ISM self-assessment

Pyron against the Australian Government's Information Security Manual at OFFICIAL: every control listed, the ones a cloud service is judged on first assessed.

Framework: Information Security Manual (ASD), 2026.09.4, non-classified baseline
Version: 1.0
Assessed: 25 October 2026

The Australian Signals Directorate's Information Security Manual (ISM) is the control set Australian government systems are assessed against. This page lists every control the ISM applies to a non-classified (OFFICIAL) system, 1017 of them, from ASD's own machine-readable release (2026.09.4), and gives Pyron's status for 251.

Assessed first are the guidelines a cloud service is judged on: incidents, suppliers, documentation, physical security, personnel, access and credentials, administration, patching, backups, monitoring, security assessments, software development, databases, cryptography, network design, service continuity, content filtering and data transfers. A control is assessed only where its answer can be shown; a status is never guessed.
Not yet assessed is every other control, many of them for equipment, networks, mobile devices and email systems a cloud application does not run. It means exactly that: we have not answered it, not that it is missing.
This is our own account, checked against production on the date above. Pyron has had no IRAP assessment, the ISM's independent one.

The control wording is ASD's, from the Information Security Manual, © Commonwealth of Australia, under the Creative Commons Attribution 4.0 International licence. The Security overview and the ASD Essentials for cloud matrix say more about how each control works.

In place: 108
Partial: 70
Planned: 13
Not applicable: 60
Not yet assessed: 766

Download CSV

SearchStatus

Showing 1017 of 1017

ISM self-assessment
Reference	Requirement	Status	How we meet it
ISM-1997	Embedding cyber security: The board of directors or executive committee defines clear roles and responsibilities for cyber security both within the board of directors or executive committee and broadly within their organisation.	In place	Techly's two directors are accountable for information security. The Technical Director runs it day to day, and the Managing Director takes part in each policy's review and in every decision to accept a risk.
ISM-1998	Embedding cyber security: The board of directors or executive committee ensures that cyber security is integrated throughout all business functions within their organisation.	Not yet assessed	Not yet assessed.
ISM-1999	Embedding cyber security: The board of directors or executive committee ensures the cyber security strategy for their organisation is aligned with the overarching strategic direction and business strategy for their organisation.	Not yet assessed	Not yet assessed.
ISM-2000	Embedding cyber security: The board of directors or executive committee seeks regular briefings or reporting on the cyber security posture of their organisation, as well as the threat environment in which they operate, from internal and external subject matter experts.	Not yet assessed	Not yet assessed.
ISM-2001	Championing a positive cyber security culture: The board of directors or executive committee champions a positive cyber security culture within their organisation, including through leading by example.	Not yet assessed	Not yet assessed.
ISM-2002	Building cyber security expertise: The board of directors or executive committee maintains a sufficient level of cyber security literacy to fulfil both their fiduciary duties and any legislative or regulatory obligations.	Not yet assessed	Not yet assessed.
ISM-2003	Building cyber security expertise: The board of directors or executive committee maintains awareness of key cyber security recruitment activities, retention rates for cyber security personnel, and cyber security skills and experience gaps within their organisation.	Not yet assessed	Not yet assessed.
ISM-2004	Building cyber security expertise: The board of directors or executive committee supports the development of cyber security skills and experience for all personnel via internal and external cyber security awareness raising and training opportunities.	Not yet assessed	Not yet assessed.
ISM-2005	Identifying critical business assets: The board of directors or executive committee understands the business criticality of their organisation’s systems, including at least a basic understanding of what systems exist, their value, where they reside, who has access, who might seek access, how they are protected, and how that protection is verified.	Not yet assessed	Not yet assessed.
ISM-2006	Planning for major cyber security incidents: The board of directors or executive committee plans for major cyber security incidents, including by participating in exercises, and understands their duties in relation to such cyber security incidents.	Not yet assessed	Not yet assessed.
ISM-0714	Providing cyber security leadership and guidance: A CISO is appointed to provide cyber security leadership and guidance for their organisation (covering IT and OT).	Partial	Techly's two directors are accountable for information security. The Technical Director runs it day to day, and the Managing Director takes part in each policy's review and in every decision to accept a risk. Techly has no appointed CISO: the Technical Director runs information security.
ISM-1478	Overseeing the cyber security program: The CISO oversees their organisation’s cyber security program and ensures their organisation’s compliance with cyber security policy, standards, regulations and legislation.	Not yet assessed	Not yet assessed.
ISM-1617	Overseeing the cyber security program: The CISO regularly reviews and updates their organisation’s cyber security program to ensure its relevance in addressing cyber threats and harnessing business and cyber security opportunities.	Not yet assessed	Not yet assessed.
ISM-1966	Overseeing the cyber security program: The CISO develops, implements, maintains and regularly verifies a register of systems used by their organisation.	Not yet assessed	Not yet assessed.
ISM-0724	Overseeing the cyber security program: The CISO implements cyber security measurement metrics and key performance indicators for their organisation.	Not yet assessed	Not yet assessed.
ISM-0725	Coordinating cyber security: The CISO coordinates cyber security and business alignment through a cyber security steering committee or advisory board, comprising key cyber security and business executives, which meets formally and regularly.	Not yet assessed	Not yet assessed.
ISM-0726	Coordinating cyber security: The CISO coordinates security risk management activities between cyber security and business teams.	Not yet assessed	Not yet assessed.
ISM-0718	Reporting on cyber security: The CISO regularly reports directly to their organisation’s board of directors or executive committee on cyber security matters.	Not yet assessed	Not yet assessed.
ISM-1918	Reporting on cyber security: The CISO regularly reports directly to their organisation’s audit, risk and compliance committee (or equivalent) on cyber security matters.	Not yet assessed	Not yet assessed.
ISM-0733	Overseeing cyber security incident response activities: The CISO is fully aware of all cyber security incidents within their organisation.	Not yet assessed	Not yet assessed.
ISM-1618	Overseeing cyber security incident response activities: The CISO oversees their organisation’s response to cyber security incidents.	Not yet assessed	Not yet assessed.
ISM-0734	Contributing to business continuity and disaster recovery planning: The CISO contributes to the development, implementation and maintenance of business continuity and disaster recovery plans for their organisation to ensure that business-critical services are supported appropriately in the event of a disaster.	Not yet assessed	Not yet assessed.
ISM-0720	Communicating a cyber security vision and strategy: The CISO oversees the development, implementation and maintenance of a cyber security communications strategy to assist in communicating the cyber security vision and strategy for their organisation.	Not yet assessed	Not yet assessed.
ISM-0731	Working with suppliers: The CISO oversees cyber supply chain risk management activities for their organisation.	Not yet assessed	Not yet assessed.
ISM-0732	Receiving and managing a dedicated cyber security budget: The CISO receives and manages a dedicated cyber security budget for their organisation.	Not yet assessed	Not yet assessed.
ISM-0717	Overseeing cyber security personnel: The CISO oversees the management of cyber security personnel within their organisation.	Not yet assessed	Not yet assessed.
ISM-2020	Overseeing cyber security personnel: The CISO ensures sufficient cyber security personnel, with the right skills and experience, are acquired to support cyber security activities within their organisation.	Not yet assessed	Not yet assessed.
ISM-0735	Overseeing cyber security awareness training: The CISO oversees the development, implementation and maintenance of their organisation’s cyber security awareness training program.	Not yet assessed	Not yet assessed.
ISM-1071	System ownership and oversight: Each system has a designated system owner.	In place	Techly's two directors are accountable for information security. The Technical Director runs it day to day, and the Managing Director takes part in each policy's review and in every decision to accept a risk.
ISM-1525	System ownership and oversight: System owners register each system with its authorising officer.	Not yet assessed	Not yet assessed.
ISM-1633	Protecting systems and their resources: System owners, in consultation with each system’s authorising officer, determine the system boundary, business criticality, and security and resilience objectives for each system based on an assessment of the impact if it were to be compromised or attacked.	Not yet assessed	Not yet assessed.
ISM-1203	Protecting systems and their resources: System owners, in consultation with each system’s authorising officer, conduct a threat and risk assessment for each system.	Not yet assessed	Not yet assessed.
ISM-1634	Protecting systems and their resources: System owners, in consultation with each system’s authorising officer, select security controls for each system and tailor them to achieve desired security and resilience objectives.	Not yet assessed	Not yet assessed.
ISM-0009	Protecting systems and their resources: System owners, in consultation with each system’s authorising officer, identify any supplementary security controls required based upon the unique nature of each system, its operating environment and the organisation’s risk tolerances.	Not yet assessed	Not yet assessed.
ISM-1635	Protecting systems and their resources: System owners implement security controls for each system and its operating environment.	Not yet assessed	Not yet assessed.
ISM-1636	Protecting systems and their resources: System owners, in consultation with each system’s authorising officer, ensure security controls for each non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET system and its operating environment undergo a security control assessment by their organisation’s own assessors or Infosec Registered Assessor Program (IRAP) assessors to determine if they have been implemented correctly and are operating as intended.	Not yet assessed	Not yet assessed.
ISM-0027	Protecting systems and their resources: System owners obtain an authorisation to operate for each non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET system from its authorising officer.	Not yet assessed	Not yet assessed.
ISM-1526	Protecting systems and their resources: System owners continuously monitor the security of each system, and manage associated cyber threats, security risks and security controls.	Not yet assessed	Not yet assessed.
ISM-2021	Protecting systems and their resources: System owners implement and maintain data minimisation practices for each of their systems.	Not yet assessed	Not yet assessed.
ISM-1587	Annual reporting of system security status: System owners report the security status of each system to its authorising officer at least annually.	Not yet assessed	Not yet assessed.
ISM-0576	Cyber security incident management policy: A cyber security incident management policy, and associated cyber security incident response plan, is developed, implemented and maintained.	Partial	The Incident Management Policy sets out how an incident is found, rated, contained, investigated with its evidence preserved, and learned from, who leads it and when customers are told. Each Critical or High incident gets a written review within 10 business days, and an affected customer may ask for a summary of it. The policy took effect on 25 October 2026, and the yearly walk-through of an incident scenario it requires has not yet been held.
ISM-1784	Cyber security incident management policy: The cyber security incident management policy, including the associated cyber security incident response plan, is exercised at least annually.	Partial	The Incident Management Policy sets out how an incident is found, rated, contained, investigated with its evidence preserved, and learned from, who leads it and when customers are told. Each Critical or High incident gets a written review within 10 business days, and an affected customer may ask for a summary of it. The policy took effect on 25 October 2026, and the yearly walk-through of an incident scenario it requires has not yet been held.
ISM-0125	Cyber security incident register: A cyber security incident register is developed, implemented and maintained.	In place	Each incident is recorded in Techly's issue tracker with its timeline, its cause and its follow-up actions.
ISM-1803	Cyber security incident register: A cyber security incident register contains the following for each cyber security incident: - the date the cyber security incident occurred - the date the cyber security incident was discovered - a description of the cyber security incident - any actions taken in response to the cyber security incident - to whom the cyber security incident was reported.	Partial	Each incident is recorded in Techly's issue tracker with its timeline, its cause and its follow-up actions. The record does not say to whom each incident was reported.
ISM-1625	Insider threat mitigation program: An insider threat mitigation program is developed, implemented and maintained.	Not yet assessed	Not yet assessed.
ISM-1626	Insider threat mitigation program: Legal advice is sought regarding the development and implementation of an insider threat mitigation program.	Not yet assessed	Not yet assessed.
ISM-0123	Reporting cyber security incidents: Cyber security incidents are reported to the chief information security officer, or one of their delegates, as soon as possible after they occur or are discovered.	Partial	Staff read Techly's policies when they join and confirm each year that they follow them, use their own named account with two-step sign-in wherever a system offers it, report anything that may be an incident straight away, and lose their access on the day they leave; a breach of the policies can lead to access being removed. Security training beyond the policies is not yet documented. The Incident Management Policy sets out how an incident is found, rated, contained, investigated with its evidence preserved, and learned from, who leads it and when customers are told. Each Critical or High incident gets a written review within 10 business days, and an affected customer may ask for a summary of it. The policy took effect on 25 October 2026, and the yearly walk-through of an incident scenario it requires has not yet been held.
ISM-0140	Reporting cyber security incidents to ASD: Cyber security incidents are reported to ASD as soon as possible after they occur or are discovered.	Partial	We notify an affected customer of a suspected or confirmed security incident affecting their data without undue delay and no later than 48 hours, and assess a possible eligible data breach under the Privacy Act 1988 (Cth) within 30 days. Reporting an incident to ASD is not yet part of the Incident Management Policy.
ISM-1880	Reporting cyber security incidents to customers and the public: Cyber security incidents that involve customer data are reported to customers and the public in a timely manner after they occur or are discovered.	In place	We notify an affected customer of a suspected or confirmed security incident affecting their data without undue delay and no later than 48 hours, and assess a possible eligible data breach under the Privacy Act 1988 (Cth) within 30 days.
ISM-1881	Reporting cyber security incidents to customers and the public: Cyber security incidents that do not involve customer data are reported to customers and the public in a timely manner after they occur or are discovered.	Partial	We notify an affected customer of a suspected or confirmed security incident affecting their data without undue delay and no later than 48 hours, and assess a possible eligible data breach under the Privacy Act 1988 (Cth) within 30 days. We do not yet commit to report an incident that does not involve customer data.
ISM-1819	Enacting cyber security incident response plans: Following the identification of a cyber security incident, the cyber security incident response plan is enacted.	Partial	The Incident Management Policy sets out how an incident is found, rated, contained, investigated with its evidence preserved, and learned from, who leads it and when customers are told. Each Critical or High incident gets a written review within 10 business days, and an affected customer may ask for a summary of it. The policy took effect on 25 October 2026, and the yearly walk-through of an incident scenario it requires has not yet been held.
ISM-0133	Handling and containing data spills: When a data spill occurs, data owners are advised and access to the data is restricted.	Partial	We notify an affected customer of a suspected or confirmed security incident affecting their data without undue delay and no later than 48 hours, and assess a possible eligible data breach under the Privacy Act 1988 (Cth) within 30 days. The Incident Management Policy sets out how an incident is found, rated, contained, investigated with its evidence preserved, and learned from, who leads it and when customers are told. Each Critical or High incident gets a written review within 10 business days, and an affected customer may ask for a summary of it. The policy took effect on 25 October 2026, and the yearly walk-through of an incident scenario it requires has not yet been held.
ISM-0917	Handling and containing malicious code infections: When malicious code is detected, the following steps are taken to handle the infection: - the infected systems are isolated - all previously connected media used in the period leading up to the infection are scanned for signs of infection and isolated if necessary - antivirus applications are used to remove the infection from infected systems and media - if the infection cannot be reliably removed, systems are restored from a known good backup or rebuilt.	Not yet assessed	Not yet assessed.
