishing IPsec connections.
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

AES-GCM is used for encryption of TLS connections.

• Evidence demonstrating: AES-GCM is used for encryption of TLS connections.
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

Only server-initiated secure renegotiation is used for TLS connections.

• Evidence demonstrating: Only server-initiated secure renegotiation is used for TLS connections.
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

DH or ECDH is used for key establishment of TLS connections.

• Evidence demonstrating: DH or ECDH is used for key establishment of TLS connections.
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

Anonymous DH is not used for TLS connections.

• Evidence demonstrating: Anonymous DH is not used for TLS connections.
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

SHA-2-based certificates are used for TLS connections.

• Evidence demonstrating: SHA-2-based certificates are used for TLS connections.
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

SHA-2 is used for the Hash-based Message Authentication Code (HMAC) and pseudorandom function (PRF) for TLS connections.

• Evidence demonstrating: SHA-2 is used for the Hash-based Message Authentication Code (HMAC) and pseudora
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

When using elliptic curve cryptography, a suitable curve from NIST SP 800-186 is used.

• Evidence demonstrating: When using elliptic curve cryptography, a suitable curve from NIST SP 800-186 is
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

When using DH or ECDH for key establishment of TLS connections, the ephemeral variant is used.

• Evidence demonstrating: When using DH or ECDH for key establishment of TLS connections, the ephemeral va
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

SSH private keys are protected with a password or a key encryption key.

• Evidence demonstrating: SSH private keys are protected with a password or a key encryption key.
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

Perfect Forward Secrecy (PFS) is used for TLS connections.

• Evidence demonstrating: Perfect Forward Secrecy (PFS) is used for TLS connections.
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

The use of SSH version 1 is disabled for SSH connections.

• Evidence demonstrating: The use of SSH version 1 is disabled for SSH connections.
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

TLS compression is disabled for TLS connections.

• Evidence demonstrating: TLS compression is disabled for TLS connections.
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

When using DH for agreeing on encryption session keys, a modulus and associated parameters are selected according to NIST SP 800-56A Rev. 3.

• Evidence demonstrating: When using DH for agreeing on encryption session keys, a modulus and associated
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

When using DH for agreeing on encryption session keys, a modulus of at least 3072 bits is used, preferably 3072 bits.

• Evidence demonstrating: When using DH for agreeing on encryption session keys, a modulus of at least 307
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

When using ECDH for agreeing on encryption session keys, NIST P-256, P-384 or P-521 curves are used, preferably the NIST P-384 curve.

• Evidence demonstrating: When using ECDH for agreeing on encryption session keys, NIST P-256, P-384 or P-
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

When using ECDH for agreeing on encryption session keys, NIST P-384 or P-521 curves are used, preferably the NIST P-384 curve.

• Evidence demonstrating: When using ECDH for agreeing on encryption session keys, NIST P-384 or P-521 cur
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

When using ECDSA for digital signatures, NIST P-256, P-384 or P-521 curves are used, preferably the NIST P-384 curve.

• Evidence demonstrating: When using ECDSA for digital signatures, NIST P-256, P-384 or P-521 curves are u
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

When using ECDSA for digital signatures, NIST P-384 or P-521 curves are used, preferably the NIST P-384 curve.

• Evidence demonstrating: When using ECDSA for digital signatures, NIST P-384 or P-521 curves are used, pr
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

When using RSA for digital signatures, and transporting encryption session keys (and similar keys), a modulus of at least 3072 bits is used, preferably 3072 bits.

• Evidence demonstrating: When using RSA for digital signatures, and transporting encryption session keys
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

When using SHA-2 for hashing, an output size of at least 224 bits is used, preferably SHA-384 or SHA-512.

• Evidence demonstrating: When using SHA-2 for hashing, an output size of at least 224 bits is used, prefe
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

When using SHA-2 for hashing, an output size of at least 256 bits is used, preferably SHA-384 or SHA-512.

• Evidence demonstrating: When using SHA-2 for hashing, an output size of at least 256 bits is used, prefe
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

When using SHA-2 for hashing, an output size of at least 384 bits is used, preferably SHA-384 or SHA-512.

• Evidence demonstrating: When using SHA-2 for hashing, an output size of at least 384 bits is used, prefe
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

When using AES for encryption, AES-128, AES-192 or AES-256 is used, preferably AES-256.

• Evidence demonstrating: When using AES for encryption, AES-128, AES-192 or AES-256 is used, preferably A
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

When using AES for encryption, AES-192 or AES-256 is used, preferably AES-256.

• Evidence demonstrating: When using AES for encryption, AES-192 or AES-256 is used, preferably AES-256.
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

AES is used for encrypting IPsec connections, preferably ENCR_AES_GCM_16.

• Evidence demonstrating: AES is used for encrypting IPsec connections, preferably ENCR AES GCM 16.
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

PRF_HMAC_SHA2_256, PRF_HMAC_SHA2_384 or PRF_HMAC_SHA2_512 is used for IPsec connections, preferably PRF_HMAC_SHA2_512.

• Evidence demonstrating: PRF HMAC SHA2 256, PRF HMAC SHA2 384 or PRF HMAC SHA2 512 is used for IPsec conn
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

HACE are issued an Approval for Use by ASD and operated in accordance with the latest version of their associated Australian Communications Security Instructions.

• Evidence demonstrating: HACE are issued an Approval for Use by ASD and operated in accordance with the l
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

The development and procurement of new cryptographic equipment, applications and libraries ensures support for the use of ML-DSA-87, ML-KEM-1024, SHA-384, SHA-512 and AES-256 by no later than 2030.

• Evidence demonstrating: The development and procurement of new cryptographic equipment, applications and
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

When using ML-DSA and ML-KEM, as per FIPS 204 and FIPS 203 respectively, adherence to pre-requisite FIPS 140-3 validation is preferred.

• Evidence demonstrating: When using ML-DSA and ML-KEM, as per FIPS 204 and FIPS 203 respectively, adheren
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

When using ML-DSA for digital signatures, ML-DSA-65 or ML-DSA-87 is used, preferably ML-DSA-87.

• Evidence demonstrating: When using ML-DSA for digital signatures, ML-DSA-65 or ML-DSA-87 is used, prefer
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

When using ML-DSA for digital signatures, the hedged variant is used whenever possible.

• Evidence demonstrating: When using ML-DSA for digital signatures, the hedged variant is used whenever po
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

Pre-hashed variants of ML-DSA-65 and ML-DSA-87 are only used when the performance of default variants is unacceptable.

• Evidence demonstrating: Pre-hashed variants of ML-DSA-65 and ML-DSA-87 are only used when the performanc
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

When the pre-hashed variants of ML-DSA-65 and ML-DSA-87 are used, at least SHA-384 and SHA-512 respectively are used for pre-hashing.

• Evidence demonstrating: When the pre-hashed variants of ML-DSA-65 and ML-DSA-87 are used, at least SHA-3
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

When using ML-KEM for encapsulating encryption session keys (and similar keys), ML-KEM-768 or ML-KEM-1024 is used, preferably ML-KEM-1024.

• Evidence demonstrating: When using ML-KEM for encapsulating encryption session keys (and similar keys),
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

When a post-quantum traditional hybrid scheme is used, either the post-quantum cryptographic algorithm, the traditional cryptographic algorithm or both are AACAs.

• Evidence demonstrating: When a post-quantum traditional hybrid scheme is used, either the post-quantum c
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

A post-quantum cryptography transition plan is developed, implemented and maintained.

• Evidence demonstrating: A post-quantum cryptography transition plan is developed, implemented and mainta
• ASD-Approved algorithm/protocol configuration
• Key management procedures
• TLS/SSH/IPsec configuration

• Non-approved or weak algorithms
• Poor key management

A cyber security strategy is developed, implemented and maintained.

• Evidence demonstrating: A cyber security strategy is developed, implemented and maintained.
• System security plans
• Standard operating procedures
• Current-as-at dates and approval records

• Documentation out of date
• No system security plan
• No annual review

Systems have a system security plan that includes an overview of the system (covering the system's purpose, the system boundary and how the system is managed) as well as an annex that covers applicable controls from this document and any additional controls that have been identified and implemented.

• Evidence demonstrating: Systems have a system security plan that includes an overview of the system (cov
• System security plans
• Standard operating procedures
• Current-as-at dates and approval records

• Documentation out of date
• No system security plan
• No annual review

Systems have a cyber security incident response plan that covers the following: - guidelines on what constitutes a cyber security incident - the types of cyber security incidents likely to be encountered and the expected response to each type - how to report cyber security incidents, internally to an organisation and externally to relevant authorities - other parties which need to be informed in the event of a cyber security incident - the authority, or authorities, responsible for investigating and responding to cyber security incidents - the criteria by which an investigation of a cyber security incident would be requested from a law enforcement agency, the Australian Signals Directorate or other relevant authority - the steps necessary to ensure the integrity of evidence relating to a cyber security incident - system contingency measures or a reference to such details if they are loca

• Evidence demonstrating: Systems have a cyber security incident response plan that covers the following:
• System security plans
• Standard operating procedures
• Current-as-at dates and approval records

• Documentation out of date
• No system security plan
• No annual review

Organisational-level cyber security documentation is approved by the chief information security officer while system-specific cyber security documentation is approved by the system's authorising officer.

• Evidence demonstrating: Organisational-level cyber security documentation is approved by the chief infor
• System security plans
• Standard operating procedures
• Current-as-at dates and approval records

• Documentation out of date
• No system security plan
• No annual review

Cyber security documentation is reviewed at least annually and includes a 'current as at \[date\]' or equivalent statement.

• Evidence demonstrating: Cyber security documentation is reviewed at least annually and includes a 'curre
• System security plans
• Standard operating procedures
• Current-as-at dates and approval records

• Documentation out of date
• No system security plan
• No annual review

Systems have a change and configuration management plan that includes: - the establishment and maintenance of authorised baseline configurations for systems - what constitutes routine and urgent changes to the configuration of systems - how changes to the configuration of systems will be requested, tracked and documented - who needs to be consulted prior to routine and urgent changes to the configuration of systems - who needs to approve routine and urgent changes to the configuration of systems - who needs to be notified of routine and urgent changes to the configuration of systems - what additional change management and configuration management processes and procedures need to be followed before, during and after routine and urgent changes to the configuration of systems.

• Evidence demonstrating: Systems have a change and configuration management plan that includes: - the est
• System security plans
• Standard operating procedures
• Current-as-at dates and approval records

• Documentation out of date
• No system security plan
• No annual review

Systems have a continuous monitoring plan that includes: - conducting vulnerability scans for systems at least fortnightly - conducting vulnerability assessments and penetration tests for systems prior to deployment, including prior to deployment of significant changes, and at least annually thereafter - analysing identified vulnerabilities to determine their potential impact - implementing mitigations based on risk, effectiveness and cost.

• Evidence demonstrating: Systems have a continuous monitoring plan that includes: - conducting vulnerabil
• System security plans
• Standard operating procedures
• Current-as-at dates and approval records

• Documentation out of date
• No system security plan
• No annual review

At the conclusion of a security assessment for a system, a security assessment report is produced by the assessor and covers: - the scope of the security assessment - the system's strengths and weaknesses - security risks associated with the operation of the system - the effectiveness of the implementation of controls - any recommended remediation actions.

• Evidence demonstrating: At the conclusion of a security assessment for a system, a security assessment r
• System security plans
• Standard operating procedures
• Current-as-at dates and approval records

• Documentation out of date
• No system security plan
• No annual review

At the conclusion of a security assessment for a system, a plan of action and milestones is produced by the system owner.

• Evidence demonstrating: At the conclusion of a security assessment for a system, a plan of action and mi
• System security plans
• Standard operating procedures
• Current-as-at dates and approval records

• Documentation out of date
• No system security plan
• No annual review

Cyber security documentation, including notification of subsequent changes, is communicated to all stakeholders.

• Evidence demonstrating: Cyber security documentation, including notification of subsequent changes, is c
• System security plans
• Standard operating procedures
• Current-as-at dates and approval records

• Documentation out of date
• No system security plan
• No annual review

A system's security architecture is approved prior to the development of the system.

• Evidence demonstrating: A system's security architecture is approved prior to the development of the sys
• System security plans
• Standard operating procedures
• Current-as-at dates and approval records

• Documentation out of date
• No system security plan
• No annual review

Cyber security personnel have access to sufficient data sources and tools to ensure that systems can be monitored for key indicators of compromise.