ISM-1969	Handling and containing malicious code infections: Malicious code, when stored or communicated, is treated beforehand to prevent accidental execution.	Not yet assessed	Not yet assessed.
ISM-1970	Handling and containing malicious code infections: Malicious code processing for cyber security incident response or research purposes is conducted in a dedicated analysis environment segregated from other systems.	Not yet assessed	Not yet assessed.
ISM-0137	Handling and containing intrusions: Legal advice is sought before allowing intrusion activity to continue on a system for the purpose of collecting further data or evidence.	Not yet assessed	Not yet assessed.
ISM-1609	Handling and containing intrusions: System owners are consulted before allowing intrusion activity to continue on a system for the purpose of collecting further data or evidence.	Not yet assessed	Not yet assessed.
ISM-1731	Handling and containing intrusions: Planning and coordination of intrusion remediation activities are conducted using trusted systems separate from a compromised system.	Not yet assessed	Not yet assessed.
ISM-1732	Handling and containing intrusions: Intrusion remediation activities are coordinated and sequenced to minimise opportunities for re-compromise of a system while balancing operational risk and business continuity requirements.	Not yet assessed	Not yet assessed.
ISM-1213	Handling and containing intrusions: Following intrusion remediation activities, enhanced monitoring is conducted until there is sufficient evidence-based confidence that malicious actors have been eradicated from a system and have not re-established access.	Not yet assessed	Not yet assessed.
ISM-0138	Maintaining the integrity of evidence: The integrity of evidence gathered during an investigation is maintained by investigators: - recording all their actions - maintaining a proper chain of custody - following all instructions provided by relevant law enforcement agencies.	Partial	The Incident Management Policy sets out how an incident is found, rated, contained, investigated with its evidence preserved, and learned from, who leads it and when customers are told. Each Critical or High incident gets a written review within 10 business days, and an affected customer may ask for a summary of it. The policy took effect on 25 October 2026, and the yearly walk-through of an incident scenario it requires has not yet been held.
ISM-1631	Cyber supply chain risk management activities: Suppliers of operating systems, applications, IT equipment, OT equipment and services associated with systems are identified.	In place	Every service provider that handles customer data is named on Data locations and in our Privacy Statement, with what it receives and where, and a change to that list is recorded in the statement's revision history.
ISM-1452	Cyber supply chain risk management activities: A supply chain risk assessment is performed for suppliers of operating systems, applications, IT equipment, OT equipment and services to assess the impact to a system’s security risk profile.	Partial	The Supplier Security Policy sets how a provider is chosen (what it will receive and where, its security, its data processing terms, and how we would leave it) and has each one reviewed every year. Copies of each provider's data processing terms are still being collected.
ISM-1567	Cyber supply chain risk management activities: Suppliers identified as high risk by a cyber supply chain risk assessment are not used.	Not yet assessed	Not yet assessed.
ISM-1568	Cyber supply chain risk management activities: Operating systems, applications, IT equipment, OT equipment and services are procured from suppliers that have demonstrated a commitment to the security of their products and services.	Not yet assessed	Not yet assessed.
ISM-1882	Cyber supply chain risk management activities: Operating systems, applications, IT equipment, OT equipment and services are procured from suppliers that have demonstrated a commitment to transparency for their products and services.	Not yet assessed	Not yet assessed.
ISM-1632	Cyber supply chain risk management activities: Operating systems, applications, IT equipment, OT equipment and services are procured from suppliers that have a strong track record of maintaining the security of their own systems.	Not yet assessed	Not yet assessed.
ISM-1569	Cyber supply chain risk management activities: A shared responsibility model is created, documented and shared between suppliers and their customers to articulate the security responsibilities of each party.	In place	This Trust Centre sets out what Pyron does and what a customer does, action by action, against ASD's Essentials for cloud, and names the owner of each answer to the Cloud Security Alliance's questionnaire.
ISM-1785	Supplier relationship management: A supplier relationship management policy is developed, implemented and maintained.	Partial	Techly's Information Security Policy and the thirteen policies under it, among them Access Control, Acceptable Use, Business Continuity, Cryptography, Logging and Monitoring, Secure Development, Supplier Security and Vulnerability Management, are published in this Trust Centre. Each names its owner and is reviewed every year. The Supplier Security Policy sets how a provider is chosen (what it will receive and where, its security, its data processing terms, and how we would leave it) and has each one reviewed every year. Copies of each provider's data processing terms are still being collected.
ISM-1786	Supplier relationship management: An approved supplier list is developed, implemented and maintained.	In place	Every service provider that handles customer data is named on Data locations and in our Privacy Statement, with what it receives and where, and a change to that list is recorded in the statement's revision history.
ISM-1787	Sourcing operating systems, applications, IT equipment, OT equipment and services: Operating systems, applications, IT equipment, OT equipment and services are sourced from approved suppliers.	Not yet assessed	Not yet assessed.
ISM-1788	Sourcing operating systems, applications, IT equipment, OT equipment and services: Multiple potential suppliers are identified for sourcing critical operating systems, applications, IT equipment, OT equipment and services.	Not yet assessed	Not yet assessed.
ISM-1789	Sourcing operating systems, applications, IT equipment, OT equipment and services: Sufficient spares of critical IT equipment and OT equipment are sourced and kept in reserve.	Not yet assessed	Not yet assessed.
ISM-1790	Delivery of operating systems, applications, IT equipment, OT equipment and services: Operating systems, applications, IT equipment, OT equipment and services are delivered in a manner that maintains their integrity.	Not yet assessed	Not yet assessed.
ISM-1791	Delivery of operating systems, applications, IT equipment, OT equipment and services: The integrity of operating systems, applications, IT equipment, OT equipment and services are assessed as part of acceptance of products and services.	Not yet assessed	Not yet assessed.
ISM-1792	Delivery of operating systems, applications, IT equipment, OT equipment and services: The authenticity of operating systems, applications, IT equipment, OT equipment and services are assessed as part of acceptance of products and services.	Not yet assessed	Not yet assessed.
ISM-1736	Managed services: A managed service register is developed, implemented, maintained and regularly verified.	Not yet assessed	Not yet assessed.
ISM-1737	Managed services: A managed service register contains the following for each managed service: - managed service provider’s name - managed service’s name - purpose for using the managed service - sensitivity or classification of data involved - due date for the next security control assessment of the managed service - contractual arrangements for the managed service - organisational point of contact for the managed service - 24/7 contact details for the managed service provider.	Not yet assessed	Not yet assessed.
ISM-1793	Assessment of managed service providers: Managed service providers and their non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET managed services undergo an Infosec Registered Assessor Program (IRAP) assessment, using the latest release of the ISM available prior to the beginning of the IRAP assessment (or a subsequent release), at least every 24 months.	Not yet assessed	Not yet assessed.
ISM-1637	Outsourced cloud services: An outsourced cloud service register is developed, implemented, maintained and regularly verified.	Partial	Every service provider that handles customer data is named on Data locations and in our Privacy Statement, with what it receives and where, and a change to that list is recorded in the statement's revision history. The list does not record when each provider's next security assessment is due, its contract or its contacts.
ISM-1638	Outsourced cloud services: An outsourced cloud service register contains the following for each outsourced cloud service: - cloud service provider’s name - cloud service’s name - purpose for using the cloud service - sensitivity or classification of data involved - due date for the next security control assessment of the cloud service - contractual arrangements for the cloud service - organisational point of contact for the cloud service - 24/7 contact details for the cloud service provider.	Partial	Every service provider that handles customer data is named on Data locations and in our Privacy Statement, with what it receives and where, and a change to that list is recorded in the statement's revision history. The list does not record when each provider's next security assessment is due, its contract or its contacts.
ISM-1570	Assessment of outsourced cloud service providers: Outsourced cloud service providers and their non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET cloud services undergo an IRAP assessment, using the latest release of the ISM available prior to the beginning of the IRAP assessment (or a subsequent release), at least every 24 months.	Not yet assessed	Not yet assessed.
ISM-1395	Contractual security requirements with service providers: Service providers, including any subcontractors, provide an appropriate level of protection for any data entrusted to them or their services.	Not yet assessed	Not yet assessed.
ISM-0072	Contractual security requirements with service providers: Security requirements associated with the confidentiality, integrity and availability of data are documented in contractual arrangements with service providers and regularly reviewed to ensure they remain fit for purpose.	Not yet assessed	Not yet assessed.
ISM-1571	Contractual security requirements with service providers: The right to verify compliance with security requirements is documented in contractual arrangements with service providers.	Not yet assessed	Not yet assessed.
ISM-1738	Contractual security requirements with service providers: The right to verify compliance with security requirements documented in contractual arrangements with service providers is regularly exercised.	Not yet assessed	Not yet assessed.
ISM-1804	Contractual security requirements with service providers: Break clauses associated with failure to meet security requirements are documented in contractual arrangements with service providers.	Not yet assessed	Not yet assessed.
ISM-0141	Contractual security requirements with service providers: The requirement for service providers to report cyber security incidents to a designated point of contact as soon as possible after they occur or are discovered is documented in contractual arrangements with service providers.	Not yet assessed	Not yet assessed.
ISM-1794	Contractual security requirements with service providers: A minimum notification period of one month by service providers for significant changes to their own service provider arrangements is documented in contractual arrangements with service providers.	Not yet assessed	Not yet assessed.
ISM-1451	Contractual security requirements with service providers: Types of data and its ownership is documented in contractual arrangements with service providers.	Not yet assessed	Not yet assessed.
ISM-1572	Contractual security requirements with service providers: The regions or availability zones where data will be processed, stored and communicated, as well as a minimum notification period for any configuration changes, is documented in contractual arrangements with service providers.	Not yet assessed	Not yet assessed.
ISM-1573	Contractual security requirements with service providers: Access to all logs relating to an organisation’s data and services is documented in contractual arrangements with service providers.	Not yet assessed	Not yet assessed.
ISM-1574	Contractual security requirements with service providers: The storage of data in a portable manner that enables backups, service migration and service decommissioning without any loss of data is documented in contractual arrangements with service providers.	Not yet assessed	Not yet assessed.
ISM-1575	Contractual security requirements with service providers: A minimum notification period of one month for the cessation of any services by a service provider is documented in contractual arrangements with service providers.	Not yet assessed	Not yet assessed.
ISM-1073	Access to systems by service providers: An organisation’s systems are not accessed or administered by a service provider unless a contractual arrangement exists between the organisation and the service provider to do so.	Not yet assessed	Not yet assessed.
ISM-2124	Access to systems by service providers: Access by a service provider to an organisation’s systems is restricted to remote management tools, source network addresses and time windows explicitly approved by the organisation.	Not yet assessed	Not yet assessed.
ISM-1576	Access to systems by service providers: If an organisation’s systems are accessed or administered by a service provider in an unauthorised manner, it is treated as a cyber security incident and the organisation is immediately notified.	Not yet assessed	Not yet assessed.
ISM-2125	Access to systems by service providers: All access to an organisation’s systems by a service provider is independently logged by the organisation in a manner that the service provider cannot modify or delete, and analysed in a timely manner to detect any anomalous, unexpected or unauthorised activity.	Not yet assessed	Not yet assessed.
ISM-0039	Cyber security strategy: A cyber security strategy is developed, implemented and maintained.	Not yet assessed	Not yet assessed.
ISM-0047	Approval of cyber security documentation: Organisational-level cyber security documentation is approved by the chief information security officer while system-specific cyber security documentation is approved by the system’s authorising officer.	Not yet assessed	Not yet assessed.
ISM-1739	Approval of cyber security documentation: A system’s security architecture is approved prior to the development of the system.	Not yet assessed	Not yet assessed.
ISM-0888	Maintenance of cyber security documentation: Cyber security documentation is reviewed at least annually and includes a ‘current as at [date]’ or equivalent statement.	In place	Techly's Information Security Policy and the thirteen policies under it, among them Access Control, Acceptable Use, Business Continuity, Cryptography, Logging and Monitoring, Secure Development, Supplier Security and Vulnerability Management, are published in this Trust Centre. Each names its owner and is reviewed every year.
ISM-1602	Communication of cyber security documentation: Cyber security documentation, including notification of subsequent changes, is communicated to all stakeholders.	In place	Techly's Information Security Policy and the thirteen policies under it, among them Access Control, Acceptable Use, Business Continuity, Cryptography, Logging and Monitoring, Secure Development, Supplier Security and Vulnerability Management, are published in this Trust Centre. Each names its owner and is reviewed every year. This Trust Centre publishes our security overview, where each kind of data is held and these self-assessments, openly and each with a version and a date.
ISM-0041	System security plan: Systems have a system security plan that includes an overview of the system (covering the system’s purpose, the system boundary and how the system is managed) as well as an annex that covers applicable security controls from this document and any additional security controls that have been identified and implemented.	Not yet assessed	Not yet assessed.
ISM-0043	Cyber security incident response plan: Systems have a cyber security incident response plan that covers the following: - guidelines on what constitutes a cyber security incident - the types of cyber security incidents likely to be encountered and the expected response to each type - how to report cyber security incidents, internally to an organisation and externally to relevant authorities - other parties that need to be informed in the event of a cyber security incident - the authority, or authorities, responsible for investigating and responding to cyber security incidents - the criteria by which an investigation of a cyber security incident would be requested from a law enforcement agency, the Australian Signals Directorate or other relevant authority - the steps necessary to ensure the integrity of evidence relating to a cyber security incident - system contingency measures or a reference to such details if they are in a separate document.	Partial	The Incident Management Policy sets out how an incident is found, rated, contained, investigated with its evidence preserved, and learned from, who leads it and when customers are told. Each Critical or High incident gets a written review within 10 business days, and an affected customer may ask for a summary of it. The policy took effect on 25 October 2026, and the yearly walk-through of an incident scenario it requires has not yet been held.
ISM-0912	Change and configuration management plan: Systems have a change and configuration management plan that includes: - the establishment and maintenance of authorised baseline configurations for systems - what constitutes routine and urgent changes to the configuration of systems - how changes to the configuration of systems will be requested, tracked and documented - who needs to be consulted prior to routine and urgent changes to the configuration of systems - who needs to approve routine and urgent changes to the configuration of systems - who needs to be notified of routine and urgent changes to the configuration of systems - what additional change management and configuration management processes and procedures need to be followed before, during and after routine and urgent changes to the configuration of systems.	In place	The Change Management Policy sets out how every change to Pyron is made, checked, released and recorded, including emergency changes, and it is reviewed every year. Our cloud accounts, network edge and source control are defined in code, changed through pull requests, and scanned for insecure settings (Checkov) on every change.
ISM-1163	Continuous monitoring plan: Systems have a continuous monitoring plan that includes: - conducting security assessment activities to identify vulnerabilities - analysing identified vulnerabilities to determine their potential impact - implementing mitigations based on risk, effectiveness and cost.	Not yet assessed	Not yet assessed.
ISM-1563	Security assessment report: At the conclusion of a security control assessment for a system, a security assessment report is produced by the assessor and covers: - the scope of the security control assessment - the system’s strengths and weaknesses - security risks associated with the operation of the system - the effectiveness of the implementation of security controls - any recommended remediation actions.	Not yet assessed	Not yet assessed.
ISM-1564	Plan of action and milestones: At the conclusion of a security control assessment for a system, a plan of action and milestones is produced by the system owner.	Not yet assessed	Not yet assessed.
ISM-1973	Physical access to systems: Non-classified systems are secured in suitably secure facilities.	In place	Pyron runs on AWS and Cloudflare, with no data centre or server room of its own. The physical and environmental security of the facilities it runs in, including their power, cooling, cabling and the disposal of their storage media, is theirs, under their own independent certifications.
ISM-1974	Physical access to servers, network devices and cryptographic equipment: Non-classified servers, network devices and cryptographic equipment are secured in suitably secure server rooms or communications rooms.	In place	Pyron runs on AWS and Cloudflare, with no data centre or server room of its own. The physical and environmental security of the facilities it runs in, including their power, cooling, cabling and the disposal of their storage media, is theirs, under their own independent certifications.
ISM-1975	Physical access to servers, network devices and cryptographic equipment: Non-classified servers, network devices and cryptographic equipment are secured in suitably secure security containers.	In place	Pyron runs on AWS and Cloudflare, with no data centre or server room of its own. The physical and environmental security of the facilities it runs in, including their power, cooling, cabling and the disposal of their storage media, is theirs, under their own independent certifications.
ISM-0813	Physical access to servers, network devices and cryptographic equipment: Server rooms, communications rooms and security containers are not left in unsecured states.	In place	Pyron runs on AWS and Cloudflare, with no data centre or server room of its own. The physical and environmental security of the facilities it runs in, including their power, cooling, cabling and the disposal of their storage media, is theirs, under their own independent certifications.
ISM-1074	Physical access to servers, network devices and cryptographic equipment: Keys or equivalent access mechanisms to server rooms, communications rooms and security containers are appropriately controlled.	In place	Pyron runs on AWS and Cloudflare, with no data centre or server room of its own. The physical and environmental security of the facilities it runs in, including their power, cooling, cabling and the disposal of their storage media, is theirs, under their own independent certifications.
ISM-1296	Physical access to network devices in public areas: Physical security is implemented to protect network devices in public areas from physical damage or unauthorised access.	In place	Pyron runs on AWS and Cloudflare, with no data centre or server room of its own. The physical and environmental security of the facilities it runs in, including their power, cooling, cabling and the disposal of their storage media, is theirs, under their own independent certifications.
ISM-0164	Preventing observation by unauthorised people: Unauthorised people are prevented from observing systems, in particular workstation displays and keyboards, within facilities.	Partial	A device used for Techly work must have its disk encrypted, a screen lock that engages within a few minutes, and a supported operating system kept up to date (Acceptable Use Policy). Each person confirms this when they join and every year; nothing enforces it centrally.
ISM-0161	Securing IT equipment and media: IT equipment and media are secured when not in use.	Partial	A device used for Techly work must have its disk encrypted, a screen lock that engages within a few minutes, and a supported operating system kept up to date (Acceptable Use Policy). Each person confirms this when they join and every year; nothing enforces it centrally.
ISM-0252	Providing cyber security awareness training: Cyber security awareness training is undertaken annually by all personnel and covers: - the purpose of the cyber security awareness training - security appointments and contacts - authorised use of systems and their resources - protection of systems and their resources - reporting of cyber security incidents and suspected compromises of systems and their resources.	Partial	Staff read Techly's policies when they join and confirm each year that they follow them, use their own named account with two-step sign-in wherever a system offers it, report anything that may be an incident straight away, and lose their access on the day they leave; a breach of the policies can lead to access being removed. Security training beyond the policies is not yet documented.
ISM-1565	Providing cyber security awareness training: Tailored privileged user training is undertaken annually by all personnel with privileged access to systems and their resources.	Not yet assessed	Not yet assessed.
ISM-2022	Providing cyber security awareness training: A cyber security awareness training register is developed, implemented and maintained.	Not yet assessed	Not yet assessed.
ISM-2074	General-purpose artificial intelligence usage policy: A general-purpose AI usage policy is developed, implemented and maintained.	Not yet assessed	Not yet assessed.
ISM-0258	Web usage policy: A web usage policy is developed, implemented and maintained.	Not yet assessed	Not yet assessed.
ISM-1740	Managing requests to change banking details or transfer funds: Personnel dealing with banking details and payment requests are advised of what business email compromise is and how to manage and report it.	Not yet assessed	Not yet assessed.
ISM-2071	Managing requests to modify user accounts: Personnel dealing with user account details are advised of what social engineering attacks are, how to manage such situations and how to report them.	Not yet assessed	Not yet assessed.
ISM-2126	Synthetic impersonation: Personnel positively identify requestors using a pre-established authentication method or independent trusted communication channel before actioning requests to modify user account details, modify banking details or conduct financial transactions.	Not yet assessed	Not yet assessed.
ISM-0817	Reporting suspicious contact via online services: Personnel are advised of what suspicious contact via online services is and how to report it.	Not yet assessed	Not yet assessed.
ISM-0820	Posting work-related information on online services: Personnel are advised not to post work-related information on unauthorised online services, and to report cases where such information is posted.	Not yet assessed	Not yet assessed.
ISM-2104	Posting work-related information on online services: Personnel are advised not to post information about their security clearance and briefings on unauthorised online services, and to report cases where such information is posted.	Not yet assessed	Not yet assessed.
ISM-2105	Posting work-related information on online services: Personnel are advised to limit posting information about their work-related duties on unauthorised online services, and to report cases where such information is posted.	Not yet assessed	Not yet assessed.
ISM-2106	Posting work-related information on online services: Personnel are advised to limit posting information about their work-related skills and experience on unauthorised online services, and to report cases where such information is posted.	Not yet assessed	Not yet assessed.
ISM-0821	Posting personal information on online services: Personnel are advised of security risks associated with posting personal information on online services.	Not yet assessed	Not yet assessed.
ISM-1146	Posting personal information on online services: Personnel are advised to maintain separate personal user accounts from any work user accounts they use for online services.	Not yet assessed	Not yet assessed.
ISM-2107	Posting personal information on online services: Personnel are encouraged to use any available privacy settings to restrict who can view personal information they post on online services.	Not yet assessed	Not yet assessed.
ISM-0824	Sending and receiving files via online services: Personnel are advised not to send or receive files via unauthorised online services.	Not yet assessed	Not yet assessed.
ISM-0181	Cabling infrastructure standards: Cabling infrastructure is installed in accordance with relevant Australian Standards, as directed by the Australian Communications and Media Authority.	Not yet assessed	Not yet assessed.
ISM-1111	Use of fibre-optic cables: Fibre-optic cables are used for cabling infrastructure instead of copper cables.	Not yet assessed	Not yet assessed.
ISM-0211	Cable register: A cable register is developed, implemented, maintained and regularly verified.	Not yet assessed	Not yet assessed.
ISM-0208	Cable register: A cable register contains the following for each cable: - cable identifier - cable colour - sensitivity/classification - source - destination - location - seal numbers (if applicable).	Not yet assessed	Not yet assessed.
ISM-1645	Floor plan diagrams: Floor plan diagrams are developed, implemented, maintained and regularly verified.	Not yet assessed	Not yet assessed.
ISM-1646	Floor plan diagrams: Floor plan diagrams contain the following: - cable paths (including ingress and egress points between floors) - cable reticulation system and conduit paths - floor concentration boxes - wall outlet boxes - network cabinets.	Not yet assessed	Not yet assessed.
ISM-0206	Cable labelling processes and procedures: Cable labelling processes, and supporting cable labelling procedures, are developed, implemented and maintained.	Not yet assessed	Not yet assessed.
ISM-1096	Labelling cables: Cables are labelled at each end with sufficient source and destination details to enable the physical identification and inspection of the cable.	Not yet assessed	Not yet assessed.
ISM-1639	Labelling building management cables: Building management cables are labelled with their purpose in black writing on a yellow background, with a minimum size of 2.5 cm x 1 cm, and attached at five-metre intervals.	Not yet assessed	Not yet assessed.
ISM-1640	Labelling cables for foreign systems in Australian facilities: Cables for foreign systems installed in Australian facilities are labelled at inspection points.	Not yet assessed	Not yet assessed.
ISM-1820	Cable colours: Cables for individual systems use a consistent colour.	Not yet assessed	Not yet assessed.
ISM-0926	Cable colours: Non-classified, OFFICIAL: Sensitive and PROTECTED cables are coloured neither salmon pink nor red.	Not yet assessed	Not yet assessed.
ISM-1112	Cable inspectability: Cables in non-TOP SECRET areas are inspectable every five metres or less.	Not yet assessed	Not yet assessed.
ISM-1119	Cable inspectability: Cables in TOP SECRET areas are fully inspectable for their entire length.	Not yet assessed	Not yet assessed.
ISM-1114	Common cable reticulation systems: Cable bundles or conduits sharing a common cable reticulation system have a dividing partition or visible gap between each cable bundle and conduit.	Not yet assessed	Not yet assessed.
ISM-1130	Enclosed cable reticulation systems: In shared facilities, cables are run in an enclosed cable reticulation system.	Not yet assessed	Not yet assessed.
ISM-1164	Covers for enclosed cable reticulation systems: In shared facilities, conduits or the front covers of ducts, cable trays in floors and ceilings, and associated fittings are clear plastic.	Not yet assessed	Not yet assessed.
ISM-1115	Cables in walls: Cables from cable trays to wall outlet boxes are run in flexible or plastic conduit.	Not yet assessed	Not yet assessed.
ISM-1095	Labelling wall outlet boxes: Wall outlet boxes denote the systems, cable identifiers and wall outlet box identifier.	Not yet assessed	Not yet assessed.
ISM-1822	Wall outlet box colours: Wall outlet boxes for individual systems use a consistent colour.	Not yet assessed	Not yet assessed.
ISM-1107	Wall outlet box colours: Non-classified, OFFICIAL: Sensitive and PROTECTED wall outlet boxes are coloured neither salmon pink nor red.	Not yet assessed	Not yet assessed.
ISM-1109	Wall outlet box covers: Wall outlet box covers are clear plastic.	Not yet assessed	Not yet assessed.
ISM-1102	Connecting cable reticulation systems to cabinets: Cable reticulation systems leading into cabinets are terminated as close as possible to the cabinet.	Not yet assessed	Not yet assessed.
ISM-1101	Connecting cable reticulation systems to cabinets: In TOP SECRET areas, cable reticulation systems leading into cabinets in server rooms or communications rooms are terminated as close as possible to the cabinet.	Not yet assessed	Not yet assessed.
ISM-1103	Connecting cable reticulation systems to cabinets: In TOP SECRET areas, cable reticulation systems leading into cabinets not in server rooms or communications rooms are terminated at the boundary of the cabinet.	Not yet assessed	Not yet assessed.
ISM-0250	Electromagnetic interference/electromagnetic compatibility standards: IT equipment meets industry and government standards relating to electromagnetic interference/electromagnetic compatibility.	Not yet assessed	Not yet assessed.
ISM-1078	Telephone system usage policy: A telephone system usage policy is developed, implemented and maintained.	Not yet assessed	Not yet assessed.
ISM-0229	Personnel awareness: Personnel are advised of the permitted sensitivity or classification of information that can be discussed over internal and external telephone systems.	Not yet assessed	Not yet assessed.
ISM-0230	Personnel awareness: Personnel are advised of security risks posed by non-secure telephone systems in areas where sensitive or classified conversations can occur.	Not yet assessed	Not yet assessed.
ISM-0231	Personnel awareness: When using cryptographic equipment to permit different levels of conversation for different kinds of connections, telephone systems give a visual indication of what kind of connection has been made.	Not yet assessed	Not yet assessed.
ISM-0232	Protecting conversations: Telephone systems used for sensitive or classified conversations encrypt all traffic that passes over external systems.	Not yet assessed	Not yet assessed.
ISM-0233	Cordless telephone systems: Cordless telephone handsets and headsets are not used for sensitive or classified conversations unless all communications are encrypted using ASD-approved cryptography.	Not yet assessed	Not yet assessed.
ISM-0235	Speakerphones: Speakerphones are not used on telephone systems in TOP SECRET areas unless the telephone system is located in an audio secure room, the room is audio secure during conversations and only personnel involved in conversations are present in the room.	Not yet assessed	Not yet assessed.
ISM-0236	Off-hook audio protection: Off-hook audio protection features are used on telephone systems in areas where background conversations may exceed the sensitivity or classification that the telephone system is authorised for communicating.	Not yet assessed	Not yet assessed.
ISM-0931	Off-hook audio protection: In SECRET and TOP SECRET areas, push-to-talk handsets or push-to-talk headsets are used to meet any off-hook audio protection requirements.	Not yet assessed	Not yet assessed.
ISM-1562	Video conferencing and Internet Protocol telephony infrastructure hardening: Video conferencing and IP telephony infrastructure is hardened.	Not yet assessed	Not yet assessed.
ISM-0546	Video-aware and voice-aware firewalls and proxies: When video conferencing or IP telephony traffic passes through a gateway containing a firewall or proxy, a video-aware or voice-aware firewall or proxy is used.	Not yet assessed	Not yet assessed.
ISM-0548	Protecting video conferencing and Internet Protocol telephony traffic: Video conferencing and IP telephony calls are established using a secure session initiation protocol.	Not yet assessed	Not yet assessed.
ISM-0547	Protecting video conferencing and Internet Protocol telephony traffic: Video conferencing and IP telephony calls are conducted using a secure real-time transport protocol.	Not yet assessed	Not yet assessed.
ISM-0554	Video conferencing unit and Internet Protocol phone authentication: An encrypted and non-replayable two-way authentication scheme is used for call authentication and authorisation.	Not yet assessed	Not yet assessed.
ISM-0553	Video conferencing unit and Internet Protocol phone authentication: Authentication and authorisation is used for all actions on a video conferencing network, including call setup and changing settings.	Not yet assessed	Not yet assessed.
ISM-0555	Video conferencing unit and Internet Protocol phone authentication: Authentication and authorisation is used for all actions on an IP telephony network, including registering a new IP phone, changing phone users, changing settings and accessing voicemail.	Not yet assessed	Not yet assessed.
ISM-0551	Video conferencing unit and Internet Protocol phone authentication: IP telephony is configured such that: - IP phones authenticate themselves to the call controller upon registration - auto-registration is disabled and only authorised devices are allowed to access the network - unauthorised devices are blocked by default - all unused and prohibited functionality is disabled.	Not yet assessed	Not yet assessed.