• Evidence demonstrating: Cyber security personnel have access to sufficient data sources and tools to ens
• Cyber security incident response plan
• Incident register
• Post-incident review records
• Reports to ASD/ACSC

• No incident response plan
• Incidents not reported to ASD
• No post-incident review

Cyber security incidents are reported to the chief information security officer, or one of their delegates, as soon as possible after they occur or are discovered.

• Evidence demonstrating: Cyber security incidents are reported to the chief information security officer,
• Cyber security incident response plan
• Incident register
• Post-incident review records
• Reports to ASD/ACSC

• No incident response plan
• Incidents not reported to ASD
• No post-incident review

A cyber security incident register is developed, implemented and maintained.

• Evidence demonstrating: A cyber security incident register is developed, implemented and maintained.
• Cyber security incident response plan
• Incident register
• Post-incident review records
• Reports to ASD/ACSC

• No incident response plan
• Incidents not reported to ASD
• No post-incident review

When a data spill occurs, data owners are advised and access to the data is restricted.

• Evidence demonstrating: When a data spill occurs, data owners are advised and access to the data is rest
• Cyber security incident response plan
• Incident register
• Post-incident review records
• Reports to ASD/ACSC

• No incident response plan
• Incidents not reported to ASD
• No post-incident review

Legal advice is sought before allowing intrusion activity to continue on a system for the purpose of collecting further data or evidence.

• Evidence demonstrating: Legal advice is sought before allowing intrusion activity to continue on a syste
• Cyber security incident response plan
• Incident register
• Post-incident review records
• Reports to ASD/ACSC

• No incident response plan
• Incidents not reported to ASD
• No post-incident review

The integrity of evidence gathered during an investigation is maintained by investigators: - recording all of their actions - maintaining a proper chain of custody - following all instructions provided by relevant law enforcement agencies.

• Evidence demonstrating: The integrity of evidence gathered during an investigation is maintained by inve
• Cyber security incident response plan
• Incident register
• Post-incident review records
• Reports to ASD/ACSC

• No incident response plan
• Incidents not reported to ASD
• No post-incident review

Cyber security incidents are reported to ASD as soon as possible after they occur or are discovered.

• Evidence demonstrating: Cyber security incidents are reported to ASD as soon as possible after they occu
• Cyber security incident response plan
• Incident register
• Post-incident review records
• Reports to ASD/ACSC

• No incident response plan
• Incidents not reported to ASD
• No post-incident review

A cyber security incident management policy, and associated cyber security incident response plan, is developed, implemented and maintained.

• Evidence demonstrating: A cyber security incident management policy, and associated cyber security incid
• Cyber security incident response plan
• Incident register
• Post-incident review records
• Reports to ASD/ACSC

• No incident response plan
• Incidents not reported to ASD
• No post-incident review

When malicious code is detected, the following steps are taken to handle the infection: - the infected systems are isolated - all previously connected media used in the period leading up to the infection are scanned for signs of infection and isolated if necessary - antivirus applications are used to remove the infection from infected systems and media - if the infection cannot be reliably removed, systems are restored from a known good backup or rebuilt.

• Evidence demonstrating: When malicious code is detected, the following steps are taken to handle the inf
• Cyber security incident response plan
• Incident register
• Post-incident review records
• Reports to ASD/ACSC

• No incident response plan
• Incidents not reported to ASD
• No post-incident review

Following intrusion remediation activities, full network traffic is captured for at least seven days and analysed to determine whether malicious actors have been successfully removed from the system.

• Evidence demonstrating: Following intrusion remediation activities, full network traffic is captured for
• Cyber security incident response plan
• Incident register
• Post-incident review records
• Reports to ASD/ACSC

• No incident response plan
• Incidents not reported to ASD
• No post-incident review

System owners are consulted before allowing intrusion activity to continue on a system for the purpose of collecting further data or evidence.

• Evidence demonstrating: System owners are consulted before allowing intrusion activity to continue on a
• Cyber security incident response plan
• Incident register
• Post-incident review records
• Reports to ASD/ACSC

• No incident response plan
• Incidents not reported to ASD
• No post-incident review

An insider threat mitigation program is developed, implemented and maintained.

• Evidence demonstrating: An insider threat mitigation program is developed, implemented and maintained.
• Cyber security incident response plan
• Incident register
• Post-incident review records
• Reports to ASD/ACSC

• No incident response plan
• Incidents not reported to ASD
• No post-incident review

Legal advice is sought regarding the development and implementation of an insider threat mitigation program.

• Evidence demonstrating: Legal advice is sought regarding the development and implementation of an inside
• Cyber security incident response plan
• Incident register
• Post-incident review records
• Reports to ASD/ACSC

• No incident response plan
• Incidents not reported to ASD
• No post-incident review

Planning and coordination of intrusion remediation activities are conducted on a separate system to that which has been compromised.

• Evidence demonstrating: Planning and coordination of intrusion remediation activities are conducted on a
• Cyber security incident response plan
• Incident register
• Post-incident review records
• Reports to ASD/ACSC

• No incident response plan
• Incidents not reported to ASD
• No post-incident review

To the extent possible, all intrusion remediation activities are conducted in a coordinated manner during the same planned outage.

• Evidence demonstrating: To the extent possible, all intrusion remediation activities are conducted in a
• Cyber security incident response plan
• Incident register
• Post-incident review records
• Reports to ASD/ACSC

• No incident response plan
• Incidents not reported to ASD
• No post-incident review

The cyber security incident management policy, including the associated cyber security incident response plan, is exercised at least annually.

• Evidence demonstrating: The cyber security incident management policy, including the associated cyber se
• Cyber security incident response plan
• Incident register
• Post-incident review records
• Reports to ASD/ACSC

• No incident response plan
• Incidents not reported to ASD
• No post-incident review

A cyber security incident register contains the following for each cyber security incident: - the date the cyber security incident occurred - the date the cyber security incident was discovered - a description of the cyber security incident - any actions taken in response to the cyber security incident - to whom the cyber security incident was reported.

• Evidence demonstrating: A cyber security incident register contains the following for each cyber securit
• Cyber security incident response plan
• Incident register
• Post-incident review records
• Reports to ASD/ACSC

• No incident response plan
• Incidents not reported to ASD
• No post-incident review

Following the identification of a cyber security incident, the cyber security incident response plan is enacted.

• Evidence demonstrating: Following the identification of a cyber security incident, the cyber security in
• Cyber security incident response plan
• Incident register
• Post-incident review records
• Reports to ASD/ACSC

• No incident response plan
• Incidents not reported to ASD
• No post-incident review

Cyber security incidents that involve customer data are reported to customers and the public in a timely manner after they occur or are discovered.

• Evidence demonstrating: Cyber security incidents that involve customer data are reported to customers an
• Cyber security incident response plan
• Incident register
• Post-incident review records
• Reports to ASD/ACSC

• No incident response plan
• Incidents not reported to ASD
• No post-incident review

Cyber security incidents that do not involve customer data are reported to customers and the public in a timely manner after they occur or are discovered.

• Evidence demonstrating: Cyber security incidents that do not involve customer data are reported to custo
• Cyber security incident response plan
• Incident register
• Post-incident review records
• Reports to ASD/ACSC

• No incident response plan
• Incidents not reported to ASD
• No post-incident review

Malicious code, when stored or communicated, is treated beforehand to prevent accidental execution.

• Evidence demonstrating: Malicious code, when stored or communicated, is treated beforehand to prevent ac
• Cyber security incident response plan
• Incident register
• Post-incident review records
• Reports to ASD/ACSC

• No incident response plan
• Incidents not reported to ASD
• No post-incident review

Malicious code processed for cyber security incident response or research purposes is done so in a dedicated analysis environment that is segregated from other systems.

• Evidence demonstrating: Malicious code processed for cyber security incident response or research purpos
• Cyber security incident response plan
• Incident register
• Post-incident review records
• Reports to ASD/ACSC

• No incident response plan
• Incidents not reported to ASD
• No post-incident review

System owners, in consultation with each system's authorising officer, identify any supplementary controls required based upon the unique nature of each system, its operating environment and the organisation's risk tolerances.

• Evidence demonstrating: System owners, in consultation with each system's authorising officer, identify
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

System owners obtain an authorisation to operate for each non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET system from its authorising officer.

• Evidence demonstrating: System owners obtain an authorisation to operate for each non-classified, OFFICI
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

A CISO is appointed to provide cyber security leadership and guidance for their organisation (covering information technology and operational technology).

• Evidence demonstrating: A CISO is appointed to provide cyber security leadership and guidance for their
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

The CISO oversees the management of cyber security personnel within their organisation.

• Evidence demonstrating: The CISO oversees the management of cyber security personnel within their organi
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

The CISO regularly reports directly to their organisation's board of directors or executive committee on cyber security matters.

• Evidence demonstrating: The CISO regularly reports directly to their organisation's board of directors o
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

The CISO oversees the development, implementation and maintenance of a cyber security communications strategy to assist in communicating the cyber security vision and strategy for their organisation.

• Evidence demonstrating: The CISO oversees the development, implementation and maintenance of a cyber sec
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

The CISO implements cyber security measurement metrics and key performance indicators for their organisation.

• Evidence demonstrating: The CISO implements cyber security measurement metrics and key performance indic
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

The CISO coordinates cyber security and business alignment through a cyber security steering committee or advisory board, comprising of key cyber security and business executives, which meets formally and on a regular basis.

• Evidence demonstrating: The CISO coordinates cyber security and business alignment through a cyber secur
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

The CISO coordinates security risk management activities between cyber security and business teams.

• Evidence demonstrating: The CISO coordinates security risk management activities between cyber security
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

The CISO oversees cyber supply chain risk management activities for their organisation.

• Evidence demonstrating: The CISO oversees cyber supply chain risk management activities for their organi
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

The CISO receives and manages a dedicated cyber security budget for their organisation.

• Evidence demonstrating: The CISO receives and manages a dedicated cyber security budget for their organi
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

The CISO is fully aware of all cyber security incidents within their organisation.

• Evidence demonstrating: The CISO is fully aware of all cyber security incidents within their organisatio
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

The CISO contributes to the development, implementation and maintenance of business continuity and disaster recovery plans for their organisation to ensure that business-critical services are supported appropriately in the event of a disaster.

• Evidence demonstrating: The CISO contributes to the development, implementation and maintenance of busin
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

The CISO oversees the development, implementation and maintenance of their organisation's cyber security awareness training program.

• Evidence demonstrating: The CISO oversees the development, implementation and maintenance of their organ
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

Each system has a designated system owner.

• Evidence demonstrating: Each system has a designated system owner.
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

System owners, in consultation with each system's authorising officer, conduct a threat and risk assessment for each system.

• Evidence demonstrating: System owners, in consultation with each system's authorising officer, conduct a
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

The CISO oversees their organisation's cyber security program and ensures their organisation's compliance with cyber security policy, standards, regulations and legislation.

• Evidence demonstrating: The CISO oversees their organisation's cyber security program and ensures their
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

System owners register each system with its authorising officer.

• Evidence demonstrating: System owners register each system with its authorising officer.
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

System owners continuously monitor the security of each system, and manage associated cyber threats, security risks and controls.

• Evidence demonstrating: System owners continuously monitor the security of each system, and manage assoc
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

System owners report the security status of each system to its authorising officer at least annually.

• Evidence demonstrating: System owners report the security status of each system to its authorising offic
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

The CISO regularly reviews and updates their organisation's cyber security program to ensure its relevance in addressing cyber threats and harnessing business and cyber security opportunities.

• Evidence demonstrating: The CISO regularly reviews and updates their organisation's cyber security progr
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

The CISO oversees their organisation's response to cyber security incidents.

• Evidence demonstrating: The CISO oversees their organisation's response to cyber security incidents.
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

System owners, in consultation with each system's authorising officer, determine the system boundary, business criticality, and security and resilience objectives for each system based on an assessment of the impact if it were to be compromised or attacked.

• Evidence demonstrating: System owners, in consultation with each system's authorising officer, determine
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

System owners, in consultation with each system's authorising officer, select controls for each system and tailor them to achieve desired security and resilience objectives.

• Evidence demonstrating: System owners, in consultation with each system's authorising officer, select co
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

System owners implement controls for each system and its operating environment.

• Evidence demonstrating: System owners implement controls for each system and its operating environment.
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

System owners, in consultation with each system's authorising officer, ensure controls for each non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET system and its operating environment undergo a security assessment by their organisation's own assessors or Infosec Registered Assessor Program (IRAP) assessors to determine if they have been implemented correctly and are operating as intended.

• Evidence demonstrating: System owners, in consultation with each system's authorising officer, ensure co
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

The CISO regularly reports directly to their organisation's audit, risk and compliance committee (or equivalent) on cyber security matters.

• Evidence demonstrating: The CISO regularly reports directly to their organisation's audit, risk and comp
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

The CISO develops, implements, maintains and verifies on a regular basis a register of systems used by their organisation.

• Evidence demonstrating: The CISO develops, implements, maintains and verifies on a regular basis a regis
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

System owners, in consultation with each system's authorising officer, ensure controls for each TOP SECRET system and its operating environment, including each sensitive compartmented information system and its operating environment, undergo a security assessment by ASD assessors (or their delegates) to determine if they have been implemented correctly and are operating as intended.

• Evidence demonstrating: System owners, in consultation with each system's authorising officer, ensure co
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

System owners obtain an authorisation to operate for each TOP SECRET system, including for each sensitive compartmented information system, from Director-General ASD (or their delegate).

• Evidence demonstrating: System owners obtain an authorisation to operate for each TOP SECRET system, inc
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

The board of directors or executive committee defines clear roles and responsibilities for cyber security both within the board of directors or executive committee and broadly within their organisation.

• Evidence demonstrating: The board of directors or executive committee defines clear roles and responsibi
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

The board of directors or executive committee ensures that cyber security is integrated throughout all business functions within their organisation.

• Evidence demonstrating: The board of directors or executive committee ensures that cyber security is int
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

The board of directors or executive committee ensures the cyber security strategy for their organisation is aligned with the overarching strategic direction and business strategy for their organisation.

• Evidence demonstrating: The board of directors or executive committee ensures the cyber security strateg
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

The board of directors or executive committee seeks regular briefings or reporting on the cyber security posture of their organisation, as well as the threat environment in which they operate, from internal and external subject matter experts.

• Evidence demonstrating: The board of directors or executive committee seeks regular briefings or reporti
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

The board of directors or executive committee champions a positive cyber security culture within their organisation, including through leading by example.

• Evidence demonstrating: The board of directors or executive committee champions a positive cyber securit
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

The board of directors or executive committee maintains a sufficient level of cyber security literacy to fulfil both their fiduciary duties and any legislative or regulatory obligations.

• Evidence demonstrating: The board of directors or executive committee maintains a sufficient level of cy
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

The board of directors or executive committee maintains awareness of key cyber security recruitment activities, retention rates for cyber security personnel, and cyber security skills and experience gaps within their organisation.

• Evidence demonstrating: The board of directors or executive committee maintains awareness of key cyber s
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

The board of directors or executive committee supports the development of cyber security skills and experience for all personnel via internal and external cyber security awareness raising and training opportunities.

• Evidence demonstrating: The board of directors or executive committee supports the development of cyber
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

The board of directors or executive committee understands the business criticality of their organisation's systems, including at least a basic understanding of what exists, their value, where they reside, who has access, who might seek access, how they are protected, and how that protection is verified.

• Evidence demonstrating: The board of directors or executive committee understands the business criticali
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

The board of directors or executive committee plans for major cyber security incidents, including by participating in exercises, and understand their duties in relation to such cyber security incidents.

• Evidence demonstrating: The board of directors or executive committee plans for major cyber security inc
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

The CISO ensures sufficient cyber security personnel, with the right skills and experience, are acquired to support cyber security activities within their organisation.

• Evidence demonstrating: The CISO ensures sufficient cyber security personnel, with the right skills and
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

System owners implement and maintain data minimisation practices for each of their systems.

• Evidence demonstrating: System owners implement and maintain data minimisation practices for each of the
• CISO appointment record
• Role descriptions / RACI
• Resourcing and reporting lines

• Accountable executive not designated
• Cyber roles undefined or unfilled

When manually importing data to systems, the data is scanned for malicious and active content.

• Evidence demonstrating: When manually importing data to systems, the data is scanned for malicious and a
• Data transfer logs
• Export review and authorisation records
• Content inspection / quarantine evidence

• Unauthorised data exports
• Transfers not logged or reviewed

Data transfer logs for SECRET and TOP SECRET systems are fully verified at least monthly.

• Evidence demonstrating: Data transfer logs for SECRET and TOP SECRET systems are fully verified at least
• Data transfer logs
• Export review and authorisation records
• Content inspection / quarantine evidence

• Unauthorised data exports
• Transfers not logged or reviewed

Users transferring data to and from systems are held accountable for data transfers they perform.

• Evidence demonstrating: Users transferring data to and from systems are held accountable for data transf
• Data transfer logs
• Export review and authorisation records
• Content inspection / quarantine evidence

• Unauthorised data exports
• Transfers not logged or reviewed

Data transfer processes, and supporting data transfer procedures, are developed, implemented and maintained.

• Evidence demonstrating: Data transfer processes, and supporting data transfer procedures, are developed,
• Data transfer logs
• Export review and authorisation records
• Content inspection / quarantine evidence

• Unauthorised data exports
• Transfers not logged or reviewed

Data exported from SECRET and TOP SECRET systems is reviewed and authorised by a trustworthy source beforehand.

• Evidence demonstrating: Data exported from SECRET and TOP SECRET systems is reviewed and authorised by a
• Data transfer logs
• Export review and authorisation records
• Content inspection / quarantine evidence

• Unauthorised data exports
• Transfers not logged or reviewed

Trustworthy sources for SECRET and TOP SECRET systems are limited to people and services that have been verified and authorised as such by the chief information security officer.

• Evidence demonstrating: Trustworthy sources for SECRET and TOP SECRET systems are limited to people and
• Data transfer logs
• Export review and authorisation records
• Content inspection / quarantine evidence

• Unauthorised data exports
• Transfers not logged or reviewed

When manually exporting data from SECRET and TOP SECRET systems, digital signatures are validated and keyword checks are performed within all textual data.

• Evidence demonstrating: When manually exporting data from SECRET and TOP SECRET systems, digital signatu
• Data transfer logs
• Export review and authorisation records
• Content inspection / quarantine evidence

• Unauthorised data exports
• Transfers not logged or reviewed

Data authorised for export from SECRET and TOP SECRET systems is digitally signed by a trustworthy source.

• Evidence demonstrating: Data authorised for export from SECRET and TOP SECRET systems is digitally signe
• Data transfer logs
• Export review and authorisation records
• Content inspection / quarantine evidence

• Unauthorised data exports
• Transfers not logged or reviewed

When manually exporting data from systems, the data is checked for unsuitable protective markings.

• Evidence demonstrating: When manually exporting data from systems, the data is checked for unsuitable pr
• Data transfer logs
• Export review and authorisation records
• Content inspection / quarantine evidence

• Unauthorised data exports
• Transfers not logged or reviewed

Data transfer logs for systems are partially verified at least monthly.

• Evidence demonstrating: Data transfer logs for systems are partially verified at least monthly.
• Data transfer logs
• Export review and authorisation records
• Content inspection / quarantine evidence

• Unauthorised data exports
• Transfers not logged or reviewed

Processes, and supporting procedures, are developed, implemented and maintained to prevent AUSTEO, AGAO and REL data in textual and non-textual formats from being exported to unsuitable foreign systems.

• Evidence demonstrating: Processes, and supporting procedures, are developed, implemented and maintained
• Data transfer logs
• Export review and authorisation records
• Content inspection / quarantine evidence

• Unauthorised data exports
• Transfers not logged or reviewed

Data transfer logs are used to record all data imports and exports from systems.

• Evidence demonstrating: Data transfer logs are used to record all data imports and exports from systems.
• Data transfer logs
• Export review and authorisation records
• Content inspection / quarantine evidence

• Unauthorised data exports
• Transfers not logged or reviewed

When manually importing data to systems, all data that fails security checks is quarantined until reviewed and subsequently approved or not approved for release.

• Evidence demonstrating: When manually importing data to systems, all data that fails security checks is
• Data transfer logs
• Export review and authorisation records
• Content inspection / quarantine evidence

• Unauthorised data exports
• Transfers not logged or reviewed

When manually exporting data from systems, all data that fails security checks is quarantined until reviewed and subsequently approved or not approved for release.

• Evidence demonstrating: When manually exporting data from systems, all data that fails security checks i
• Data transfer logs
• Export review and authorisation records
• Content inspection / quarantine evidence

• Unauthorised data exports
• Transfers not logged or reviewed

Databases and their contents are classified based on the sensitivity or classification of data that they contain.

• Evidence demonstrating: Databases and their contents are classified based on the sensitivity or classifi
• Database hardening configuration
• Database access control records
• Encryption of database communications/data

• Databases not hardened
• Excessive database privileges

A database register is developed, implemented, maintained and verified on a regular basis.

• Evidence demonstrating: A database register is developed, implemented, maintained and verified on a regu
• Database hardening configuration
• Database access control records
• Encryption of database communications/data

• Databases not hardened
• Excessive database privileges

Database users' ability to access, insert, modify and remove database contents is restricted based on their work duties.

• Evidence demonstrating: Database users' ability to access, insert, modify and remove database contents i
• Database hardening configuration
• Database access control records
• Encryption of database communications/data

• Databases not hardened
• Excessive database privileges

File-based access controls are applied to database files.

• Evidence demonstrating: File-based access controls are applied to database files.
• Database hardening configuration
• Database access control records
• Encryption of database communications/data

• Databases not hardened
• Excessive database privileges

The need-to-know principle is enforced for database contents through the application of minimum privileges, database views, database roles and data tokenisation.

• Evidence demonstrating: The need-to-know principle is enforced for database contents through the applica
• Database hardening configuration
• Database access control records
• Encryption of database communications/data

• Databases not hardened
• Excessive database privileges

Database servers and web servers are functionally separated.

• Evidence demonstrating: Database servers and web servers are functionally separated.
• Database hardening configuration
• Database access control records
• Encryption of database communications/data

• Databases not hardened
• Excessive database privileges

Database servers are placed on a different network segment to user workstations.

• Evidence demonstrating: Database servers are placed on a different network segment to user workstations.
• Database hardening configuration
• Database access control records
• Encryption of database communications/data

• Databases not hardened
• Excessive database privileges

Network access controls are implemented to restrict database server communications to strictly defined network resources that require access to the database server.

• Evidence demonstrating: Network access controls are implemented to restrict database server communicatio
• Database hardening configuration
• Database access control records
• Encryption of database communications/data

• Databases not hardened
• Excessive database privileges

If only local access to a database is required, networking functionality of database management system applications are disabled or directed to listen solely to the localhost interface.

• Evidence demonstrating: If only local access to a database is required, networking functionality of data
• Database hardening configuration
• Database access control records
• Encryption of database communications/data

• Databases not hardened
• Excessive database privileges

Database servers for development, testing, staging and production environments are segregated.

• Evidence demonstrating: Database servers for development, testing, staging and production environments a
• Database hardening configuration
• Database access control records
• Encryption of database communications/data

• Databases not hardened
• Excessive database privileges

Database contents from production environments are not used in non-production environments unless the non-production environment is secured to at least the same level as the production environment.

• Evidence demonstrating: Database contents from production environments are not used in non-production en
• Database hardening configuration
• Database access control records
• Encryption of database communications/data

• Databases not hardened
• Excessive database privileges

Data communicated between database servers and web servers is encrypted.

• Evidence demonstrating: Data communicated between database servers and web servers is encrypted.
• Database hardening configuration
• Database access control records
• Encryption of database communications/data

• Databases not hardened
• Excessive database privileges

Security-relevant events for databases are centrally logged, including: - access or modification of particularly important content - addition of new users, especially privileged users - changes to user roles or privileges - attempts to elevate user privileges - queries containing comments - queries containing multiple embedded queries - database and query alerts or failures - database structure changes - database administrator actions - use of executable commands - database logons and logoffs.

• Evidence demonstrating: Security-relevant events for databases are centrally logged, including: - access
• Database hardening configuration
• Database access control records
• Encryption of database communications/data

• Databases not hardened
• Excessive database privileges

An email usage policy is developed, implemented and maintained.

• Evidence demonstrating: An email usage policy is developed, implemented and maintained.
• Email protective marking configuration
• SPF/DKIM/DMARC records
• Email content filtering configuration

• No DMARC/SPF/DKIM
• No email content filtering
• Protective marking not applied

Access to non-approved webmail services is blocked.

• Evidence demonstrating: Access to non-approved webmail services is blocked.
• Email protective marking configuration
• SPF/DKIM/DMARC records
• Email content filtering configuration

• No DMARC/SPF/DKIM
• No email content filtering
• Protective marking not applied

Emails containing Australian Eyes Only, Australian Government Access Only or Releasable To data are not sent to email distribution lists unless the nationality of all members of email distribution lists can be confirmed.