ISM-0549	Traffic separation: Video conferencing and IP telephony traffic is physically or logically separated from other data traffic.	Not yet assessed	Not yet assessed.
ISM-0556	Traffic separation: Workstations are not connected to video conferencing units or IP phones unless the workstation or the device uses virtual local area networks or similar mechanisms to maintain separation between video conferencing, IP telephony and other data traffic.	Not yet assessed	Not yet assessed.
ISM-0558	Internet Protocol phones in public areas: IP phones used in public areas do not have the ability to access data networks, voicemail and directory services.	Not yet assessed	Not yet assessed.
ISM-0559	Microphones and webcams: Microphones (including headsets and USB handsets) and webcams are not used with non-SECRET workstations in SECRET areas.	Not yet assessed	Not yet assessed.
ISM-1450	Microphones and webcams: Microphones (including headsets and USB handsets) and webcams are not used with non-TOP SECRET workstations in TOP SECRET areas.	Not yet assessed	Not yet assessed.
ISM-1019	Denial of service response plan: A denial of service response plan for video conferencing and IP telephony services is developed, implemented and maintained.	Not yet assessed	Not yet assessed.
ISM-1805	Denial of service response plan: A denial of service response plan for video conferencing and IP telephony services contains the following: - how to identify signs of a denial-of-service attack - how to identify the source of a denial-of-service attack - how capabilities can be maintained during a denial-of-service attack - what actions can be taken to respond to a denial-of-service attack.	Not yet assessed	Not yet assessed.
ISM-0588	Multifunction device usage policy: An MFD usage policy is developed, implemented and maintained.	Not yet assessed	Not yet assessed.
ISM-0245	Connecting multifunction devices to digital telephone systems: MFDs are not connected to digital telephone systems.	Not yet assessed	Not yet assessed.
ISM-1854	Authenticating to multifunction devices: Human users authenticate to MFDs before they can print, scan or copy documents.	Not yet assessed	Not yet assessed.
ISM-0590	Authenticating to multifunction devices: Authentication measures for MFDs are the same strength as those used for workstations on networks they are connected to.	Not yet assessed	Not yet assessed.
ISM-0589	Scanning and copying documents on multifunction devices: MFDs are not used to scan or copy documents above the sensitivity or classification of networks they are connected to.	Not yet assessed	Not yet assessed.
ISM-1855	Logging multifunction device use: Use of MFDs for printing, scanning and copying purposes, including the capture of shadow copies of documents, are centrally logged.	Not yet assessed	Not yet assessed.
ISM-1036	Observing multifunction device use: MFDs are placed in areas where their use can be observed.	Not yet assessed	Not yet assessed.
ISM-2075	Sending and receiving fax messages: Fax machines, and online fax services, are not used for sending or receiving fax messages.	Not yet assessed	Not yet assessed.
ISM-1297	Privately owned mobile devices and desktop computers: Legal advice is sought prior to allowing privately owned mobile devices and desktop computers to access systems or data.	Not yet assessed	Not yet assessed.
ISM-0874	Mobile devices and desktop computers accessing the internet: Mobile devices and desktop computers access the internet via an organisation’s internet gateway rather than via a direct connection to the internet.	Not yet assessed	Not yet assessed.
ISM-0705	Mobile devices and desktop computers accessing the internet: When accessing an organisation’s network via a VPN connection, split tunnelling is disabled.	Not yet assessed	Not yet assessed.
ISM-1533	Mobile device management policy: A mobile device management policy is developed, implemented and maintained.	Not yet assessed	Not yet assessed.
ISM-1195	Mobile device management policy: Mobile Device Management solutions that have completed a Common Criteria evaluation against the Protection Profile for Mobile Device Management, version 4.0 or later, are used to enforce mobile device management policy.	Not yet assessed	Not yet assessed.
ISM-0869	Encrypted storage: Mobile devices encrypt their internal storage and any removable media using ASD-approved cryptography.	Not yet assessed	Not yet assessed.
ISM-1085	Encrypted communications: Mobile devices encrypt all sensitive or classified data communicated over public network infrastructure using ASD-approved cryptography.	Not yet assessed	Not yet assessed.
ISM-2108	Encrypted communications: Mobile applications encrypt all sensitive or classified data communicated over public network infrastructure using ASD-approved cryptography.	Not yet assessed	Not yet assessed.
ISM-1886	Maintaining mobile device security: Mobile devices are configured to operate in a supervised (or equivalent) mode.	Not yet assessed	Not yet assessed.
ISM-2096	Maintaining mobile device security: Mobile devices are configured to enforce separation between organisational and personal mobile applications and data.	Not yet assessed	Not yet assessed.
ISM-2097	Maintaining mobile device security: Mobile devices are configured with always on VPN functionality.	Not yet assessed	Not yet assessed.
ISM-1887	Maintaining mobile device security: Mobile devices are configured with remote locate and wipe functionality.	Not yet assessed	Not yet assessed.
ISM-1888	Maintaining mobile device security: Mobile devices are configured with secure password-based lock screens.	Not yet assessed	Not yet assessed.
ISM-2098	Maintaining mobile device security: Mobile devices are configured to prevent data transfers over Universal Serial Bus connections.	Not yet assessed	Not yet assessed.
ISM-0863	Maintaining mobile device security: Mobile devices prevent personnel from installing non-approved applications once provisioned.	Not yet assessed	Not yet assessed.
ISM-0864	Maintaining mobile device security: Mobile devices prevent personnel from disabling or modifying security functionality once provisioned.	Not yet assessed	Not yet assessed.
ISM-1366	Maintaining mobile device security: Security updates are applied to mobile devices as soon as they become available.	Not yet assessed	Not yet assessed.
ISM-1082	Mobile device usage policy: A mobile device usage policy is developed, implemented and maintained.	Not yet assessed	Not yet assessed.
ISM-1083	Personnel awareness: Personnel are advised of the sensitivity or classification permitted for voice and data communications when using mobile devices.	Not yet assessed	Not yet assessed.
ISM-1299	Personnel awareness: Personnel are advised to take the following precautions when using mobile devices: - never leave mobile devices or removable media unattended, including by placing them in checked-in luggage or leaving them in hotel safes - never store credentials with mobile devices that they grant access to, such as in laptop computer bags - never lend mobile devices or removable media to untrusted people, even if briefly - never allow untrusted people to connect their mobile devices or removable media to your mobile devices, including for charging - never connect mobile devices to designated charging stations or wall outlet charging ports - never use gifted or unauthorised peripherals, chargers or removable media with mobile devices - never use removable media for data transfers or backups that have not been checked for malicious code beforehand - avoid reuse of removable media once used with other parties’ systems or mobile devices - avoid connecting mobile devices to open or untrusted Wi-Fi networks - consider disabling any communications capabilities of mobile devices when not in use, such as Wi-Fi, Bluetooth, Near Field Communication and ultra-wideband - consider periodically rebooting mobile devices - consider using a VPN connection to encrypt all cellular and wireless communications - consider using encrypted email or messaging apps for all communications.	Not yet assessed	Not yet assessed.
ISM-0240	Using paging, message services and messaging apps: Paging, Multimedia Message Service, Short Message Service and messaging apps are not used to communicate sensitive or classified data.	Not yet assessed	Not yet assessed.
ISM-1196	Using Bluetooth functionality: Non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices are configured to remain undiscoverable to other Bluetooth devices except during Bluetooth pairing.	Not yet assessed	Not yet assessed.
ISM-1200	Using Bluetooth functionality: Bluetooth pairing for non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices is performed using Secure Connections, preferably with Numeric Comparison if supported.	Not yet assessed	Not yet assessed.
ISM-1198	Using Bluetooth functionality: Bluetooth pairing for non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices is performed in a manner such that connections are only made between intended Bluetooth devices.	Not yet assessed	Not yet assessed.
ISM-1199	Using Bluetooth functionality: Bluetooth pairings for non-classified, OFFICIAL: Sensitive and PROTECTED mobile devices are removed when there is no longer a requirement for their use.	Not yet assessed	Not yet assessed.
ISM-2099	Connecting mobile devices to connected vehicles: Mobile devices are not connected to the infotainment systems of connected vehicles.	Not yet assessed	Not yet assessed.
ISM-2100	Using mobile devices within or near connected vehicles: Sensitive or classified data is not viewed on mobile devices within or near connected vehicles.	Not yet assessed	Not yet assessed.
ISM-2101	Using mobile devices within or near connected vehicles: Sensitive or classified phone calls and conversations are not conducted within or near connected vehicles.	Not yet assessed	Not yet assessed.
ISM-0866	Using mobile devices in public spaces: Sensitive or classified data is not viewed on mobile devices in public locations unless care is taken to reduce the chance of the screen of a mobile device being observed.	Not yet assessed	Not yet assessed.
ISM-1644	Using mobile devices in public spaces: Sensitive or classified phone calls and conversations are not conducted in public locations unless care is taken to reduce the chance of conversations being overheard.	Not yet assessed	Not yet assessed.
ISM-0871	Maintaining control of mobile devices: Mobile devices are kept under continual direct supervision when being actively used.	Not yet assessed	Not yet assessed.
ISM-0870	Maintaining control of mobile devices: Mobile devices are carried or stored in a secured state when not being actively used.	Not yet assessed	Not yet assessed.
ISM-1084	Maintaining control of mobile devices: If unable to carry or store mobile devices in a secured state, they are physically transferred in a security briefcase or an approved multi-use satchel, pouch or transit bag.	Not yet assessed	Not yet assessed.
ISM-0701	Mobile device emergency sanitisation processes and procedures: Mobile device emergency sanitisation processes, and supporting mobile device emergency sanitisation procedures, are developed, implemented and maintained.	Not yet assessed	Not yet assessed.
ISM-1298	Before travelling overseas with mobile devices: Personnel are advised of privacy and security risks when travelling overseas with mobile devices.	Not yet assessed	Not yet assessed.
ISM-1554	Before travelling overseas with mobile devices: If travelling overseas with mobile devices to high or extreme risk countries, personnel are: - issued with newly provisioned user accounts, mobile devices and removable media from a pool of dedicated travel devices which are used solely for work-related activities - advised on how to apply and inspect tamper seals to key areas of mobile devices - advised to avoid taking any personal mobile devices, especially if rooted or jailbroken.	Not yet assessed	Not yet assessed.
ISM-1555	Before travelling overseas with mobile devices: Before travelling overseas with mobile devices, personnel take the following actions: - record all details of the mobile devices being taken, such as product types, serial numbers and International Mobile Equipment Identity numbers - update all operating systems and applications - remove all non-essential data, applications and user accounts - backup all remaining data, applications and settings.	Not yet assessed	Not yet assessed.
ISM-1088	While travelling overseas with mobile devices: Personnel report the potential compromise of mobile devices, removable media or credentials to their organisation as soon as possible, especially if they: - provide credentials to foreign government officials - decrypt mobile devices for foreign government officials - have mobile devices taken out of sight by foreign government officials - have mobile devices or removable media stolen, including if later returned - lose mobile devices or removable media, including if later found - observe unusual behaviour of mobile devices.	Not yet assessed	Not yet assessed.
ISM-1300	After travelling overseas with mobile devices: Upon returning from travelling overseas with mobile devices, personnel take the following actions: - sanitise and reset mobile devices, including all removable media - decommission any credentials that left their possession during their travel - report if significant doubt exists as to the integrity of any mobile devices or removable media.	Not yet assessed	Not yet assessed.
ISM-1556	After travelling overseas with mobile devices: If returning from travelling overseas with mobile devices to high or extreme risk countries, personnel take the following additional actions: - reset credentials used with mobile devices, including those used for remote access to their organisation’s systems - monitor user accounts for any indicators of compromise, such as failed logon attempts.	Not yet assessed	Not yet assessed.
ISM-0280	Evaluated product selection: If procuring an evaluated product, a product that has completed a PP-based evaluation, including against all applicable PP modules (as well as a software bill of materials assessment if applicable), is selected in preference to one that has completed an EAL-based evaluation.	Not yet assessed	Not yet assessed.
ISM-0285	Delivery of evaluated products: Evaluated products are delivered in a manner consistent with any delivery procedures defined in associated evaluation documentation.	Not yet assessed	Not yet assessed.
ISM-0289	Using evaluated products: Evaluated products are installed, configured, administered and operated in an evaluated configuration and in accordance with vendor guidance.	Not yet assessed	Not yet assessed.
ISM-1551	IT equipment management policy: An IT equipment management policy is developed, implemented and maintained.	Not yet assessed	Not yet assessed.
ISM-1913	Hardening IT equipment configurations: Approved configurations for IT equipment are developed, implemented and maintained.	Not yet assessed	Not yet assessed.
ISM-1858	Hardening IT equipment configurations: IT equipment is hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.	Not yet assessed	Not yet assessed.
ISM-0336	IT equipment registers: A networked IT equipment register is developed, implemented, maintained and regularly verified.	Not yet assessed	Not yet assessed.
ISM-1869	IT equipment registers: A non-networked IT equipment register is developed, implemented, maintained and regularly verified.	Not yet assessed	Not yet assessed.
ISM-0294	Labelling IT equipment: IT equipment, except for high assurance IT equipment, is labelled with protective markings reflecting its sensitivity or classification.	Not yet assessed	Not yet assessed.
ISM-0293	Classifying IT equipment: IT equipment is classified based on the highest sensitivity or classification of data that it is approved for processing, storing or communicating.	Not yet assessed	Not yet assessed.
ISM-1599	Handling IT equipment: IT equipment is handled in a manner suitable for its sensitivity or classification.	Not yet assessed	Not yet assessed.
ISM-0305	On-site maintenance or repairs: Maintenance or repairs of IT equipment are carried out on site by an appropriately cleared technician.	Not yet assessed	Not yet assessed.
ISM-0307	On-site maintenance or repairs: If an appropriately cleared technician is not used to undertake maintenance or repairs to IT equipment, the IT equipment and associated media are sanitised before maintenance or repairs.	Not yet assessed	Not yet assessed.
ISM-0306	On-site maintenance or repairs: If an appropriately cleared technician is not used to undertake maintenance or repairs to IT equipment, the technician is escorted by someone who: - has the authority to direct the technician - is appropriately cleared and briefed - is sufficiently familiar with the IT equipment to understand the work being undertaken - takes all responsible measures to ensure the integrity of the IT equipment - takes due care to ensure that data is not disclosed.	Not yet assessed	Not yet assessed.
ISM-0310	Off-site maintenance or repairs: IT equipment maintained or repaired off site is handled at facilities approved for handling the sensitivity or classification of the IT equipment.	Not yet assessed	Not yet assessed.
ISM-1598	Inspection of IT equipment following maintenance or repairs: Following maintenance or repairs to IT equipment, it is inspected to confirm that it retains its approved configuration and that no unauthorised modifications have been made.	Not yet assessed	Not yet assessed.