• Evidence demonstrating: Emails containing Australian Eyes Only, Australian Government Access Only or Rel
• Email protective marking configuration
• SPF/DKIM/DMARC records
• Email content filtering configuration

• No DMARC/SPF/DKIM
• No email content filtering
• Protective marking not applied

Protective markings are applied to emails and reflect the highest sensitivity or classification of the subject, body and attachments.

• Evidence demonstrating: Protective markings are applied to emails and reflect the highest sensitivity or
• Email protective marking configuration
• SPF/DKIM/DMARC records
• Email content filtering configuration

• No DMARC/SPF/DKIM
• No email content filtering
• Protective marking not applied

Protective marking tools do not automatically insert protective markings into emails.

• Evidence demonstrating: Protective marking tools do not automatically insert protective markings into em
• Email protective marking configuration
• SPF/DKIM/DMARC records
• Email content filtering configuration

• No DMARC/SPF/DKIM
• No email content filtering
• Protective marking not applied

Protective marking tools do not allow users to select protective markings that a system has not been authorised to process, store or communicate.

• Evidence demonstrating: Protective marking tools do not allow users to select protective markings that a
• Email protective marking configuration
• SPF/DKIM/DMARC records
• Email content filtering configuration

• No DMARC/SPF/DKIM
• No email content filtering
• Protective marking not applied

Email servers are configured to block, log and report emails with inappropriate protective markings.

• Evidence demonstrating: Email servers are configured to block, log and report emails with inappropriate
• Email protective marking configuration
• SPF/DKIM/DMARC records
• Email content filtering configuration

• No DMARC/SPF/DKIM
• No email content filtering
• Protective marking not applied

Email servers only relay emails destined for or originating from their domains (including subdomains).

• Evidence demonstrating: Email servers only relay emails destined for or originating from their domains (
• Email protective marking configuration
• SPF/DKIM/DMARC records
• Email content filtering configuration

• No DMARC/SPF/DKIM
• No email content filtering
• Protective marking not applied

Emails are routed via centralised email gateways.

• Evidence demonstrating: Emails are routed via centralised email gateways.
• Email protective marking configuration
• SPF/DKIM/DMARC records
• Email content filtering configuration

• No DMARC/SPF/DKIM
• No email content filtering
• Protective marking not applied

Where backup or alternative email gateways are in place, they are maintained at the same standard as the primary email gateway.

• Evidence demonstrating: Where backup or alternative email gateways are in place, they are maintained at
• Email protective marking configuration
• SPF/DKIM/DMARC records
• Email content filtering configuration

• No DMARC/SPF/DKIM
• No email content filtering
• Protective marking not applied

When users send or receive emails, an authenticated and encrypted channel is used to route emails via their organisation's centralised email gateways.

• Evidence demonstrating: When users send or receive emails, an authenticated and encrypted channel is use
• Email protective marking configuration
• SPF/DKIM/DMARC records
• Email content filtering configuration

• No DMARC/SPF/DKIM
• No email content filtering
• Protective marking not applied

Opportunistic TLS encryption is enabled on email servers that make incoming or outgoing email connections over public network infrastructure.

• Evidence demonstrating: Opportunistic TLS encryption is enabled on email servers that make incoming or o
• Email protective marking configuration
• SPF/DKIM/DMARC records
• Email content filtering configuration

• No DMARC/SPF/DKIM
• No email content filtering
• Protective marking not applied

SPF is used to specify authorised email servers (or lack thereof) for an organisation's domains (including subdomains).

• Evidence demonstrating: SPF is used to specify authorised email servers (or lack thereof) for an organis
• Email protective marking configuration
• SPF/DKIM/DMARC records
• Email content filtering configuration

• No DMARC/SPF/DKIM
• No email content filtering
• Protective marking not applied

DKIM signing is enabled on emails originating from an organisation's domains (including subdomains).

• Evidence demonstrating: DKIM signing is enabled on emails originating from an organisation's domains (in
• Email protective marking configuration
• SPF/DKIM/DMARC records
• Email content filtering configuration

• No DMARC/SPF/DKIM
• No email content filtering
• Protective marking not applied

The intended recipients of blocked inbound emails, and the senders of blocked outbound emails, are notified.

• Evidence demonstrating: The intended recipients of blocked inbound emails, and the senders of blocked ou
• Email protective marking configuration
• SPF/DKIM/DMARC records
• Email content filtering configuration

• No DMARC/SPF/DKIM
• No email content filtering
• Protective marking not applied

Notifications of undeliverable emails are only sent to senders that can be verified via SPF or other trusted means.

• Evidence demonstrating: Notifications of undeliverable emails are only sent to senders that can be verif
• Email protective marking configuration
• SPF/DKIM/DMARC records
• Email content filtering configuration

• No DMARC/SPF/DKIM
• No email content filtering
• Protective marking not applied

DKIM signatures on incoming emails are verified.

• Evidence demonstrating: DKIM signatures on incoming emails are verified.
• Email protective marking configuration
• SPF/DKIM/DMARC records
• Email content filtering configuration

• No DMARC/SPF/DKIM
• No email content filtering
• Protective marking not applied

Email distribution list applications used by external senders is configured such that it does not break the validity of the sender's DKIM signature.

• Evidence demonstrating: Email distribution list applications used by external senders is configured such
• Email protective marking configuration
• SPF/DKIM/DMARC records
• Email content filtering configuration

• No DMARC/SPF/DKIM
• No email content filtering
• Protective marking not applied

Protective marking tools do not allow users replying to or forwarding emails to select protective markings lower than previously used.

• Evidence demonstrating: Protective marking tools do not allow users replying to or forwarding emails to
• Email protective marking configuration
• SPF/DKIM/DMARC records
• Email content filtering configuration

• No DMARC/SPF/DKIM
• No email content filtering
• Protective marking not applied

SPF is used to verify the authenticity of incoming emails.

• Evidence demonstrating: SPF is used to verify the authenticity of incoming emails.
• Email protective marking configuration
• SPF/DKIM/DMARC records
• Email content filtering configuration

• No DMARC/SPF/DKIM
• No email content filtering
• Protective marking not applied

A hard fail SPF record is used when specifying authorised email servers (or lack thereof) for an organisation's domains (including subdomains).

• Evidence demonstrating: A hard fail SPF record is used when specifying authorised email servers (or lack
• Email protective marking configuration
• SPF/DKIM/DMARC records
• Email content filtering configuration

• No DMARC/SPF/DKIM
• No email content filtering
• Protective marking not applied

Email content filtering is implemented to filter potentially harmful content in email bodies and attachments.

• Evidence demonstrating: Email content filtering is implemented to filter potentially harmful content in
• Email protective marking configuration
• SPF/DKIM/DMARC records
• Email content filtering configuration

• No DMARC/SPF/DKIM
• No email content filtering
• Protective marking not applied

Emails arriving via an external connection where the email source address uses an internal domain, or internal subdomain, are blocked at the email gateway.

• Evidence demonstrating: Emails arriving via an external connection where the email source address uses a
• Email protective marking configuration
• SPF/DKIM/DMARC records
• Email content filtering configuration

• No DMARC/SPF/DKIM
• No email content filtering
• Protective marking not applied

DMARC records are configured for an organisation's domains (including subdomains) such that emails are rejected if they do not pass DMARC checks.

• Evidence demonstrating: DMARC records are configured for an organisation's domains (including subdomains
• Email protective marking configuration
• SPF/DKIM/DMARC records
• Email content filtering configuration

• No DMARC/SPF/DKIM
• No email content filtering
• Protective marking not applied

MTA-STS is enabled to prevent the unencrypted transfer of emails between email servers.

• Evidence demonstrating: MTA-STS is enabled to prevent the unencrypted transfer of emails between email s
• Email protective marking configuration
• SPF/DKIM/DMARC records
• Email content filtering configuration

• No DMARC/SPF/DKIM
• No email content filtering
• Protective marking not applied

Incoming emails are rejected if they do not pass DMARC checks.

• Evidence demonstrating: Incoming emails are rejected if they do not pass DMARC checks.
• Email protective marking configuration
• SPF/DKIM/DMARC records
• Email content filtering configuration

• No DMARC/SPF/DKIM
• No email content filtering
• Protective marking not applied

Paging, Multimedia Message Service, Short Message Service and messaging apps are not used to communicate sensitive or classified data.

• Evidence demonstrating: Paging, Multimedia Message Service, Short Message Service and messaging apps are
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Bluetooth functionality is not enabled on SECRET and TOP SECRET mobile devices.

• Evidence demonstrating: Bluetooth functionality is not enabled on SECRET and TOP SECRET mobile devices.
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Mobile devices that access SECRET or TOP SECRET systems or data use mobile platforms that have been issued an Approval for Use by ASD and are operated in accordance with the latest version of their associated Australian Communications Security Instruction.

• Evidence demonstrating: Mobile devices that access SECRET or TOP SECRET systems or data use mobile platf
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Privately-owned mobile devices and desktop computers do not access SECRET and TOP SECRET systems or data.

• Evidence demonstrating: Privately-owned mobile devices and desktop computers do not access SECRET and TO
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Mobile device emergency sanitisation processes, and supporting mobile device emergency sanitisation procedures, are developed, implemented and maintained.

• Evidence demonstrating: Mobile device emergency sanitisation processes, and supporting mobile device eme
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

If a cryptographic zeroise or sanitise function is provided for cryptographic keys on a SECRET or TOP SECRET mobile device, the function is used as part of mobile device emergency sanitisation processes and procedures.

• Evidence demonstrating: If a cryptographic zeroise or sanitise function is provided for cryptographic ke
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

When accessing an organisation's network via a VPN connection, split tunnelling is disabled.

• Evidence demonstrating: When accessing an organisation's network via a VPN connection, split tunnelling
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Mobile devices prevent personnel from installing non-approved applications once provisioned.

• Evidence demonstrating: Mobile devices prevent personnel from installing non-approved applications once
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Mobile devices prevent personnel from disabling or modifying security functionality once provisioned.

• Evidence demonstrating: Mobile devices prevent personnel from disabling or modifying security functional
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Sensitive or classified data is not viewed on mobile devices in public locations unless care is taken to reduce the chance of the screen of a mobile device being observed.

• Evidence demonstrating: Sensitive or classified data is not viewed on mobile devices in public locations
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Mobile devices encrypt their internal storage and any removable media.

• Evidence demonstrating: Mobile devices encrypt their internal storage and any removable media.
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Mobile devices are carried or stored in a secured state when not being actively used.

• Evidence demonstrating: Mobile devices are carried or stored in a secured state when not being actively
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Mobile devices are kept under continual direct supervision when being actively used.

• Evidence demonstrating: Mobile devices are kept under continual direct supervision when being actively u
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Mobile devices and desktop computers access the internet via an organisation's internet gateway rather than via a direct connection to the internet.

• Evidence demonstrating: Mobile devices and desktop computers access the internet via an organisation's i
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

A mobile device usage policy is developed, implemented and maintained.

• Evidence demonstrating: A mobile device usage policy is developed, implemented and maintained.
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Personnel are advised of the sensitivity or classification permitted for voice and data communications when using mobile devices.

• Evidence demonstrating: Personnel are advised of the sensitivity or classification permitted for voice a
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

If unable to carry or store mobile devices in a secured state, they are physically transferred in a security briefcase or an approved multi-use satchel, pouch or transit bag.

• Evidence demonstrating: If unable to carry or store mobile devices in a secured state, they are physical
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Mobile devices encrypt all sensitive or classified data communicated over public network infrastructure.

• Evidence demonstrating: Mobile devices encrypt all sensitive or classified data communicated over public
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Personnel report the potential compromise of mobile devices, removable media or credentials to their organisation as soon as possible, especially if they: - provide credentials to foreign government officials - decrypt mobile devices for foreign government officials - have mobile devices taken out of sight by foreign government officials - have mobile devices or removable media stolen, including if later returned - lose mobile devices or removable media, including if later found - observe unusual behaviour of mobile devices.

• Evidence demonstrating: Personnel report the potential compromise of mobile devices, removable media or
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Privacy filters are applied to the screens of SECRET and TOP SECRET mobile devices.

• Evidence demonstrating: Privacy filters are applied to the screens of SECRET and TOP SECRET mobile devic
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Mobile Device Management solutions that have completed a Common Criteria evaluation against the Protection Profile for Mobile Device Management, version 4.0 or later, are used to enforce mobile device management policy.

• Evidence demonstrating: Mobile Device Management solutions that have completed a Common Criteria evaluat
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices are configured to remain undiscoverable to other Bluetooth devices except during Bluetooth pairing.

• Evidence demonstrating: Non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices are configured
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Bluetooth pairing for non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices is performed in a manner such that connections are only made between intended Bluetooth devices.

• Evidence demonstrating: Bluetooth pairing for non-classified, OFFICIAL: Sensitive and PROTECTED mobile d
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Bluetooth pairings for non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices are removed when there is no longer a requirement for their use.

• Evidence demonstrating: Bluetooth pairings for non-classified, OFFICIAL: Sensitive and PROTECTED mobile
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Bluetooth pairing for non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices is performed using Secure Connections, preferably with Numeric Comparison if supported.

• Evidence demonstrating: Bluetooth pairing for non-classified, OFFICIAL: Sensitive and PROTECTED mobile d
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Legal advice is sought prior to allowing privately-owned mobile devices and desktop computers to access systems or data.

• Evidence demonstrating: Legal advice is sought prior to allowing privately-owned mobile devices and desk
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Personnel are advised of privacy and security risks when travelling overseas with mobile devices.

• Evidence demonstrating: Personnel are advised of privacy and security risks when travelling overseas wit
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Personnel are advised to take the following precautions when using mobile devices: - never leave mobile devices or removable media unattended, including by placing them in checked-in luggage or leaving them in hotel safes - never store credentials with mobile devices that they grant access to, such as in laptop computer bags - never lend mobile devices or removable media to untrusted people, even if briefly - never allow untrusted people to connect their mobile devices or removable media to your mobile devices, including for charging - never connect mobile devices to designated charging stations or wall outlet charging ports - never use gifted or unauthorised peripherals, chargers or removable media with mobile devices - never use removable media for data transfers or backups that have not been checked for malicious code beforehand - avoid reuse of removable media once used with other pa

• Evidence demonstrating: Personnel are advised to take the following precautions when using mobile device
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Upon returning from travelling overseas with mobile devices, personnel take the following actions: - sanitise and reset mobile devices, including all removable media - decommission any credentials that left their possession during their travel - report if significant doubt exists as to the integrity of any mobile devices or removable media.

• Evidence demonstrating: Upon returning from travelling overseas with mobile devices, personnel take the
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Security updates are applied to mobile devices as soon as they become available.

• Evidence demonstrating: Security updates are applied to mobile devices as soon as they become available.
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Personnel using privately-owned mobile devices or desktop computers to access OFFICIAL: Sensitive or PROTECTED systems or data have enforced separation of classified data and personal data.

• Evidence demonstrating: Personnel using privately-owned mobile devices or desktop computers to access OF
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Personnel using organisation-owned mobile devices or desktop computers to access classified systems or data have enforced separation of classified data and personal data.

• Evidence demonstrating: Personnel using organisation-owned mobile devices or desktop computers to access
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

A mobile device management policy is developed, implemented and maintained.

• Evidence demonstrating: A mobile device management policy is developed, implemented and maintained.
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

If travelling overseas with mobile devices to high or extreme risk countries, personnel are: - issued with newly provisioned user accounts, mobile devices and removable media from a pool of dedicated travel devices which are used solely for work-related activities - advised on how to apply and inspect tamper seals to key areas of mobile devices - advised to avoid taking any personal mobile devices, especially if rooted or jailbroken.

• Evidence demonstrating: If travelling overseas with mobile devices to high or extreme risk countries, pe
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Before travelling overseas with mobile devices, personnel take the following actions: - record all details of the mobile devices being taken, such as product types, serial numbers and International Mobile Equipment Identity numbers - update all operating systems and applications - remove all non-essential data, applications and user accounts - backup all remaining data, applications and settings.

• Evidence demonstrating: Before travelling overseas with mobile devices, personnel take the following act
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

If returning from travelling overseas with mobile devices to high or extreme risk countries, personnel take the following additional actions: - reset credentials used with mobile devices, including those used for remote access to their organisation's systems - monitor user accounts for any indicators of compromise, such as failed logon attempts.

• Evidence demonstrating: If returning from travelling overseas with mobile devices to high or extreme ris
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Sensitive or classified phone calls and conversations are not conducted in public locations unless care is taken to reduce the chance of conversations being overheard.

• Evidence demonstrating: Sensitive or classified phone calls and conversations are not conducted in publi
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Personnel using privately-owned mobile devices or desktop computers to access OFFICIAL: Sensitive or PROTECTED systems or data are prevented from storing classified data on their privately-owned mobile devices and desktop computers.

• Evidence demonstrating: Personnel using privately-owned mobile devices or desktop computers to access OF
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Mobile devices that access OFFICIAL: Sensitive or PROTECTED systems or data use mobile platforms that have completed a Common Criteria evaluation against the Protection Profile for Mobile Device Fundamentals, version 3.3 or later, and are operated in accordance with the latest version of their associated ASD security configuration guide.

• Evidence demonstrating: Mobile devices that access OFFICIAL: Sensitive or PROTECTED systems or data use
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

SECRET and TOP SECRET mobile devices do not use removable media unless approved beforehand by ASD.

• Evidence demonstrating: SECRET and TOP SECRET mobile devices do not use removable media unless approved
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Mobile devices are configured to operate in a supervised (or equivalent) mode.

• Evidence demonstrating: Mobile devices are configured to operate in a supervised (or equivalent) mode.
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Mobile devices are configured with remote locate and wipe functionality.

• Evidence demonstrating: Mobile devices are configured with remote locate and wipe functionality.
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Mobile devices are configured with secure password-based lock screens.

• Evidence demonstrating: Mobile devices are configured with secure password-based lock screens.
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Personnel using privately-owned mobile devices or desktop computers to access OFFICIAL: Sensitive or PROTECTED systems or data are disallowed from granting access to unapproved artificial intelligence agents.

• Evidence demonstrating: Personnel using privately-owned mobile devices or desktop computers to access OF
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Mobile devices are configured to enforce separation between organisational and personal mobile applications and data.

• Evidence demonstrating: Mobile devices are configured to enforce separation between organisational and p
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Mobile devices are configured with always on VPN functionality.

• Evidence demonstrating: Mobile devices are configured with always on VPN functionality.
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Mobile devices are configured to prevent data transfers over Universal Serial Bus connections.

• Evidence demonstrating: Mobile devices are configured to prevent data transfers over Universal Serial Bu
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Mobile devices are not connected to the infotainment systems of connected vehicles.

• Evidence demonstrating: Mobile devices are not connected to the infotainment systems of connected vehicl
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Sensitive or classified data is not viewed on mobile devices within or near connected vehicles.

• Evidence demonstrating: Sensitive or classified data is not viewed on mobile devices within or near conn
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

Sensitive or classified phone calls and conversations are not conducted within or near connected vehicles.

• Evidence demonstrating: Sensitive or classified phone calls and conversations are not conducted within o
• Mobile device management (MDM) configuration
• Mobile device policy
• Overseas travel briefings and device controls

• No MDM enforcement
• BYOD allowed without controls
• No travel security process

If procuring an evaluated product, a product that has completed a PP-based evaluation, including against all applicable PP modules (as well as a software bill of materials assessment if applicable), is selected in preference to one that has completed an EAL-based evaluation.

• Evidence demonstrating: If procuring an evaluated product, a product that has completed a PP-based evalu
• Evaluated product selection records
• Protection Profile / evaluation evidence
• Evidence products run in their evaluated configuration

• Unevaluated products used for high assurance
• Products not in evaluated configuration

Evaluated products are delivered in a manner consistent with any delivery procedures defined in associated evaluation documentation.

• Evidence demonstrating: Evaluated products are delivered in a manner consistent with any delivery proced
• Evaluated product selection records
• Protection Profile / evaluation evidence
• Evidence products run in their evaluated configuration

• Unevaluated products used for high assurance
• Products not in evaluated configuration

When procuring high assurance information technology (IT) equipment, ASD is contacted for any equipment-specific delivery procedures.

• Evidence demonstrating: When procuring high assurance information technology (IT) equipment, ASD is cont
• Evaluated product selection records
• Protection Profile / evaluation evidence
• Evidence products run in their evaluated configuration

• Unevaluated products used for high assurance
• Products not in evaluated configuration

Evaluated products are installed, configured, administered and operated in an evaluated configuration and in accordance with vendor guidance.

• Evidence demonstrating: Evaluated products are installed, configured, administered and operated in an ev
• Evaluated product selection records
• Protection Profile / evaluation evidence
• Evidence products run in their evaluated configuration

• Unevaluated products used for high assurance
• Products not in evaluated configuration

High assurance IT equipment is installed, configured, administered and operated in an evaluated configuration and in accordance with ASD guidance.

• Evidence demonstrating: High assurance IT equipment is installed, configured, administered and operated
• Evaluated product selection records
• Protection Profile / evaluation evidence
• Evidence products run in their evaluated configuration

• Unevaluated products used for high assurance
• Products not in evaluated configuration

Non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET gateways undergo an IRAP assessment, using the latest release of the ISM available prior to the beginning of the IRAP assessment (or a subsequent release), at least every 24 months.

• Evidence demonstrating: Non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET gateways undergo an IR
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

All web access, including that by internal servers, is conducted through web proxies.

• Evidence demonstrating: All web access, including that by internal servers, is conducted through web pro
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

The following details are centrally logged for websites accessed via web proxies: - web address - date and time - user - amount of data uploaded and downloaded - internal and external IP addresses.

• Evidence demonstrating: The following details are centrally logged for websites accessed via web proxies
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

TLS traffic communicated through gateways is decrypted and inspected.

• Evidence demonstrating: TLS traffic communicated through gateways is decrypted and inspected.
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Evaluated peripheral switches are used when sharing peripherals between systems.

• Evidence demonstrating: Evaluated peripheral switches are used when sharing peripherals between systems.
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

When planning, designing, implementing or introducing additional connectivity to CDSs, ASD is consulted and any directions provided by ASD are complied with.

• Evidence demonstrating: When planning, designing, implementing or introducing additional connectivity to
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Users are trained on the secure use of CDSs before access is granted.

• Evidence demonstrating: Users are trained on the secure use of CDSs before access is granted.
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

System administrators for gateways are assigned the minimum privileges required to perform their duties.

• Evidence demonstrating: System administrators for gateways are assigned the minimum privileges required
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

System administrators for gateways are formally trained on the operation and management of gateways.

• Evidence demonstrating: System administrators for gateways are formally trained on the operation and man
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

System administrators for gateways that connect to Australian Eyes Only or Releasable To networks are Australian nationals.

• Evidence demonstrating: System administrators for gateways that connect to Australian Eyes Only or Relea
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Separation of duties is implemented in performing administrative activities for gateways.

• Evidence demonstrating: Separation of duties is implemented in performing administrative activities for
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Users authenticate to other networks accessed via gateways.

• Evidence demonstrating: Users authenticate to other networks accessed via gateways.
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

IT equipment authenticates to other networks accessed via gateways.

• Evidence demonstrating: IT equipment authenticates to other networks accessed via gateways.
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

CDSs are implemented between SECRET or TOP SECRET networks and any other networks belonging to different security domains.

• Evidence demonstrating: CDSs are implemented between SECRET or TOP SECRET networks and any other network
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Gateways are implemented between networks belonging to different security domains.

• Evidence demonstrating: Gateways are implemented between networks belonging to different security domain
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

For gateways between networks belonging to different security domains, any shared components are managed by system administrators for the higher security domain or by system administrators from a mutually agreed upon third party.

• Evidence demonstrating: For gateways between networks belonging to different security domains, any share
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Gateways only allow explicitly authorised data flows.

• Evidence demonstrating: Gateways only allow explicitly authorised data flows.
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Security-relevant events for gateways are centrally logged, including: - data packets and data flows permitted through gateways - data packets and data flows attempting to leave gateways - real-time alerts for attempted intrusions.

• Evidence demonstrating: Security-relevant events for gateways are centrally logged, including: - data pa
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

CDSs implement isolated upward and downward network paths.

• Evidence demonstrating: CDSs implement isolated upward and downward network paths.
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Gateways implement a demilitarised zone if external parties require access to an organisation's services.

• Evidence demonstrating: Gateways implement a demilitarised zone if external parties require access to an
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Evaluated firewalls are used between networks belonging to different security domains.

• Evidence demonstrating: Evaluated firewalls are used between networks belonging to different security do
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Evaluated diodes are used for controlling the data flow of unidirectional gateways between an organisation's networks and public network infrastructure.

• Evidence demonstrating: Evaluated diodes are used for controlling the data flow of unidirectional gatewa
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Evaluated diodes used for controlling the data flow of unidirectional gateways between SECRET or TOP SECRET networks and public network infrastructure complete a high assurance evaluation.