ISM-0313	IT equipment sanitisation processes and procedures: IT equipment sanitisation processes, and supporting IT equipment sanitisation procedures, are developed, implemented and maintained.	Not yet assessed	Not yet assessed.
ISM-1741	IT equipment destruction processes and procedures: IT equipment destruction processes, and supporting IT equipment destruction procedures, are developed, implemented and maintained.	Not yet assessed	Not yet assessed.
ISM-0311	Sanitising IT equipment: IT equipment containing media is sanitised by removing the media from the IT equipment or by sanitising the media in situ.	Not yet assessed	Not yet assessed.
ISM-1742	Sanitising IT equipment: IT equipment that cannot be sanitised is destroyed.	Not yet assessed	Not yet assessed.
ISM-0317	Sanitising printers and multifunction devices: At least three pages of random text with no blank areas are printed on each colour printer cartridge or MFD print drum.	Not yet assessed	Not yet assessed.
ISM-1219	Sanitising printers and multifunction devices: MFD print drums and image transfer rollers are inspected and destroyed if there is remnant toner that cannot be removed or a print is visible on the image transfer roller.	Not yet assessed	Not yet assessed.
ISM-1220	Sanitising printers and multifunction devices: Printer and MFD platens are inspected and destroyed if any text or images are retained on the platen.	Not yet assessed	Not yet assessed.
ISM-1221	Sanitising printers and multifunction devices: Printers and MFDs are checked to ensure no pages are trapped in the paper path due to a paper jam.	Not yet assessed	Not yet assessed.
ISM-0318	Sanitising printers and multifunction devices: When unable to sanitise printer cartridges or MFD print drums, they are destroyed as per electrostatic memory devices.	Not yet assessed	Not yet assessed.
ISM-1534	Sanitising printers and multifunction devices: Printer ribbons in printers and MFDs are removed and destroyed.	Not yet assessed	Not yet assessed.
ISM-1076	Sanitising televisions and computer monitors: Televisions and computer monitors with minor burn-in or image persistence are sanitised by displaying a solid white image on the screen for an extended period.	Not yet assessed	Not yet assessed.
ISM-1222	Sanitising televisions and computer monitors: Televisions and computer monitors that cannot be sanitised are destroyed.	Not yet assessed	Not yet assessed.
ISM-1223	Sanitising network devices: Memory in network devices is sanitised using the following processes, in order of preference: - following device-specific guidance provided in evaluation documentation - following vendor sanitisation guidance - loading a dummy configuration file, performing a factory reset and then reinstalling firmware.	Not yet assessed	Not yet assessed.
ISM-1550	IT equipment disposal processes and procedures: IT equipment disposal processes, and supporting IT equipment disposal procedures, are developed, implemented and maintained.	Not yet assessed	Not yet assessed.
ISM-1217	Disposal of IT equipment: Labels and markings indicating the owner, sensitivity, classification or any other marking that can associate IT equipment with its prior use are removed prior to its disposal.	Not yet assessed	Not yet assessed.
ISM-0316	Disposal of IT equipment: Following sanitisation, destruction or declassification, a formal administrative decision is made to release IT equipment, or its waste, into the public domain.	Not yet assessed	Not yet assessed.
ISM-1549	Media management policy: A media management policy is developed, implemented and maintained.	Not yet assessed	Not yet assessed.
ISM-1359	Removable media usage policy: A removable media usage policy is developed, implemented and maintained.	Not yet assessed	Not yet assessed.
ISM-1713	Removable media register: A removable media register is developed, implemented, maintained and regularly verified.	Not yet assessed	Not yet assessed.
ISM-0332	Labelling media: Media, except for internally mounted fixed media within information technology equipment, is labelled with protective markings reflecting its sensitivity or classification.	Not yet assessed	Not yet assessed.
ISM-0323	Classifying media: Media is classified to the highest sensitivity or classification of data it stores, unless the media has been classified to a higher sensitivity or classification.	Not yet assessed	Not yet assessed.
ISM-0337	Classifying media: Media is only used with systems that are authorised to process, store or communicate its sensitivity or classification.	Not yet assessed	Not yet assessed.
ISM-0325	Reclassifying media: Any media connected to a system with a higher sensitivity or classification than the media is reclassified to the higher sensitivity or classification, unless the media is read-only or the system has a mechanism through which read-only access can be ensured.	Not yet assessed	Not yet assessed.
ISM-0330	Reclassifying media: Before reclassifying media to a lower sensitivity or classification, the media is sanitised or destroyed, and a formal administrative decision is made to reclassify it.	Not yet assessed	Not yet assessed.
ISM-1059	Encrypting media: All data stored on media is encrypted using ASD-approved cryptography.	Not yet assessed	Not yet assessed.
ISM-0459	Encrypting media: Full disk encryption, or partial encryption where access controls only allow writing to encrypted partitions or volumes, is implemented when encrypting media.	Not yet assessed	Not yet assessed.
ISM-2109	Encrypting media: Pre-boot authentication using passwords, or managed network-based key release, is implemented for media containing encrypted system volumes.	Not yet assessed	Not yet assessed.
ISM-0831	Handling media: Media is handled in a manner suitable for its sensitivity or classification.	Not yet assessed	Not yet assessed.
ISM-1600	Sanitising media before first use: Media is sanitised before it is used for the first time.	Not yet assessed	Not yet assessed.
ISM-1642	Sanitising media before first use: Media is sanitised before it is reused in a different security domain.	Not yet assessed	Not yet assessed.
ISM-0347	Using media for data transfers: When transferring data manually between two systems belonging to different security domains, write-once media is used unless the destination system has a mechanism through which read-only access can be ensured.	Not yet assessed	Not yet assessed.
ISM-0947	Using media for data transfers: When transferring data manually between two systems belonging to different security domains, rewritable media is sanitised after each data transfer.	Not yet assessed	Not yet assessed.
ISM-0348	Media sanitisation processes and procedures: Media sanitisation processes, and supporting media sanitisation procedures, are developed, implemented and maintained.	Not yet assessed	Not yet assessed.
ISM-0351	Volatile media sanitisation: Volatile media is sanitised by removing its power for at least 10 minutes.	Not yet assessed	Not yet assessed.
ISM-0354	Non-volatile magnetic media sanitisation: Non-volatile magnetic media is sanitised by overwriting it at least once (or three times if pre-2001 or under 15 GB) in its entirety with a random pattern followed by a read back for verification.	Not yet assessed	Not yet assessed.
ISM-1065	Non-volatile magnetic media sanitisation: The host-protected area and device configuration overlay table are reset prior to the sanitisation of non-volatile magnetic hard drives.	Not yet assessed	Not yet assessed.
ISM-1067	Non-volatile magnetic media sanitisation: The ATA secure erase command is used, in addition to block overwriting software, to ensure the growth defects table of non-volatile magnetic hard drives is overwritten.	Not yet assessed	Not yet assessed.
ISM-0357	Non-volatile erasable programmable read-only memory media sanitisation: Non-volatile EPROM media is sanitised by applying three times the manufacturer’s specified ultraviolet erasure time and then overwriting it at least once in its entirety with a random pattern followed by a read back for verification.	Not yet assessed	Not yet assessed.
ISM-0836	Non-volatile electrically erasable programmable read-only memory media sanitisation: Non-volatile EEPROM media is sanitised by overwriting it at least once in its entirety with a random pattern followed by a read back for verification.	Not yet assessed	Not yet assessed.
ISM-0359	Non-volatile flash memory media sanitisation: Non-volatile flash memory media is sanitised by overwriting it at least twice in its entirety with a random pattern followed by a read back for verification.	Not yet assessed	Not yet assessed.
ISM-1735	Media that cannot be successfully sanitised: Media that cannot be successfully sanitised is destroyed prior to its disposal.	Not yet assessed	Not yet assessed.
ISM-0363	Media destruction processes and procedures: Media destruction processes, and supporting media destruction procedures, are developed, implemented and maintained.	Not yet assessed	Not yet assessed.
ISM-0350	Media that cannot be sanitised: The following media types are destroyed prior to their disposal: - microfiche and microfilm - optical discs - programmable read-only memory - read-only memory - other types of media that cannot be sanitised.	Not yet assessed	Not yet assessed.
ISM-1361	Media destruction equipment: Security Construction and Equipment Committee-approved equipment or ASIO-approved equipment is used when destroying media.	Not yet assessed	Not yet assessed.
ISM-1160	Media destruction equipment: If using degaussers to destroy media, degaussers evaluated by the United States’ National Security Agency are used.	Not yet assessed	Not yet assessed.
ISM-1517	Media destruction methods: Equipment that is capable of reducing microform to a fine powder, with resultant particles not showing more than five consecutive characters per particle upon microscopic inspection, is used to destroy microfiche and microfilm.	Not yet assessed	Not yet assessed.
ISM-1722	Media destruction methods: Electrostatic memory devices are destroyed using a furnace/incinerator, hammer mill, disintegrator or grinder/sander.	Not yet assessed	Not yet assessed.
ISM-1723	Media destruction methods: Magnetic floppy disks are destroyed using a furnace/incinerator, hammer mill, disintegrator, degausser or by cutting.	Not yet assessed	Not yet assessed.
ISM-1724	Media destruction methods: Magnetic hard disks are destroyed using a furnace/incinerator, hammer mill, disintegrator, grinder/sander or degausser.	Not yet assessed	Not yet assessed.
ISM-1725	Media destruction methods: Magnetic tapes are destroyed using a furnace/incinerator, hammer mill, disintegrator, degausser or by cutting.	Not yet assessed	Not yet assessed.
ISM-1726	Media destruction methods: Optical disks are destroyed using a furnace/incinerator, hammer mill, disintegrator, grinder/sander or by cutting.	Not yet assessed	Not yet assessed.
ISM-1727	Media destruction methods: Semiconductor memory is destroyed using a furnace/incinerator, hammer mill or disintegrator.	Not yet assessed	Not yet assessed.
ISM-0368	Media destruction methods: Media destroyed using a hammer mill, disintegrator, grinder/sander or by cutting results in media waste particles no larger than 9 mm.	Not yet assessed	Not yet assessed.
ISM-0361	Degaussing magnetic media: Magnetic media is destroyed using a degausser with a suitable magnetic field strength and magnetic orientation.	Not yet assessed	Not yet assessed.
ISM-0362	Degaussing magnetic media: Product-specific directions provided by degausser manufacturers are followed.	Not yet assessed	Not yet assessed.
ISM-1641	Degaussing magnetic media: Following the use of a degausser, magnetic media is physically damaged by deforming any internal platters.	Not yet assessed	Not yet assessed.
ISM-0370	Supervision of destruction: The destruction of media is performed under the supervision of at least one cleared person.	Not yet assessed	Not yet assessed.
ISM-0371	Supervision of destruction: Personnel supervising the destruction of media supervise its handling to the point of destruction and ensure that the destruction is completed successfully.	Not yet assessed	Not yet assessed.
ISM-0372	Supervision of accountable material destruction: The destruction of media storing accountable material is performed under the supervision of at least two cleared personnel.	Not yet assessed	Not yet assessed.
ISM-0373	Supervision of accountable material destruction: Personnel supervising the destruction of media storing accountable material supervise its handling to the point of destruction, ensure that the destruction is completed successfully and sign a destruction certificate afterwards.	Not yet assessed	Not yet assessed.
ISM-0374	Media disposal processes and procedures: Media disposal processes, and supporting media disposal procedures, are developed, implemented and maintained.	Not yet assessed	Not yet assessed.
ISM-0378	Disposal of media: Labels and markings indicating the owner, sensitivity, classification or any other marking that can associate media with its prior use are removed prior to its disposal.	Not yet assessed	Not yet assessed.
ISM-0375	Disposal of media: Following sanitisation, destruction or declassification, a formal administrative decision is made to release media, or its waste, into the public domain.	Not yet assessed	Not yet assessed.
ISM-1743	Operating system selection: Vendors that have demonstrated a commitment to Secure by Design and Secure by Default principles and practices, including secure programming practices and either memory-safe programming languages or less preferably memory-safe programming practices, are used for operating systems.	Not yet assessed	Not yet assessed.
ISM-1407	Operating system releases and versions: The latest release, or the previous release, of operating systems are used.	Not yet assessed	Not yet assessed.
ISM-1408	Operating system releases and versions: 64-bit versions of operating systems are used.	Not yet assessed	Not yet assessed.
ISM-1406	Standard operating environments: SOEs are used for workstations and servers.	Not yet assessed	Not yet assessed.
ISM-1608	Standard operating environments: SOEs provided by third parties are scanned for malicious code and configurations.	Not yet assessed	Not yet assessed.
ISM-1588	Standard operating environments: SOEs are reviewed and updated at least annually.	Not yet assessed	Not yet assessed.
ISM-1914	Hardening operating system configurations: Approved configurations for operating systems are developed, implemented and maintained.	Not yet assessed	Not yet assessed.
ISM-1409	Hardening operating system configurations: Operating systems are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.	Not yet assessed	Not yet assessed.
ISM-1601	Hardening operating system configurations: Microsoft’s attack surface reduction rules are implemented.	Not yet assessed	Not yet assessed.
ISM-0383	Hardening operating system configurations: Default user accounts or credentials for operating systems, including for any pre-configured user accounts, are changed, disabled or removed during initial setup.	Not yet assessed	Not yet assessed.
ISM-0380	Hardening operating system configurations: Unneeded user accounts, components, services and functionality of operating systems are disabled or removed.	Not yet assessed	Not yet assessed.
ISM-0341	Hardening operating system configurations: Automatic execution features for removable media are disabled.	Not yet assessed	Not yet assessed.
ISM-1654	Hardening operating system configurations: Internet Explorer 11 is disabled or removed.	Not yet assessed	Not yet assessed.
ISM-1655	Hardening operating system configurations: .NET Framework 3.5 (includes .NET 2.0 and 3.0) is disabled or removed.	Not yet assessed	Not yet assessed.
ISM-1492	Hardening operating system configurations: Operating system exploit protection functionality is enabled.	Not yet assessed	Not yet assessed.
ISM-1745	Hardening operating system configurations: Early Launch Antimalware, Secure Boot, Trusted Boot and Measured Boot functionality is enabled.	Not yet assessed	Not yet assessed.
ISM-2127	Hardening operating system configurations: Digital signature verification functionality for drivers is enforced before they are loaded.	Not yet assessed	Not yet assessed.
ISM-1896	Hardening operating system configurations: Memory integrity functionality is enabled.	Not yet assessed	Not yet assessed.
ISM-2128	Hardening operating system configurations: The ability to install, load or modify kernel-mode code, including drivers, kernel modules and extensions, is limited to privileged users who require such abilities as part of their duties or functions.	Not yet assessed	Not yet assessed.
ISM-1584	Hardening operating system configurations: Unprivileged users are prevented from bypassing, disabling or modifying security functionality of operating systems.	Not yet assessed	Not yet assessed.
ISM-1491	Hardening operating system configurations: Unprivileged human users are prevented from running script execution engines, including: - Windows Script Host (cscript.exe and wscript.exe) - PowerShell (powershell.exe, powershell_ise.exe and pwsh.exe) - Command Prompt (cmd.exe) - Windows Management Instrumentation (wmic.exe) - Microsoft Hypertext Markup Language (HTML) Application Host (mshta.exe).	Not yet assessed	Not yet assessed.
ISM-1592	Application management: Unprivileged human users do not have the ability to install unapproved applications.	Not yet assessed	Not yet assessed.
ISM-0382	Application management: Unprivileged human users do not have the ability to uninstall or disable approved applications.	Not yet assessed	Not yet assessed.
ISM-0843	Application control: Application control is implemented on workstations.	Not yet assessed	Not yet assessed.
ISM-1490	Application control: Application control is implemented on internet-facing servers.	Not yet assessed	Not yet assessed.
ISM-1656	Application control: Application control is implemented on non-internet-facing servers.	Not yet assessed	Not yet assessed.
ISM-1870	Application control: Application control is applied to user profiles and temporary folders used by operating systems, web browsers and email clients.	Not yet assessed	Not yet assessed.
ISM-1871	Application control: Application control is applied to all locations other than user profiles and temporary folders used by operating systems, web browsers and email clients.	Not yet assessed	Not yet assessed.
ISM-1657	Application control: Application control restricts the execution of executables, libraries, scripts, installers, compiled HTML, HTML applications and control panel applets to an organisation-approved set.	Not yet assessed	Not yet assessed.
ISM-1658	Application control: Application control restricts the execution of drivers to an organisation-approved set.	Not yet assessed	Not yet assessed.
ISM-0955	Application control: Application control is implemented using cryptographic hash rules, publisher certificate rules or path rules.	Not yet assessed	Not yet assessed.
ISM-1471	Application control: When implementing application control using publisher certificate rules, publisher names and product names are used.	Not yet assessed	Not yet assessed.
ISM-1392	Application control: When implementing application control using path rules, only approved users can modify approved files and write to approved folders.	Not yet assessed	Not yet assessed.
ISM-1746	Application control: When implementing application control using path rules, only approved users can change file system permissions for approved files and folders.	Not yet assessed	Not yet assessed.
ISM-1544	Application control: Microsoft’s recommended application blocklist is implemented.	Not yet assessed	Not yet assessed.
ISM-1659	Application control: Microsoft’s vulnerable driver blocklist is implemented.	Not yet assessed	Not yet assessed.
ISM-1582	Application control: Application control rulesets are validated at least annually.	Not yet assessed	Not yet assessed.
ISM-0846	Application control: Users cannot disable or bypass application control, and are not exempted from application control, except when using local administrator accounts or break glass accounts.	Not yet assessed	Not yet assessed.
ISM-1660	Application control: Allowed and blocked application control events are centrally logged.	Not yet assessed	Not yet assessed.
ISM-1889	Command Shell: Command line process creation events are centrally logged.	Not yet assessed	Not yet assessed.
ISM-1621	PowerShell: Windows PowerShell 2.0 is disabled or removed.	Not yet assessed	Not yet assessed.
ISM-1622	PowerShell: PowerShell is configured to use Constrained Language Mode.	Not yet assessed	Not yet assessed.
ISM-1623	PowerShell: PowerShell module logging, script block logging and transcription events are centrally logged.	Not yet assessed	Not yet assessed.
ISM-1624	PowerShell: PowerShell script block logs are protected by Protected Event Logging functionality.	Not yet assessed	Not yet assessed.
ISM-2129	Windows Management Instrumentation: WMI activity, including the creation of permanent event subscriptions, is centrally logged.	Not yet assessed	Not yet assessed.
ISM-1341	Host-based intrusion detection and response solution: A HIPS or EDR solution is implemented on workstations.	Not yet assessed	Not yet assessed.
ISM-1034	Host-based intrusion detection and response solution: A HIPS or EDR solution is implemented on critical servers and high-value servers.	Not yet assessed	Not yet assessed.
ISM-1416	Software firewall: A software firewall is implemented on workstations and servers to restrict inbound and outbound network connections to an organisation-approved set of applications and services.	Not yet assessed	Not yet assessed.
ISM-1417	Antivirus application: An antivirus application is implemented on workstations and servers with: - signature-based detection functionality enabled and set to a high level - heuristic-based detection functionality enabled and set to a high level - reputation rating functionality enabled - ransomware protection functionality enabled - detection signatures configured to update at least daily - regular scanning configured for all fixed disks and removable media.	Not yet assessed	Not yet assessed.
ISM-1418	Device access control: If there is no business requirement for reading from removable media and devices, such functionality is disabled via the use of a device access control application or by disabling external communication interfaces.	Not yet assessed	Not yet assessed.
ISM-0343	Device access control: If there is no business requirement for writing to removable media and devices, such functionality is disabled via the use of a device access control application or by disabling external communication interfaces.	Not yet assessed	Not yet assessed.
ISM-0345	Device access control: External communication interfaces that allow DMA are disabled.	Not yet assessed	Not yet assessed.
ISM-1976	Operating system event logging: Security-relevant events for Apple macOS operating systems are centrally logged.	Not yet assessed	Not yet assessed.
ISM-1977	Operating system event logging: Security-relevant events for Linux operating systems are centrally logged.	Not yet assessed	Not yet assessed.
ISM-0582	Operating system event logging: Security-relevant events for Microsoft Windows operating systems are centrally logged.	Not yet assessed	Not yet assessed.
ISM-0938	User application selection: Vendors that have demonstrated a commitment to Secure by Design and Secure by Default principles and practices, including secure programming practices and either memory-safe programming languages or less preferably memory-safe programming practices, are used for user applications.	Not yet assessed	Not yet assessed.
ISM-1467	User application releases: The latest release of email clients, office productivity suites, PDF applications, security products and web browsers, including their extensions, are used.	Not yet assessed	Not yet assessed.
ISM-1915	Hardening user application configurations: Approved configurations for user applications are developed, implemented and maintained.	Not yet assessed	Not yet assessed.
ISM-2110	Hardening user application configurations: User applications are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.	Not yet assessed	Not yet assessed.
ISM-1806	Hardening user application configurations: Default user accounts or credentials for user applications, including for any pre-configured user accounts, are changed, disabled or removed during initial setup.	Not yet assessed	Not yet assessed.
ISM-1470	Hardening user application configurations: Unneeded user accounts, components, services and functionality of user applications are disabled or removed.	Not yet assessed	Not yet assessed.
ISM-1235	Hardening user application configurations: Extensions for user applications are restricted to an organisation-approved set.	Not yet assessed	Not yet assessed.
ISM-2111	Hardening user application configurations: All temporary installation files created during user application installation processes are removed after user applications have been installed.	Not yet assessed	Not yet assessed.
ISM-2113	Artificial intelligence applications: AI applications are configured to require human approval before executing sensitive or high-impact actions.	Not yet assessed	Not yet assessed.
ISM-2114	Artificial intelligence applications: Baselines of expected behaviour and performance for AI applications are established and monitored for unexpected deviations.	Not yet assessed	Not yet assessed.
ISM-1748	Email clients: Email client security settings cannot be changed by human users.	Not yet assessed	Not yet assessed.
ISM-1859	Office productivity suites: Office productivity suites are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.	Not yet assessed	Not yet assessed.
ISM-1667	Office productivity suites: Microsoft Office is blocked from creating child processes.	Not yet assessed	Not yet assessed.
ISM-1668	Office productivity suites: Microsoft Office is blocked from creating executable content.	Not yet assessed	Not yet assessed.
ISM-1669	Office productivity suites: Microsoft Office is blocked from injecting code into other processes.	Not yet assessed	Not yet assessed.
ISM-1542	Office productivity suites: Microsoft Office is configured to prevent activation of Object Linking and Embedding packages.	Not yet assessed	Not yet assessed.
ISM-1823	Office productivity suites: Office productivity suite security settings cannot be changed by human users.	Not yet assessed	Not yet assessed.
ISM-1671	Office productivity suites: Microsoft Office macros are disabled for human users that do not have a demonstrated business requirement.	Not yet assessed	Not yet assessed.
ISM-1488	Office productivity suites: Microsoft Office macros in files originating from the internet are blocked.	Not yet assessed	Not yet assessed.
ISM-1672	Office productivity suites: Microsoft Office macro antivirus scanning is enabled.	Not yet assessed	Not yet assessed.
ISM-1673	Office productivity suites: Microsoft Office macros are blocked from making Win32 API calls.	Not yet assessed	Not yet assessed.
ISM-1674	Office productivity suites: Only Microsoft Office macros running from within a sandboxed environment, a Trusted Location or that are digitally signed by a trusted publisher are allowed to execute.	Not yet assessed	Not yet assessed.
ISM-1890	Office productivity suites: Microsoft Office macros are checked to ensure they are free of malicious code before being digitally signed or placed within Trusted Locations.	Not yet assessed	Not yet assessed.
ISM-1487	Office productivity suites: Only privileged human users responsible for checking that Microsoft Office macros are free of malicious code can write to and modify content within Trusted Locations.	Not yet assessed	Not yet assessed.
ISM-1675	Office productivity suites: Microsoft Office macros digitally signed by an untrusted publisher cannot be enabled via the Message Bar or Backstage View.	Not yet assessed	Not yet assessed.
ISM-1891	Office productivity suites: Microsoft Office macros digitally signed by signatures other than V3 signatures cannot be enabled via the Message Bar or Backstage View.	Not yet assessed	Not yet assessed.
ISM-1676	Office productivity suites: Microsoft Office’s list of trusted publishers is validated at least annually.	Not yet assessed	Not yet assessed.
ISM-1489	Office productivity suites: Microsoft Office macro security settings cannot be changed by human users.	Not yet assessed	Not yet assessed.
ISM-1670	Portable Document Format applications: PDF applications are blocked from creating child processes.	Not yet assessed	Not yet assessed.
ISM-1860	Portable Document Format applications: PDF applications are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.	Not yet assessed	Not yet assessed.
ISM-1824	Portable Document Format applications: PDF application security settings cannot be changed by human users.	Not yet assessed	Not yet assessed.
ISM-1825	Security products: Security product security settings cannot be changed by human users.	Not yet assessed	Not yet assessed.
ISM-1486	Web browsers: Web browsers do not process Java from the internet.	Not yet assessed	Not yet assessed.
ISM-1485	Web browsers: Web browsers do not process web advertisements from the internet.	Not yet assessed	Not yet assessed.
ISM-1412	Web browsers: Web browsers are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.	Not yet assessed	Not yet assessed.
ISM-1585	Web browsers: Web browser security settings cannot be changed by human users.	Not yet assessed	Not yet assessed.
ISM-1826	Server application selection: Vendors that have demonstrated a commitment to Secure by Design and Secure by Default principles and practices, including secure programming practices and either memory-safe programming languages or less preferably memory-safe programming practices, are used for server applications.	Not yet assessed	Not yet assessed.
ISM-1483	Server application releases: The latest release of internet-facing server applications is used.	Not yet assessed	Not yet assessed.
ISM-1916	Hardening server application configurations: Approved configurations for server applications are developed, implemented and maintained.	Not yet assessed	Not yet assessed.
ISM-1246	Hardening server application configurations: Server applications are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking precedence when conflicts occur.	Not yet assessed	Not yet assessed.
ISM-1260	Hardening server application configurations: Default user accounts or credentials for server applications, including for any pre-configured user accounts, are changed, disabled or removed during initial setup.	Not yet assessed	Not yet assessed.
ISM-1247	Hardening server application configurations: Unneeded user accounts, components, services and functionality of server applications are disabled or removed.	Not yet assessed	Not yet assessed.
ISM-2115	Hardening server application configurations: Extensions for server applications are restricted to an organisation-approved set.	Not yet assessed	Not yet assessed.
ISM-1245	Hardening server application configurations: All temporary installation files created during server application installation processes are removed after server applications have been installed.	Not yet assessed	Not yet assessed.
ISM-1249	Restricting privileges for server applications: Server applications are configured to run as a separate user account with the minimum privileges needed to perform their functions.	Not yet assessed	Not yet assessed.
ISM-1250	Restricting privileges for server applications: The user accounts under which server applications run have limited access to their underlying server’s file system.	Not yet assessed	Not yet assessed.