• Evidence demonstrating: Evaluated diodes used for controlling the data flow of unidirectional gateways b
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Files imported or exported via gateways or CDSs are filtered for allowed file types.

• Evidence demonstrating: Files imported or exported via gateways or CDSs are filtered for allowed file ty
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Files identified by content filtering checks as malicious, or that cannot be inspected, are blocked.

• Evidence demonstrating: Files identified by content filtering checks as malicious, or that cannot be ins
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Files identified by content filtering checks as suspicious are quarantined until reviewed and subsequently approved or not approved for release.

• Evidence demonstrating: Files identified by content filtering checks as suspicious are quarantined until
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Files imported or exported via gateways or CDSs undergo content filtering checks.

• Evidence demonstrating: Files imported or exported via gateways or CDSs undergo content filtering checks
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Security-relevant events for CDSs are centrally logged.

• Evidence demonstrating: Security-relevant events for CDSs are centrally logged.
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Files imported or exported via gateways or CDSs that have a digital signature or cryptographic checksum are validated.

• Evidence demonstrating: Files imported or exported via gateways or CDSs that have a digital signature or
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

An organisation-approved list of domain names, or list of website categories, is implemented for all Hypertext Transfer Protocol and Hypertext Transfer Protocol Secure traffic communicated through gateways.

• Evidence demonstrating: An organisation-approved list of domain names, or list of website categories, is
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Client-side active content is restricted by web content filters to an organisation-approved list of domain names.

• Evidence demonstrating: Client-side active content is restricted by web content filters to an organisati
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Web content filtering is implemented to filter potentially harmful web-based content.

• Evidence demonstrating: Web content filtering is implemented to filter potentially harmful web-based con
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Gateways undergo testing following configuration changes, and at regular intervals no more than six months apart, to validate they conform to expected security configurations.

• Evidence demonstrating: Gateways undergo testing following configuration changes, and at regular interva
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Evaluated diodes are used for controlling the data flow of unidirectional gateways between networks.

• Evidence demonstrating: Evaluated diodes are used for controlling the data flow of unidirectional gatewa
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Evaluated diodes used for controlling the data flow of unidirectional gateways between SECRET or TOP SECRET networks and any other networks complete a high assurance evaluation.

• Evidence demonstrating: Evaluated diodes used for controlling the data flow of unidirectional gateways b
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Attempts to access websites through their IP addresses instead of their domain names are blocked by web content filters.

• Evidence demonstrating: Attempts to access websites through their IP addresses instead of their domain n
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Gateways inspect and filter data flows at the transport and above network layers.

• Evidence demonstrating: Gateways inspect and filter data flows at the transport and above network layers
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Malicious domain names, dynamic domain names and domain names that can be registered anonymously for free are blocked by web content filters.

• Evidence demonstrating: Malicious domain names, dynamic domain names and domain names that can be regist
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Web content filtering is applied to outbound web traffic where appropriate.

• Evidence demonstrating: Web content filtering is applied to outbound web traffic where appropriate.
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Files imported or exported via gateways or CDSs undergo content validation.

• Evidence demonstrating: Files imported or exported via gateways or CDSs undergo content validation.
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Files imported or exported via gateways or CDSs undergo content conversion.

• Evidence demonstrating: Files imported or exported via gateways or CDSs undergo content conversion.
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Files imported or exported via gateways or CDSs undergo content sanitisation.

• Evidence demonstrating: Files imported or exported via gateways or CDSs undergo content sanitisation.
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Files imported or exported via gateways or CDSs undergo antivirus scanning using multiple different scanning engines.

• Evidence demonstrating: Files imported or exported via gateways or CDSs undergo antivirus scanning using
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Archive files imported or exported via gateways or CDSs are unpacked in order to undergo content filtering checks.

• Evidence demonstrating: Archive files imported or exported via gateways or CDSs are unpacked in order to
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Archive files are unpacked in a controlled manner to ensure content filter performance or availability is not adversely affected.

• Evidence demonstrating: Archive files are unpacked in a controlled manner to ensure content filter perfo
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Encrypted files imported or exported via gateways or CDSs are decrypted in order to undergo content filtering checks.

• Evidence demonstrating: Encrypted files imported or exported via gateways or CDSs are decrypted in order
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Executable files imported via gateways or CDSs are automatically executed in a sandbox to detect any suspicious behaviour.

• Evidence demonstrating: Executable files imported via gateways or CDSs are automatically executed in a s
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Gateways perform ingress traffic filtering to detect and prevent IP source address spoofing.

• Evidence demonstrating: Gateways perform ingress traffic filtering to detect and prevent IP source addre
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Evaluated peripheral switches used for sharing peripherals between SECRET and TOP SECRET systems, or between SECRET or TOP SECRET systems belonging to different security domains, preferably complete a high assurance evaluation.

• Evidence demonstrating: Evaluated peripheral switches used for sharing peripherals between SECRET and TO
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Evaluated peripheral switches used for sharing peripherals between SECRET or TOP SECRET systems and any non-SECRET or TOP SECRET systems complete a high assurance evaluation.

• Evidence demonstrating: Evaluated peripheral switches used for sharing peripherals between SECRET or TOP
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

System administrators for gateways undergo appropriate employment screening, and where necessary hold an appropriate security clearance, based on the sensitivity or classification of gateways.

• Evidence demonstrating: System administrators for gateways undergo appropriate employment screening, and
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

CDSs implement protocol breaks at each network layer.

• Evidence demonstrating: CDSs implement protocol breaks at each network layer.
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

CDSs implement independent security-enforcing functions for upward and downward network paths.

• Evidence demonstrating: CDSs implement independent security-enforcing functions for upward and downward
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

A sample of security-relevant events relating to data transfer policies are taken at least every three months and assessed against security policies for CDSs to identify any operational failures.

• Evidence demonstrating: A sample of security-relevant events relating to data transfer policies are take
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Content filters used by CDSs undergo rigorous security testing to ensure they perform as expected and cannot be bypassed.

• Evidence demonstrating: Content filters used by CDSs undergo rigorous security testing to ensure they pe
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Evaluated firewalls are used between an organisation's networks and public network infrastructure.

• Evidence demonstrating: Evaluated firewalls are used between an organisation's networks and public netwo
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

System administrators for gateways that connect to Australian Government Access Only networks are Australian nationals or seconded foreign nationals.

• Evidence demonstrating: System administrators for gateways that connect to Australian Government Access
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Gateways are managed via a secure path isolated from all connected networks.

• Evidence demonstrating: Gateways are managed via a secure path isolated from all connected networks.
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Public IP addresses controlled by, or used by, an organisation are signed by valid ROA records.

• Evidence demonstrating: Public IP addresses controlled by, or used by, an organisation are signed by val
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

If using a WAF, disclosing the IP addresses of web servers under an organisation's control (referred to as origin servers) is avoided and access to the origin servers is restricted to the WAF and authorised management networks.

• Evidence demonstrating: If using a WAF, disclosing the IP addresses of web servers under an organisation
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Files imported or exported via gateways or CDSs undergo content checking.

• Evidence demonstrating: Files imported or exported via gateways or CDSs undergo content checking.
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

Routes for RPKI-registered IP addresses that are advertised from invalid Autonomous Systems, or that are longer than allowed, are rejected or deprioritised by routers that exchange routes via BGP.

• Evidence demonstrating: Routes for RPKI-registered IP addresses that are advertised from invalid Autonom
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

TOP SECRET gateways undergo a security assessment by ASD assessors (or their delegates), using the latest release of the ISM available prior to the beginning of the assessment (or a subsequent release), at least every 24 months.

• Evidence demonstrating: TOP SECRET gateways undergo a security assessment by ASD assessors (or their del
• Gateway configuration
• Firewall rule-set and review records
• Cross Domain Solution / web & content filtering configuration

• Firewall rules not reviewed
• Unrestricted gateway data flows

IT equipment is classified based on the highest sensitivity or classification of data that it is approved for processing, storing or communicating.

• Evidence demonstrating: IT equipment is classified based on the highest sensitivity or classification of
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

IT equipment, with the exception of high assurance IT equipment, is labelled with protective markings reflecting its sensitivity or classification.

• Evidence demonstrating: IT equipment, with the exception of high assurance IT equipment, is labelled wit
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

ASD's approval is sought before applying labels to external surfaces of high assurance IT equipment.

• Evidence demonstrating: ASD's approval is sought before applying labels to external surfaces of high ass
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

Maintenance and repairs of IT equipment is carried out on site by an appropriately cleared technician.

• Evidence demonstrating: Maintenance and repairs of IT equipment is carried out on site by an appropriate
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

If an appropriately cleared technician is not used to undertake maintenance or repairs of IT equipment, the technician is escorted by someone who: - is appropriately cleared and briefed - takes due care to ensure that data is not disclosed - takes all responsible measures to ensure the integrity of the IT equipment - has the authority to direct the technician - is sufficiently familiar with the IT equipment to understand the work being performed.

• Evidence demonstrating: If an appropriately cleared technician is not used to undertake maintenance or r
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

If an appropriately cleared technician is not used to undertake maintenance or repairs of IT equipment, the IT equipment and associated media is sanitised before maintenance or repair work is undertaken.

• Evidence demonstrating: If an appropriately cleared technician is not used to undertake maintenance or r
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

IT equipment maintained or repaired off site is done so at facilities approved for handling the sensitivity or classification of the IT equipment.

• Evidence demonstrating: IT equipment maintained or repaired off site is done so at facilities approved f
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

IT equipment containing media is sanitised by removing the media from the IT equipment or by sanitising the media in situ.

• Evidence demonstrating: IT equipment containing media is sanitised by removing the media from the IT equ
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

IT equipment, including associated media, that is located overseas and has processed, stored or communicated AUSTEO or AGAO data that cannot be sanitised in situ, is returned to Australia for destruction.

• Evidence demonstrating: IT equipment, including associated media, that is located overseas and has proce
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

IT equipment sanitisation processes, and supporting IT equipment sanitisation procedures, are developed, implemented and maintained.

• Evidence demonstrating: IT equipment sanitisation processes, and supporting IT equipment sanitisation pr
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

High assurance IT equipment is destroyed prior to its disposal.

• Evidence demonstrating: High assurance IT equipment is destroyed prior to its disposal.
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

Following sanitisation, destruction or declassification, a formal administrative decision is made to release IT equipment, or its waste, into the public domain.

• Evidence demonstrating: Following sanitisation, destruction or declassification, a formal administrative
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

At least three pages of random text with no blank areas are printed on each colour printer cartridge or MFD print drum.

• Evidence demonstrating: At least three pages of random text with no blank areas are printed on each colo
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

When unable to sanitise printer cartridges or MFD print drums, they are destroyed as per electrostatic memory devices.

• Evidence demonstrating: When unable to sanitise printer cartridges or MFD print drums, they are destroye
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

When disposing of IT equipment that has been designed or modified to meet emanation security standards, ASD is contacted for requirements relating to its disposal.

• Evidence demonstrating: When disposing of IT equipment that has been designed or modified to meet emanat
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

A networked IT equipment register is developed, implemented, maintained and verified on a regular basis.

• Evidence demonstrating: A networked IT equipment register is developed, implemented, maintained and veri
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

Televisions and computer monitors with minor burn-in or image persistence are sanitised by displaying a solid white image on the screen for an extended period of time.

• Evidence demonstrating: Televisions and computer monitors with minor burn-in or image persistence are sa
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

ASD's approval is sought before undertaking any maintenance or repairs to high assurance IT equipment.

• Evidence demonstrating: ASD's approval is sought before undertaking any maintenance or repairs to high a
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

Labels and markings indicating the owner, sensitivity, classification or any other marking that can associate IT equipment with its prior use are removed prior to its disposal.

• Evidence demonstrating: Labels and markings indicating the owner, sensitivity, classification or any oth
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

IT equipment, including associated media, that is located overseas and has processed, stored or communicated AUSTEO or AGAO data, is sanitised in situ.

• Evidence demonstrating: IT equipment, including associated media, that is located overseas and has proce
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

MFD print drums and image transfer rollers are inspected and destroyed if there is remnant toner which cannot be removed or a print is visible on the image transfer roller.

• Evidence demonstrating: MFD print drums and image transfer rollers are inspected and destroyed if there
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

Printer and MFD platens are inspected and destroyed if any text or images are retained on the platen.

• Evidence demonstrating: Printer and MFD platens are inspected and destroyed if any text or images are re
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

Printers and MFDs are checked to ensure no pages are trapped in the paper path due to a paper jam.