ISM-1926	Microsoft Active Directory services: Microsoft AD DS domain controllers, Microsoft AD CS servers, Microsoft AD FS servers and Microsoft Entra Connect servers are only used for their designed role and no other applications or services are installed, unless they are security related.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1927	Microsoft Active Directory services: Access to Microsoft AD DS domain controllers, Microsoft AD CS servers, Microsoft AD FS servers and Microsoft Entra Connect servers is limited to privileged users that require access.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1928	Microsoft Active Directory services: Backups of Microsoft AD DS domain controllers, Microsoft AD CS servers, Microsoft AD FS servers and Microsoft Entra Connect servers are encrypted using ASD-approved cryptography, stored securely and only accessible to backup administrator accounts.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1830	Microsoft Active Directory services: Security-relevant events for Microsoft AD DS domain controllers, Microsoft AD CS servers, Microsoft AD FS servers and Microsoft Entra Connect servers are centrally logged.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1827	Microsoft Active Directory Domain Services: Microsoft AD DS domain controllers are administered using dedicated domain administrator user accounts that are not used to administer other systems.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1929	Microsoft Active Directory Domain Services: Lightweight Directory Access Protocol signing is enabled on Microsoft AD DS domain controllers.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1828	Microsoft Active Directory Domain Services: The Print Spooler service is disabled on Microsoft AD DS domain controllers.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1829	Microsoft Active Directory Domain Services: Passwords are not stored in Group Policy Preferences.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1930	Microsoft Active Directory Domain Services: Passwords are prevented from being stored in Group Policy Preferences.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1931	Microsoft Active Directory Domain Services: SID Filtering is enabled for domain and forest trusts.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1832	Microsoft Active Directory Domain Services account hardening: Only service accounts and computer accounts are configured with Service Principal Names (SPNs).	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1932	Microsoft Active Directory Domain Services account hardening: The number of service accounts configured with an SPN is minimised.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1933	Microsoft Active Directory Domain Services account hardening: Service accounts configured with an SPN do not have DCSync permissions.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-2010	Microsoft Active Directory Domain Services account hardening: Service accounts configured with an SPN use the Advanced Encryption Standard for encryption.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1834	Microsoft Active Directory Domain Services account hardening: Duplicate SPNs do not exist within the domain.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1833	Microsoft Active Directory Domain Services account hardening: User accounts are provisioned with the minimum privileges required.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1934	Microsoft Active Directory Domain Services account hardening: User accounts with DCSync permissions are reviewed at least every six months, and those without an ongoing requirement for the permissions have them removed.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1835	Microsoft Active Directory Domain Services account hardening: Privileged user accounts are configured as sensitive and cannot be delegated.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1935	Microsoft Active Directory Domain Services account hardening: Computer accounts are not configured for unconstrained delegation.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1836	Microsoft Active Directory Domain Services account hardening: User accounts require Kerberos pre-authentication.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1838	Microsoft Active Directory Domain Services account hardening: The UserPassword attribute for user accounts is not used.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1936	Microsoft Active Directory Domain Services account hardening: The sIDHistory attribute for user accounts is not used.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1937	Microsoft Active Directory Domain Services account hardening: User accounts are checked at least weekly for the presence of the sIDHistory attribute.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1839	Microsoft Active Directory Domain Services account hardening: Account properties accessible by unprivileged users are not used to store passwords.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1840	Microsoft Active Directory Domain Services account hardening: User account passwords do not use reversible encryption.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1841	Microsoft Active Directory Domain Services account hardening: Unprivileged user accounts cannot add machines to the domain.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1842	Microsoft Active Directory Domain Services account hardening: Dedicated privileged service accounts are used to add machines to the domain.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1843	Microsoft Active Directory Domain Services account hardening: User accounts with unconstrained delegation are reviewed at least annually, and those without an SPN or demonstrated business requirement are removed.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1844	Microsoft Active Directory Domain Services account hardening: Computer accounts that are not Microsoft AD DS domain controllers are not trusted for delegation to services.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1938	Microsoft Active Directory Domain Services account hardening: The Domain Computers security group does not have write or modify permissions to any Microsoft Active Directory objects.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1620	Microsoft Active Directory Domain Services security group memberships: Privileged user accounts are members of the Protected Users security group.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1939	Microsoft Active Directory Domain Services security group memberships: The number of user accounts that are members of the Domain Admins, Enterprise Admins or other highly privileged security groups is minimised.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1940	Microsoft Active Directory Domain Services security group memberships: Service accounts are not members of the Domain Admins, Enterprise Admins or other highly privileged security groups.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1941	Microsoft Active Directory Domain Services security group memberships: Computer accounts are not members of the Domain Admins, Enterprise Admins or other highly privileged security groups.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1942	Microsoft Active Directory Domain Services security group memberships: The Domain Computers security group is not a member of any privileged or highly privileged security groups.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1845	Microsoft Active Directory Domain Services security group memberships: When a user account is disabled, it is removed from all security group memberships.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1846	Microsoft Active Directory Domain Services security group memberships: The Pre-Windows 2000 Compatible Access security group does not contain user accounts.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1943	Microsoft Active Directory Certificate Services: Strong mapping between certificates and users is enforced.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1944	Microsoft Active Directory Certificate Services: The EDITF_ATTRIBUTESUBJECTALTNAME2 flag is removed from Microsoft AD CS certification authority configurations.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1945	Microsoft Active Directory Certificate Services: The CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag is removed from certificate templates.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1946	Microsoft Active Directory Certificate Services: Unprivileged user accounts do not have write access to certificate templates.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1947	Microsoft Active Directory Certificate Services: Extended Key Usages that enable user authentication are removed.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1948	Microsoft Active Directory Certificate Services: Certificate manager approval is required for certificate templates that allow a Subject Alternative Name to be supplied.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-2130	Microsoft Active Directory Certificate Services: Web-based enrolment interfaces for Microsoft AD CS servers are disabled unless required, and where enabled, are configured to require HTTPS and Extended Protection for Authentication.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-2131	Microsoft Active Directory Certificate Services: Certificate templates are reviewed at least every three months to identify and remediate misconfigurations that could enable privilege escalation or unauthorised certificate enrolment.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-2132	Microsoft Active Directory Certificate Services: Certificate enrolment events, including successful and unsuccessful requests and changes to certificate templates or Microsoft AD CS configurations, are centrally logged.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1949	Microsoft Active Directory Federation Services: Microsoft AD FS servers are administered using a dedicated service account that is not used to administer other systems.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1950	Microsoft Entra Connect: Soft matching between Microsoft AD DS and Microsoft Entra ID is disabled following initial synchronisation activities.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1951	Microsoft Entra Connect: Hard match takeover is disabled for Microsoft Entra Connect servers.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1952	Microsoft Entra Connect: Privileged user accounts are not synchronised between Microsoft AD DS and Microsoft Entra ID.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1978	Server application event logging: Security-relevant events for server applications on internet-facing servers are centrally logged.	Not yet assessed	Not yet assessed.
ISM-1979	Server application event logging: Security-relevant events for server applications on non-internet-facing servers are centrally logged.	Not yet assessed	Not yet assessed.
ISM-1460	Functional separation between operating environments: When using a software-based isolation mechanism that consumes shared physical computing resources, the isolation mechanism is from a vendor that has demonstrated a commitment to Secure by Design and Secure by Default principles and practices, including secure programming practices and either memory-safe programming languages or less preferably memory-safe programming practices.	Not yet assessed	Not yet assessed.
ISM-1604	Functional separation between operating environments: When using a software-based isolation mechanism that consumes shared physical computing resources, the configuration of the isolation mechanism is hardened by removing unneeded functionality and restricting access to the administrative interface used to manage the isolation mechanism.	Not yet assessed	Not yet assessed.
ISM-1605	Functional separation between operating environments: When using a software-based isolation mechanism that consumes shared physical computing resources, the underlying operating system is hardened.	Not yet assessed	Not yet assessed.
ISM-1606	Functional separation between operating environments: When using a software-based isolation mechanism that consumes shared physical computing resources, patches, updates or vendor mitigations for vulnerabilities are applied to the isolation mechanism and underlying operating system in a timely manner.	Not yet assessed	Not yet assessed.
ISM-1848	Functional separation between operating environments: When using a software-based isolation mechanism that consumes shared physical computing resources, the isolation mechanism or underlying operating system is replaced when it is no longer supported by a vendor.	Not yet assessed	Not yet assessed.
ISM-1607	Functional separation between operating environments: When using a software-based isolation mechanism that consumes shared physical resources, integrity monitoring and centralised event logging is performed for the isolation mechanism and underlying operating system.	Not yet assessed	Not yet assessed.
ISM-1864	System usage policy: A system usage policy is developed, implemented and maintained.	Partial	Staff read Techly's policies when they join and confirm each year that they follow them, use their own named account with two-step sign-in wherever a system offers it, report anything that may be an incident straight away, and lose their access on the day they leave; a breach of the policies can lead to access being removed. Security training beyond the policies is not yet documented.
ISM-0432	System access requirements: Access requirements for systems and their resources are documented in their system security plan.	Not yet assessed	Not yet assessed.
ISM-0434	System access requirements: Personnel undergo appropriate employment screening and, where necessary, hold an appropriate security clearance before being granted access to systems and their resources.	Planned	Screening before someone joins, and the security terms of employment and confidentiality agreements, are not yet documented in a policy.
ISM-0435	System access requirements: Personnel receive any necessary briefings before being granted access to systems and their resources.	Not yet assessed	Not yet assessed.
ISM-1865	System access requirements: Personnel agree to abide by system usage policies before being granted access to systems and their resources.	Partial	Staff read Techly's policies when they join and confirm each year that they follow them, use their own named account with two-step sign-in wherever a system offers it, report anything that may be an incident straight away, and lose their access on the day they leave; a breach of the policies can lead to access being removed. Security training beyond the policies is not yet documented.
ISM-0408	System access requirements: Systems have a logon banner that reminds personnel of their security responsibilities when accessing the system and its resources.	Not yet assessed	Not yet assessed.
ISM-0414	User identification: Users granted access to systems and their resources are uniquely identifiable.	In place	Every change in a workspace is recorded in plain words, whoever made it: a person, an automation, the AI or Support. What people view is recorded too, and so are attempts the permission engine refuses. The trail is kept for 24 months: records are only ever added, never edited, and each is cryptographically linked to the one before it, so tampering would be evident. Integrations and automations act as service accounts, each holding roles like a person. An API key belongs to one service account, is stored only as a hash, can expire and can be revoked at any time, and what is done with it is recorded on the audit trail as that account.
ISM-0415	User identification: The use of shared user accounts is strictly controlled, and users of such accounts are uniquely identifiable.	Not yet assessed	Not yet assessed.
ISM-1583	User identification: Personnel who are contractors are identified as such.	Not yet assessed	Not yet assessed.
ISM-2133	Artificial intelligence agent identification: Each AI agent is assigned a unique identity that is distinct from the user accounts of personnel and the identities of other AI agents.	Not yet assessed	Not yet assessed.
ISM-0405	Unprivileged access to systems: Requests for unprivileged access to systems and their resources are validated when first requested.	In place	What a person can see and do comes from their roles and from what is shared with them, and access to a place flows down to everything beneath it. Every operation in Pyron has a permission of its own, the permission engine's default answer is no, and only a role that holds the permission can add people, change roles or change the workspace's settings.
ISM-1852	Unprivileged access to systems: Unprivileged access to systems and their resources is limited to only what is required for users to undertake their duties or functions.	In place	What a person can see and do comes from their roles and from what is shared with them, and access to a place flows down to everything beneath it. Every operation in Pyron has a permission of its own, the permission engine's default answer is no, and only a role that holds the permission can add people, change roles or change the workspace's settings.
ISM-1566	Unprivileged access to systems: Use of unprivileged access is centrally logged.	In place	Every change in a workspace is recorded in plain words, whoever made it: a person, an automation, the AI or Support. What people view is recorded too, and so are attempts the permission engine refuses. The trail is kept for 24 months: records are only ever added, never edited, and each is cryptographically linked to the one before it, so tampering would be evident.
ISM-1507	Privileged access to systems: Requests for privileged access to systems and their resources are validated when first requested.	In place	What a person can see and do comes from their roles and from what is shared with them, and access to a place flows down to everything beneath it. Every operation in Pyron has a permission of its own, the permission engine's default answer is no, and only a role that holds the permission can add people, change roles or change the workspace's settings.
ISM-1508	Privileged access to systems: Privileged access to systems and their resources is limited to only what is required for users to undertake their duties or functions.	Partial	What a person can see and do comes from their roles and from what is shared with them, and access to a place flows down to everything beneath it. Every operation in Pyron has a permission of its own, the permission engine's default answer is no, and only a role that holds the permission can add people, change roles or change the workspace's settings. Our engineers sign in to AWS through IAM Identity Center, in sessions that expire, and the production database accepts only short-lived sign-in tokens, never a stored password. Administrator access is standing rather than raised for each task.
ISM-1175	Privileged access to systems: Privileged user accounts (excluding those explicitly authorised to access online services) are prevented from accessing the internet, email and web services.	Not yet assessed	Not yet assessed.
ISM-1883	Privileged access to systems: Privileged user accounts explicitly authorised to access online services are strictly limited to only what is required for users to undertake their duties or functions.	Not yet assessed	Not yet assessed.
ISM-1649	Privileged access to systems: Just-in-time administration is used for the administration of systems and their resources.	Partial	Our engineers sign in to AWS through IAM Identity Center, in sessions that expire, and the production database accepts only short-lived sign-in tokens, never a stored password. Administrator access is standing rather than raised for each task.
ISM-0445	Privileged access to systems: Privileged human users are assigned a dedicated privileged user account to be used solely for duties requiring privileged access.	Not yet assessed	Not yet assessed.
ISM-1263	Privileged access to systems: Unique privileged user accounts are used for administering individual server applications.	Not yet assessed	Not yet assessed.
ISM-1509	Privileged access to systems: Privileged access events are centrally logged.	In place	Every change in a workspace is recorded in plain words, whoever made it: a person, an automation, the AI or Support. What people view is recorded too, and so are attempts the permission engine refuses. The trail is kept for 24 months: records are only ever added, never edited, and each is cryptographically linked to the one before it, so tampering would be evident. Activity on our AWS accounts is recorded by AWS CloudTrail into a separate archive account, where it is locked for 12 months.
ISM-1650	Privileged access to systems: Privileged user account and security group management events are centrally logged.	In place	Every change in a workspace is recorded in plain words, whoever made it: a person, an automation, the AI or Support. What people view is recorded too, and so are attempts the permission engine refuses. The trail is kept for 24 months: records are only ever added, never edited, and each is cryptographically linked to the one before it, so tampering would be evident. Activity on our AWS accounts is recorded by AWS CloudTrail into a separate archive account, where it is locked for 12 months.
ISM-0407	Recording authorisation for personnel to access systems: A secure record is maintained for the life of systems and their resources that covers the following for each human user: - their unique identifier - their signed agreement to abide by system usage policies - who authorised their access - when their access was granted - the level of access they were granted - when their access, and their level of access, was last reviewed - when their level of access was changed, and to what extent (if applicable) - when their access was withdrawn (if applicable).	Partial	Every change in a workspace is recorded in plain words, whoever made it: a person, an automation, the AI or Support. What people view is recorded too, and so are attempts the permission engine refuses. The trail is kept for 24 months: records are only ever added, never edited, and each is cryptographically linked to the one before it, so tampering would be evident. Pyron records who gave each role and when, and every change to it; it does not record a signed agreement to the usage policy or a review of the access.
ISM-2134	Artificial intelligence agent register: An AI agent register is developed, implemented, maintained and regularly verified.	Not yet assessed	Not yet assessed.
ISM-2135	Artificial intelligence agent register: An AI agent register contains the following for each AI agent: - its unique identifier - its owner and business purpose - the identities assigned to it - any user accounts and credentials it uses - the tools, permissions and data repositories it can access.	Not yet assessed	Not yet assessed.
ISM-0430	Suspension of access to systems: Access to systems and their resources are removed or suspended the same day users no longer have a legitimate requirement for access.	Partial	A workspace admin can suspend a person, which refuses every request they make from that moment, or remove them. There is no automatic deprovisioning from an identity provider (SCIM): when someone leaves, an admin suspends or removes them in Pyron. Staff read Techly's policies when they join and confirm each year that they follow them, use their own named account with two-step sign-in wherever a system offers it, report anything that may be an incident straight away, and lose their access on the day they leave; a breach of the policies can lead to access being removed. Security training beyond the policies is not yet documented.
ISM-1591	Suspension of access to systems: Access to systems and their resources are removed or suspended as soon as practicable when users are detected undertaking malicious activities.	In place	A workspace admin can suspend a person, which refuses every request they make from that moment, or remove them. There is no automatic deprovisioning from an identity provider (SCIM): when someone leaves, an admin suspends or removes them in Pyron. A person can sign out every other device at once, and a workspace admin can sign everyone out; either stops the access tokens already issued, not only the sessions. Resetting a password does not by itself sign out a person's other sessions.
ISM-1404	Suspension of access to systems: Unprivileged access to systems and their resources are disabled after 45 days of inactivity.	Planned	An account is not disabled automatically after a period without use.