• Evidence demonstrating: Printers and MFDs are checked to ensure no pages are trapped in the paper path d
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

Televisions and computer monitors that cannot be sanitised are destroyed.

• Evidence demonstrating: Televisions and computer monitors that cannot be sanitised are destroyed.
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

Memory in network devices is sanitised using the following processes, in order of preference: - following device-specific guidance provided in evaluation documentation - following vendor sanitisation guidance - loading a dummy configuration file, performing a factory reset and then reinstalling firmware.

• Evidence demonstrating: Memory in network devices is sanitised using the following processes, in order o
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

Printer ribbons in printers and MFDs are removed and destroyed.

• Evidence demonstrating: Printer ribbons in printers and MFDs are removed and destroyed.
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

IT equipment disposal processes, and supporting IT equipment disposal procedures, are developed, implemented and maintained.

• Evidence demonstrating: IT equipment disposal processes, and supporting IT equipment disposal procedures
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

An IT equipment management policy is developed, implemented and maintained.

• Evidence demonstrating: An IT equipment management policy is developed, implemented and maintained.
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

Following maintenance or repair activities for IT equipment, the IT equipment is inspected to confirm it retains its approved configuration and that no unauthorised modifications have taken place.

• Evidence demonstrating: Following maintenance or repair activities for IT equipment, the IT equipment is
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

IT equipment is handled in a manner suitable for its sensitivity or classification.

• Evidence demonstrating: IT equipment is handled in a manner suitable for its sensitivity or classificati
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

IT equipment destruction processes, and supporting IT equipment destruction procedures, are developed, implemented and maintained.

• Evidence demonstrating: IT equipment destruction processes, and supporting IT equipment destruction proc
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

IT equipment that cannot be sanitised is destroyed.

• Evidence demonstrating: IT equipment that cannot be sanitised is destroyed.
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

IT equipment is hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.

• Evidence demonstrating: IT equipment is hardened using ASD and vendor hardening guidance, with the most
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

A non-networked IT equipment register is developed, implemented, maintained and verified on a regular basis.

• Evidence demonstrating: A non-networked IT equipment register is developed, implemented, maintained and
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

Approved configurations for IT equipment are developed, implemented and maintained.

• Evidence demonstrating: Approved configurations for IT equipment are developed, implemented and maintain
• IT equipment register
• Sanitisation/destruction records
• Disposal and movement records

• Equipment not sanitised before disposal
• No equipment register

Media is classified to the highest sensitivity or classification of data it stores, unless the media has been classified to a higher sensitivity or classification.

• Evidence demonstrating: Media is classified to the highest sensitivity or classification of data it stor
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Any media connected to a system with a higher sensitivity or classification than the media is reclassified to the higher sensitivity or classification, unless the media is read-only or the system has a mechanism through which read-only access can be ensured.

• Evidence demonstrating: Any media connected to a system with a higher sensitivity or classification than
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Before reclassifying media to a lower sensitivity or classification, the media is sanitised or destroyed, and a formal administrative decision is made to reclassify it.

• Evidence demonstrating: Before reclassifying media to a lower sensitivity or classification, the media i
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Media, with the exception of internally mounted fixed media within information technology equipment, is labelled with protective markings reflecting its sensitivity or classification.

• Evidence demonstrating: Media, with the exception of internally mounted fixed media within information t
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Media is only used with systems that are authorised to process, store or communicate its sensitivity or classification.

• Evidence demonstrating: Media is only used with systems that are authorised to process, store or communi
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

When transferring data manually between two systems belonging to different security domains, write-once media is used unless the destination system has a mechanism through which read-only access can be ensured.

• Evidence demonstrating: When transferring data manually between two systems belonging to different secur
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Media sanitisation processes, and supporting media sanitisation procedures, are developed, implemented and maintained.

• Evidence demonstrating: Media sanitisation processes, and supporting media sanitisation procedures, are
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

The following media types are destroyed prior to their disposal: - microfiche and microfilm - optical discs - programmable read-only memory - read-only memory - other types of media that cannot be sanitised.

• Evidence demonstrating: The following media types are destroyed prior to their disposal: - microfiche an
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Volatile media is sanitised by removing its power for at least 10 minutes.

• Evidence demonstrating: Volatile media is sanitised by removing its power for at least 10 minutes.
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

SECRET and TOP SECRET volatile media is sanitised by overwriting it at least once in its entirety with a random pattern followed by a read back for verification.

• Evidence demonstrating: SECRET and TOP SECRET volatile media is sanitised by overwriting it at least onc
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Non-volatile magnetic media is sanitised by overwriting it at least once (or three times if pre-2001 or under 15 GB) in its entirety with a random pattern followed by a read back for verification.

• Evidence demonstrating: Non-volatile magnetic media is sanitised by overwriting it at least once (or thr
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Following sanitisation, SECRET and TOP SECRET non-volatile magnetic media retains its classification.

• Evidence demonstrating: Following sanitisation, SECRET and TOP SECRET non-volatile magnetic media retain
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Non-volatile EPROM media is sanitised by applying three times the manufacturer's specified ultraviolet erasure time and then overwriting it at least once in its entirety with a random pattern followed by a read back for verification.

• Evidence demonstrating: Non-volatile EPROM media is sanitised by applying three times the manufacturer's
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Following sanitisation, SECRET and TOP SECRET non-volatile EPROM and EEPROM media retains its classification.

• Evidence demonstrating: Following sanitisation, SECRET and TOP SECRET non-volatile EPROM and EEPROM medi
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Non-volatile flash memory media is sanitised by overwriting it at least twice in its entirety with a random pattern followed by a read back for verification.

• Evidence demonstrating: Non-volatile flash memory media is sanitised by overwriting it at least twice in
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Following sanitisation, SECRET and TOP SECRET non-volatile flash memory media retains its classification.

• Evidence demonstrating: Following sanitisation, SECRET and TOP SECRET non-volatile flash memory media re
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Magnetic media is destroyed using a degausser with a suitable magnetic field strength and magnetic orientation.

• Evidence demonstrating: Magnetic media is destroyed using a degausser with a suitable magnetic field str
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Product-specific directions provided by degausser manufacturers are followed.

• Evidence demonstrating: Product-specific directions provided by degausser manufacturers are followed.
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Media destruction processes, and supporting media destruction procedures, are developed, implemented and maintained.

• Evidence demonstrating: Media destruction processes, and supporting media destruction procedures, are de
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Media destroyed using a hammer mill, disintegrator, grinder/sander or by cutting results in media waste particles no larger than 9 mm.

• Evidence demonstrating: Media destroyed using a hammer mill, disintegrator, grinder/sander or by cutting
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

The destruction of media is performed under the supervision of at least one cleared person.

• Evidence demonstrating: The destruction of media is performed under the supervision of at least one clea
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Personnel supervising the destruction of media supervise its handling to the point of destruction and ensure that the destruction is completed successfully.

• Evidence demonstrating: Personnel supervising the destruction of media supervise its handling to the poi
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

The destruction of media storing accountable material is performed under the supervision of at least two cleared personnel.

• Evidence demonstrating: The destruction of media storing accountable material is performed under the sup
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Personnel supervising the destruction of media storing accountable material supervise its handling to the point of destruction, ensure that the destruction is completed successfully and sign a destruction certificate afterwards.

• Evidence demonstrating: Personnel supervising the destruction of media storing accountable material supe
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Media disposal processes, and supporting media disposal procedures, are developed, implemented and maintained.

• Evidence demonstrating: Media disposal processes, and supporting media disposal procedures, are develope
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Following sanitisation, destruction or declassification, a formal administrative decision is made to release media, or its waste, into the public domain.

• Evidence demonstrating: Following sanitisation, destruction or declassification, a formal administrative
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Labels and markings indicating the owner, sensitivity, classification or any other marking that can associate media with its prior use are removed prior to its disposal.

• Evidence demonstrating: Labels and markings indicating the owner, sensitivity, classification or any oth
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Media is handled in a manner suitable for its sensitivity or classification.

• Evidence demonstrating: Media is handled in a manner suitable for its sensitivity or classification.
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Following sanitisation, TOP SECRET volatile media retains its classification if it stored static data for an extended period of time, or had data repeatedly stored on or written to the same memory location for an extended period of time.

• Evidence demonstrating: Following sanitisation, TOP SECRET volatile media retains its classification if
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Non-volatile EEPROM media is sanitised by overwriting it at least once in its entirety with a random pattern followed by a read back for verification.

• Evidence demonstrating: Non-volatile EEPROM media is sanitised by overwriting it at least once in its en
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

The destruction of media storing accountable material is not outsourced.

• Evidence demonstrating: The destruction of media storing accountable material is not outsourced.
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

When outsourcing the destruction of media storing non-accountable material, a National Association for Information Destruction AAA certified destruction service with endorsements, as specified in ASIO's Protective Security Circular-167, is used.

• Evidence demonstrating: When outsourcing the destruction of media storing non-accountable material, a Na
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

When transferring data manually between two systems belonging to different security domains, rewritable media is sanitised after each data transfer.

• Evidence demonstrating: When transferring data manually between two systems belonging to different secur
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

All data stored on media is encrypted.

• Evidence demonstrating: All data stored on media is encrypted.
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

The host-protected area and device configuration overlay table are reset prior to the sanitisation of non-volatile magnetic hard drives.

• Evidence demonstrating: The host-protected area and device configuration overlay table are reset prior t
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

The ATA secure erase command is used, in addition to block overwriting software, to ensure the growth defects table of non-volatile magnetic hard drives is overwritten.

• Evidence demonstrating: The ATA secure erase command is used, in addition to block overwriting software,
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

If using degaussers to destroy media, degaussers evaluated by the United States' National Security Agency are used.

• Evidence demonstrating: If using degaussers to destroy media, degaussers evaluated by the United States'
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

A removable media usage policy is developed, implemented and maintained.

• Evidence demonstrating: A removable media usage policy is developed, implemented and maintained.
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Security Construction and Equipment Committee-approved equipment or ASIO-approved equipment is used when destroying media.

• Evidence demonstrating: Security Construction and Equipment Committee-approved equipment or ASIO-approve
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Equipment that is capable of reducing microform to a fine powder, with resultant particles not showing more than five consecutive characters per particle upon microscopic inspection, is used to destroy microfiche and microfilm.

• Evidence demonstrating: Equipment that is capable of reducing microform to a fine powder, with resultant
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

A media management policy is developed, implemented and maintained.

• Evidence demonstrating: A media management policy is developed, implemented and maintained.
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Media is sanitised before it is used for the first time.

• Evidence demonstrating: Media is sanitised before it is used for the first time.
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Following the use of a degausser, magnetic media is physically damaged by deforming any internal platters.

• Evidence demonstrating: Following the use of a degausser, magnetic media is physically damaged by deform
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Media is sanitised before it is reused in a different security domain.

• Evidence demonstrating: Media is sanitised before it is reused in a different security domain.
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

A removable media register is developed, implemented, maintained and verified on a regular basis.

• Evidence demonstrating: A removable media register is developed, implemented, maintained and verified on
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Electrostatic memory devices are destroyed using a furnace/incinerator, hammer mill, disintegrator or grinder/sander.

• Evidence demonstrating: Electrostatic memory devices are destroyed using a furnace/incinerator, hammer m
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Magnetic floppy disks are destroyed using a furnace/incinerator, hammer mill, disintegrator, degausser or by cutting.

• Evidence demonstrating: Magnetic floppy disks are destroyed using a furnace/incinerator, hammer mill, di
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Magnetic hard disks are destroyed using a furnace/incinerator, hammer mill, disintegrator, grinder/sander or degausser.

• Evidence demonstrating: Magnetic hard disks are destroyed using a furnace/incinerator, hammer mill, disi
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Magnetic tapes are destroyed using a furnace/incinerator, hammer mill, disintegrator, degausser or by cutting.

• Evidence demonstrating: Magnetic tapes are destroyed using a furnace/incinerator, hammer mill, disintegr
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Optical disks are destroyed using a furnace/incinerator, hammer mill, disintegrator, grinder/sander or by cutting.

• Evidence demonstrating: Optical disks are destroyed using a furnace/incinerator, hammer mill, disintegra
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Semiconductor memory is destroyed using a furnace/incinerator, hammer mill or disintegrator.

• Evidence demonstrating: Semiconductor memory is destroyed using a furnace/incinerator, hammer mill or di
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

The resulting media waste particles from the destruction of SECRET media is stored and handled as OFFICIAL if less than or equal to 3 mm, PROTECTED if greater than 3 mm and less than or equal to 6 mm, or SECRET if greater than 6 mm and less than or equal to 9 mm.

• Evidence demonstrating: The resulting media waste particles from the destruction of SECRET media is stor
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

The resulting media waste particles from the destruction of TOP SECRET media is stored and handled as OFFICIAL if less than or equal to 3 mm, or SECRET if greater than 3 mm and less than or equal to 9 mm.

• Evidence demonstrating: The resulting media waste particles from the destruction of TOP SECRET media is
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Media that cannot be successfully sanitised is destroyed prior to its disposal.

• Evidence demonstrating: Media that cannot be successfully sanitised is destroyed prior to its disposal.
• Media register
• Sanitisation/destruction logs
• Media labelling and classification records

• Media not sanitised before reuse/disposal
• Unlabelled or misclassified media

Servers maintain effective functional separation with other servers allowing them to operate independently.

• Evidence demonstrating: Servers maintain effective functional separation with other servers allowing the
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Network documentation includes high-level network diagrams showing all connections into networks and logical network diagrams showing all critical servers, high-value servers, network devices and network security appliances.

• Evidence demonstrating: Network documentation includes high-level network diagrams showing all connectio
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Network documentation is developed, implemented and maintained.

• Evidence demonstrating: Network documentation is developed, implemented and maintained.
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Network access controls are implemented on networks to prevent the connection of unauthorised network devices and networked IT equipment.

• Evidence demonstrating: Network access controls are implemented on networks to prevent the connection of
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

IPv6 functionality is disabled in dual-stack network devices unless it is being used.

• Evidence demonstrating: IPv6 functionality is disabled in dual-stack network devices unless it is being
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

VLANs are not used to separate network traffic between networks belonging to different security domains.

• Evidence demonstrating: VLANs are not used to separate network traffic between networks belonging to dif
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Network devices managing VLANs are administered from the most trusted security domain.

• Evidence demonstrating: Network devices managing VLANs are administered from the most trusted security d
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Unused physical ports on network devices are disabled.

• Evidence demonstrating: Unused physical ports on network devices are disabled.
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Network devices managing VLANs belonging to different security domains do not share VLAN trunks.

• Evidence demonstrating: Network devices managing VLANs belonging to different security domains do not sh
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Public wireless networks provided for general public use are segregated from all other organisation networks.

• Evidence demonstrating: Public wireless networks provided for general public use are segregated from all
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Security measures are implemented to prevent unauthorised access to network management traffic.

• Evidence demonstrating: Security measures are implemented to prevent unauthorised access to network mana
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

The effective range of wireless communications outside an organisation's area of control is limited by implementing RF shielding on facilities in which SECRET or TOP SECRET wireless networks are used.

• Evidence demonstrating: The effective range of wireless communications outside an organisation's area of
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

A NIDS or NIPS is deployed in gateways between an organisation's networks and other networks they do not manage.

• Evidence demonstrating: A NIDS or NIPS is deployed in gateways between an organisation's networks and ot
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

A NIDS or NIPS is located immediately inside the outermost firewall for gateways and configured to generate event logs and alerts for network traffic that contravenes any rule in a firewall ruleset.

• Evidence demonstrating: A NIDS or NIPS is located immediately inside the outermost firewall for gateways
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Network documentation provided to a third party, or published in public tender documentation, only contains details necessary for other parties to undertake contractual services.

• Evidence demonstrating: Network documentation provided to a third party, or published in public tender d
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Networks are segregated into multiple network zones according to the criticality of servers, services and data.

• Evidence demonstrating: Networks are segregated into multiple network zones according to the criticality
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Network access controls are implemented to limit the flow of network traffic within and between network segments to only that required for business purposes.

• Evidence demonstrating: Network access controls are implemented to limit the flow of network traffic wit
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

IPv6 capable network security appliances are used on IPv6 and dual-stack networks.

• Evidence demonstrating: IPv6 capable network security appliances are used on IPv6 and dual-stack network
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Default user accounts or credentials for network devices, including for any pre-configured user accounts, are changed, disabled or removed during initial setup.

• Evidence demonstrating: Default user accounts or credentials for network devices, including for any pre-
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

SNMP version 1 and SNMP version 2 are not used on networks.

• Evidence demonstrating: SNMP version 1 and SNMP version 2 are not used on networks.
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

All default SNMP community strings on network devices are changed and write access is disabled.

• Evidence demonstrating: All default SNMP community strings on network devices are changed and write acce
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

All wireless devices are Wi-Fi Alliance certified.

• Evidence demonstrating: All wireless devices are Wi-Fi Alliance certified.
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

The administrative interface on wireless access points is disabled for wireless network connections.

• Evidence demonstrating: The administrative interface on wireless access points is disabled for wireless
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Default SSIDs of wireless access points are changed.

• Evidence demonstrating: Default SSIDs of wireless access points are changed.
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

SSIDs of non-public wireless networks are not readily associated with an organisation, the location of their premises or the functionality of wireless networks.

• Evidence demonstrating: SSIDs of non-public wireless networks are not readily associated with an organis
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

SSID broadcasting is not disabled on wireless access points.

• Evidence demonstrating: SSID broadcasting is not disabled on wireless access points.
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Static addressing is not used for assigning IP addresses on wireless networks.

• Evidence demonstrating: Static addressing is not used for assigning IP addresses on wireless networks.
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

MAC address filtering is not used to restrict which devices can connect to wireless networks.

• Evidence demonstrating: MAC address filtering is not used to restrict which devices can connect to wirel
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

802.1X authentication with EAP-TLS, using X.509 certificates, is used for mutual authentication; with all other EAP methods disabled on supplicants and authentication servers.

• Evidence demonstrating: 802.1X authentication with EAP-TLS, using X.509 certificates, is used for mutual
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Evaluated supplicants, authenticators, wireless access points and authentication servers are used in wireless networks.

• Evidence demonstrating: Evaluated supplicants, authenticators, wireless access points and authentication
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Certificates are required for devices and users accessing wireless networks.

• Evidence demonstrating: Certificates are required for devices and users accessing wireless networks.
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Certificates are generated using an evaluated certificate authority or hardware security module.

• Evidence demonstrating: Certificates are generated using an evaluated certificate authority or hardware
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Certificates are protected by logical and physical access controls, encryption, and user authentication.

• Evidence demonstrating: Certificates are protected by logical and physical access controls, encryption,
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

The PMK caching period is not set to greater than 1440 minutes (24 hours).

• Evidence demonstrating: The PMK caching period is not set to greater than 1440 minutes (24 hours).
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

WPA3-Enterprise 192-bit mode is used to protect the confidentiality and integrity of all wireless network traffic.

• Evidence demonstrating: WPA3-Enterprise 192-bit mode is used to protect the confidentiality and integrit
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Wireless networks implement sufficient frequency separation from other wireless networks.

• Evidence demonstrating: Wireless networks implement sufficient frequency separation from other wireless
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Wireless access points enable the use of the 802.11w amendment to protect management frames.

• Evidence demonstrating: Wireless access points enable the use of the 802.11w amendment to protect manage
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Instead of deploying a small number of wireless access points that broadcast on high power, a greater number of wireless access points that use less broadcast power are deployed to achieve the desired footprint for wireless networks.

• Evidence demonstrating: Instead of deploying a small number of wireless access points that broadcast on
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Network devices managing VLANs terminate VLANs belonging to different security domains on separate physical network interfaces.

• Evidence demonstrating: Network devices managing VLANs terminate VLANs belonging to different security d
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Unless explicitly required, IPv6 tunnelling is disabled on all network devices.

• Evidence demonstrating: Unless explicitly required, IPv6 tunnelling is disabled on all network devices.
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

IPv6 tunnelling is blocked by network security appliances at externally-connected network boundaries.

• Evidence demonstrating: IPv6 tunnelling is blocked by network security appliances at externally-connecte
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Dynamically assigned IPv6 addresses are configured with Dynamic Host Configuration Protocol version 6 in a stateful manner with lease data stored in a centralised event logging facility.

• Evidence demonstrating: Dynamically assigned IPv6 addresses are configured with Dynamic Host Configurati
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Denial-of-service attack mitigation strategies are discussed with cloud service providers, specifically: - their capacity to withstand denial-of-service attacks - costs likely to be incurred as a result of denial-of-service attacks - availability monitoring and thresholds for notification of denial-of-service attacks - thresholds for turning off any online services or functionality during denial-of-service attacks - pre-approved actions that can be undertaken during denial-of-service attacks - any arrangements with upstream service providers to block malicious network traffic as far upstream as possible.

• Evidence demonstrating: Denial-of-service attack mitigation strategies are discussed with cloud service
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Domain names for online services are protected via registrar locking and confirming that domain registration details are correct.

• Evidence demonstrating: Domain names for online services are protected via registrar locking and confirm
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Critical online services are segregated from other online services that are more likely to be targeted as part of denial-of-service attacks.

• Evidence demonstrating: Critical online services are segregated from other online services that are more
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Cloud service providers are used for hosting online services.

• Evidence demonstrating: Cloud service providers are used for hosting online services.
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Where a high availability requirement exists for website hosting, CDNs that cache websites are used.

• Evidence demonstrating: Where a high availability requirement exists for website hosting, CDNs that cach
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

If using CDNs, disclosing the IP addresses of web servers under an organisation's control (referred to as origin servers) is avoided and access to the origin servers is restricted to the CDNs and authorised management networks.

• Evidence demonstrating: If using CDNs, disclosing the IP addresses of web servers under an organisation'
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Communications between authenticators and a RADIUS server are encapsulated with an additional layer of encryption using RADIUS over Internet Protocol Security or RADIUS over Transport Layer Security.

• Evidence demonstrating: Communications between authenticators and a RADIUS server are encapsulated with
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Servers minimise communications with other servers at the network and file system level.

• Evidence demonstrating: Servers minimise communications with other servers at the network and file syste
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

VLANs are not used to separate network traffic between an organisation's networks and public network infrastructure.

• Evidence demonstrating: VLANs are not used to separate network traffic between an organisation's network
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

An organisation's networks are segregated from their service providers' networks.

• Evidence demonstrating: An organisation's networks are segregated from their service providers' networks
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Cloud service providers' ability to dynamically scale resources in response to a genuine spike in demand is discussed and verified as part of capacity and availability planning for online services.

• Evidence demonstrating: Cloud service providers' ability to dynamically scale resources in response to a
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Where a high availability requirement exists for online services, the services are architected to automatically transition between availability zones.

• Evidence demonstrating: Where a high availability requirement exists for online services, the services a
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Continuous real-time monitoring of the capacity and availability of online services is performed.

• Evidence demonstrating: Continuous real-time monitoring of the capacity and availability of online servi
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Inbound network connections from anonymity networks are blocked.

• Evidence demonstrating: Inbound network connections from anonymity networks are blocked.
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Outbound network connections to anonymity networks are blocked.

• Evidence demonstrating: Outbound network connections to anonymity networks are blocked.
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Settings for wireless access points are hardened.

• Evidence demonstrating: Settings for wireless access points are hardened.
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

User identity confidentiality is used if available with EAP-TLS implementations.

• Evidence demonstrating: User identity confidentiality is used if available with EAP-TLS implementations.
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

The use of FT (802.11r) is disabled unless authenticator-to-authenticator communications are secured by an ASD-Approved Cryptographic Protocol.

• Evidence demonstrating: The use of FT (802.11r) is disabled unless authenticator-to-authenticator commun
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

All data communicated over network infrastructure is encrypted.

• Evidence demonstrating: All data communicated over network infrastructure is encrypted.
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

A protective DNS service is used to block access to known malicious domain names.

• Evidence demonstrating: A protective DNS service is used to block access to known malicious domain names
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Network devices are flashed with trusted firmware before they are used for the first time.

• Evidence demonstrating: Network devices are flashed with trusted firmware before they are used for the f
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Network devices are restarted on at least a monthly basis.

• Evidence demonstrating: Network devices are restarted on at least a monthly basis.
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Networked management interfaces for IT equipment are not directly exposed to the internet.

• Evidence demonstrating: Networked management interfaces for IT equipment are not directly exposed to the
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

Network documentation includes device settings for all critical servers, high-value servers, network devices and network security appliances.

• Evidence demonstrating: Network documentation includes device settings for all critical servers, high-va
• Network segmentation diagrams
• Access control lists
• Wireless network configuration

• Flat/unsegmented network
• Unrestricted network traffic

SMB version 1 is not used on networks.

• Evidence demonstrating: SMB version 1 is not used on networks.
• Network segmentation diagrams
• Access control lists
• Wireless network configuration