ISM-1648	Suspension of access to systems: Privileged access to systems and their resources are disabled after 45 days of inactivity.	Planned	An account is not disabled automatically after a period without use.
ISM-1647	Suspension of access to systems: Privileged access to systems and their resources are disabled after 12 months unless revalidated.	Partial	The Access Control Policy has the Technical Director review, every quarter, who holds access to each of Techly's systems and that two-step sign-in is on for every account, and record the review. The policy took effect on 25 October 2026.
ISM-0441	Temporary access to systems: When personnel are granted temporary access to systems and their resources, effective security controls are put in place to restrict their access to only data required for them to undertake their duties or functions.	Not yet assessed	Not yet assessed.
ISM-1610	Emergency access to systems: A method of emergency access to systems and their resources is documented and tested at least once when initially implemented and each time fundamental information technology infrastructure changes occur.	Not yet assessed	Not yet assessed.
ISM-1611	Emergency access to systems: Break glass accounts are only used when normal authentication processes cannot be used.	Not yet assessed	Not yet assessed.
ISM-1612	Emergency access to systems: Break glass accounts are only used for specific authorised activities.	Not yet assessed	Not yet assessed.
ISM-1614	Emergency access to systems: Break glass account credentials are changed by the account custodian after they are accessed by any other party.	Not yet assessed	Not yet assessed.
ISM-1615	Emergency access to systems: Break glass accounts are tested after credentials are changed.	Not yet assessed	Not yet assessed.
ISM-1613	Emergency access to systems: Use of break glass accounts is centrally logged.	In place	Emergency access to our AWS accounts is a separate permission set, and each use of it, like any sign-in as an account's root user, pages our on-call engineer. Activity on our AWS accounts is recorded by AWS CloudTrail into a separate archive account, where it is locked for 12 months.
ISM-1546	Authenticating to systems: Users are authenticated before they are granted access to a system and its resources.	In place	People sign in with a password and two-step sign-in, or through SAML or OpenID Connect single sign-on; integrations use API keys over HTTPS. No legacy protocol is offered.
ISM-2136	Authenticating to systems: Risk-based access decisions, informed by contextual signals, are enforced for access to systems and their resources.	Not yet assessed	Not yet assessed.
ISM-1603	Insecure authentication methods: Authentication methods susceptible to replay attacks are disabled.	Not yet assessed	Not yet assessed.
ISM-1055	Insecure authentication methods: LAN Manager and NT LAN Manager authentication methods are disabled.	Not applicable	Pyron uses no LAN Manager or NT LAN Manager authentication.
ISM-2076	Insecure authentication methods: Security questions are not used for authentication purposes.	Not yet assessed	Not yet assessed.
ISM-2077	Insecure authentication methods: Email is not used for out-of-band authentication purposes.	Partial	Two-step sign-in works with a passkey, an authenticator app or a code sent by email. A workspace admin can make it required for everyone or for chosen roles, and can switch off authenticator apps and emailed codes so that only passkeys, which resist phishing, are accepted. Codes sent by email are offered for two-step sign-in unless a workspace admin switches them off.
ISM-1504	Multi-factor authentication: Multi-factor authentication is used to authenticate human users to their organisation’s online services that process, store or communicate their organisation’s sensitive data.	Partial	Techly's support engineers can sign in to any workspace to help, only through Techly's Google Workspace, which enforces 2-step verification, and a Support session lasts at most 8 hours and cannot be extended. What Support views and changes is recorded on the workspace's audit trail. A workspace cannot yet switch this access off. Pyron's source code is held in a private GitHub repository. Our GitHub organisation requires two-factor authentication, and secrets are kept out of the code. Two-step sign-in is not yet confirmed for every service our staff sign in to, our AWS accounts among them.
ISM-1679	Multi-factor authentication: Multi-factor authentication is used to authenticate human users to third-party online services that process, store or communicate their organisation’s sensitive data.	Not yet assessed	Not yet assessed.
ISM-1680	Multi-factor authentication: Multi-factor authentication (where available) is used to authenticate human users to third-party online services that process, store or communicate their organisation’s non-sensitive data.	Not yet assessed	Not yet assessed.
ISM-1892	Multi-factor authentication: Multi-factor authentication is used to authenticate human users to their organisation’s online customer services that process, store or communicate their organisation’s sensitive customer data.	Not yet assessed	Not yet assessed.
ISM-1893	Multi-factor authentication: Multi-factor authentication is used to authenticate human users to third-party online customer services that process, store or communicate their organisation’s sensitive customer data.	Not yet assessed	Not yet assessed.
ISM-1681	Multi-factor authentication: Multi-factor authentication is used to authenticate customers to online customer services that process, store or communicate sensitive customer data.	Partial	Two-step sign-in works with a passkey, an authenticator app or a code sent by email. A workspace admin can make it required for everyone or for chosen roles, and can switch off authenticator apps and emailed codes so that only passkeys, which resist phishing, are accepted. Two-step sign-in is optional until a workspace admin makes it required.
ISM-1919	Multi-factor authentication: When multi-factor authentication is used to authenticate human users or customers to online services or online customer services, all other authentication protocols that do not support multi-factor authentication are disabled.	Not yet assessed	Not yet assessed.
ISM-1173	Multi-factor authentication: Multi-factor authentication is used to authenticate privileged human users of systems.	Not yet assessed	Not yet assessed.
ISM-0974	Multi-factor authentication: Multi-factor authentication is used to authenticate unprivileged human users of systems.	Not yet assessed	Not yet assessed.
ISM-1505	Multi-factor authentication: Multi-factor authentication is used to authenticate human users of data repositories.	Not yet assessed	Not yet assessed.
ISM-1401	Multi-factor authentication: Multi-factor authentication uses either: something people have and something people know, or something people have that is unlocked by something people know or are.	Not yet assessed	Not yet assessed.
ISM-1872	Multi-factor authentication: Multi-factor authentication used for authenticating human users of online services is phishing-resistant.	Not yet assessed	Not yet assessed.
ISM-1873	Multi-factor authentication: Multi-factor authentication used for authenticating customers of online customer services provides a phishing-resistant option.	In place	Two-step sign-in works with a passkey, an authenticator app or a code sent by email. A workspace admin can make it required for everyone or for chosen roles, and can switch off authenticator apps and emailed codes so that only passkeys, which resist phishing, are accepted.
ISM-1874	Multi-factor authentication: Multi-factor authentication used for authenticating customers of online customer services is phishing-resistant.	Partial	Two-step sign-in works with a passkey, an authenticator app or a code sent by email. A workspace admin can make it required for everyone or for chosen roles, and can switch off authenticator apps and emailed codes so that only passkeys, which resist phishing, are accepted. Two-step sign-in resists phishing only where a workspace admin allows passkeys alone.
ISM-1682	Multi-factor authentication: Multi-factor authentication used for authenticating human users of systems is phishing-resistant.	Not yet assessed	Not yet assessed.
ISM-1894	Multi-factor authentication: Multi-factor authentication used for authenticating human users of data repositories is phishing-resistant.	Not yet assessed	Not yet assessed.
ISM-2011	Multi-factor authentication: When phishing-resistant multi-factor authentication is used by human users, other non-phishing-resistant multi-factor authentication options are disabled for their user accounts.	Not yet assessed	Not yet assessed.
ISM-1920	Multi-factor authentication: When multi-factor authentication is used to authenticate human users to online services, online customer services, systems or data repositories – that process, store or communicate their organisation’s sensitive data or sensitive customer data – human users are prevented from self-enrolling into multi-factor authentication from untrustworthy devices.	Not yet assessed	Not yet assessed.
ISM-1683	Multi-factor authentication: Successful and unsuccessful multi-factor authentication events are centrally logged.	Not yet assessed	Not yet assessed.
ISM-0417	Single-factor authentication: When systems cannot support multi-factor authentication, single-factor authentication using passwords is implemented instead.	Not yet assessed	Not yet assessed.
ISM-1895	Single-factor authentication: Successful and unsuccessful single-factor authentication events are centrally logged.	In place	Every change in a workspace is recorded in plain words, whoever made it: a person, an automation, the AI or Support. What people view is recorded too, and so are attempts the permission engine refuses. The trail is kept for 24 months: records are only ever added, never edited, and each is cryptographically linked to the one before it, so tampering would be evident.
ISM-1403	User account lockouts: User accounts, except for break glass accounts, are protected by fixed or risk-based lockout mechanisms aligned to a maximum of five failed logon attempts, with either indefinite or automated lockout durations.	Planned	An account is not locked after failed sign-in attempts. Sign-in attempts are rate-limited at our network edge.
ISM-0428	Session locking: Services are configured with a session lock that: - activates after a maximum of 15 minutes of human user inactivity, a maximum of 12 hours of overall session time or when manually activated - blocks access to all session content - requires re-authentication by human users using all authentication factors to unlock the session - denies human users the ability to disable the session locking mechanism.	Partial	A workspace admin chooses how long a person stays signed in (1, 7 or 30 days) and whether an idle session signs out (after 30 minutes, 2 hours or 8 hours). The shortest idle sign-out a workspace can choose is 30 minutes, and the shortest session a day.
ISM-2012	Screen locking: Systems are configured with a screen lock that: - activates after a maximum of 15 minutes of human user inactivity, or when manually activated - conceals all content on the screen - ensures that the screen does not enter a power saving state before the screen lock is activated - requires re-authentication by human users using all authentication factors to unlock the system - denies human users the ability to disable the screen locking mechanism.	Partial	A device used for Techly work must have its disk encrypted, a screen lock that engages within a few minutes, and a supported operating system kept up to date (Acceptable Use Policy). Each person confirms this when they join and every year; nothing enforces it centrally.
ISM-0853	Session termination: Interactive user sessions are terminated and workstations are restarted at least daily.	Not yet assessed	Not yet assessed.
ISM-2137	Third-party application access and device code authentication: Human users are prevented from granting consent to third-party OAuth applications, with such consent granted only by an authorised administrator.	Not yet assessed	Not yet assessed.
ISM-2138	Third-party application access and device code authentication: OAuth application consents, including their granted permissions, are reviewed at least every six months, with unused applications and excessive permissions revoked.	Not yet assessed	Not yet assessed.
ISM-2139	Third-party application access and device code authentication: Consent grants, token issuance and token use for third-party OAuth applications are centrally logged.	Not yet assessed	Not yet assessed.
ISM-2140	Third-party application access and device code authentication: The OAuth device code authentication flow is disabled unless required, and where required, is restricted to authorised user accounts and managed devices.	Not yet assessed	Not yet assessed.
ISM-1559	Password strength: Passwords used for multi-factor authentication on non-classified, OFFICIAL: Sensitive and PROTECTED systems are a minimum of 6 characters.	Not yet assessed	Not yet assessed.
ISM-0421	Password strength: Passwords used for single-factor authentication on non-classified, OFFICIAL: Sensitive and PROTECTED systems are a minimum of 15 characters.	Not yet assessed	Not yet assessed.
ISM-1558	Password strength: Passwords using a sequence of words for single-factor authentication are not constructed using: - a list of categorised words - a real sentence in a natural language - song lyrics, movie or television show quotes, literature, or any other publicly available material - less than 4 random words for non-classified, OFFICIAL: Sensitive and PROTECTED systems; 5 random words for SECRET systems; or 6 random words for TOP SECRET systems.	Not yet assessed	Not yet assessed.
ISM-2078	Password strength: Passwords appearing in lists of commonly used passwords or lists of compromised passwords are not used.	In place	A password must meet a minimum length and is refused when it is common, entirely numeric or too like the person's own details, and it is stored only as a salted hash.
ISM-2079	Password strength: Maximum length limits for passwords are not less than 64 characters.	Not yet assessed	Not yet assessed.
ISM-2080	Password strength: Password complexity requirements are not imposed for passwords.	Not yet assessed	Not yet assessed.
ISM-2081	Password strength: All ASCII printable characters are supported for passwords.	Not yet assessed	Not yet assessed.
ISM-1593	Setting credentials for user accounts: Human users provide sufficient evidence to verify their identity when first requesting credentials, when requesting the reset of any credentials, when requesting the temporary disabling of any credentials, and when requesting the enrolment or re-enrolment of any credentials.	Not yet assessed	Not yet assessed.
ISM-1227	Setting credentials for user accounts: Credentials set for user accounts are randomly generated.	Not yet assessed	Not yet assessed.
ISM-1594	Setting credentials for user accounts: Credentials for human users are provided via a secure communications channel or, if not possible, split into two parts with one part provided to the human user and the other part provided to their supervisor.	Not yet assessed	Not yet assessed.
ISM-1595	Setting credentials for user accounts: Credentials provided to human users are changed on first use.	Not yet assessed	Not yet assessed.
ISM-1596	Setting credentials for user accounts: Credentials are not reused by users across different systems.	Not yet assessed	Not yet assessed.
ISM-1953	Setting credentials for built-in Administrator accounts, break glass accounts, local administrator accounts and service accounts: Credentials for the built-in Administrator account in each domain are long, unique, unpredictable and managed.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1685	Setting credentials for built-in Administrator accounts, break glass accounts, local administrator accounts and service accounts: Credentials for break glass accounts, local administrator accounts and service accounts are long, unique, unpredictable and managed.	Not yet assessed	Not yet assessed.
ISM-1795	Setting credentials for built-in Administrator accounts, break glass accounts, local administrator accounts and service accounts: Credentials for built-in Administrator accounts, break glass accounts, local administrator accounts and service accounts are a minimum of 30 characters.	Not yet assessed	Not yet assessed.
ISM-1954	Setting credentials for built-in Administrator accounts, break glass accounts, local administrator accounts and service accounts: Credentials for built-in Administrator accounts, break glass accounts, local administrator accounts and service accounts are randomly generated.	Not yet assessed	Not yet assessed.
ISM-1619	Setting credentials for built-in Administrator accounts, break glass accounts, local administrator accounts and service accounts: Service accounts are created as group Managed Service Accounts.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-2141	Application and workload credentials: Applications and workloads use short-lived dynamically issued credentials in preference to long-lived static credentials.	In place	Our services reach AWS through roles bound to each workload, and our build pipelines through short-lived OpenID Connect credentials, never through stored access keys.
ISM-2142	Application and workload credentials: Static credentials used by applications and workloads are centrally managed using a credential or secrets management solution.	In place	Logins a workspace keeps in the Pyron Vault are stored encrypted, apart from the database. A hidden value is never shown to the AI, which reads only a hint of what it is for, and a value is only ever sent to the web addresses its login allows. Our services reach AWS through roles bound to each workload, and our build pipelines through short-lived OpenID Connect credentials, never through stored access keys.
ISM-2143	Application and workload credentials: Applications and workloads use unique credentials that are not shared with other applications or workloads, or across development, testing, staging and production environments.	Not yet assessed	Not yet assessed.
ISM-1590	Changing credentials: Credentials for user accounts are changed if: - they are compromised or suspected of being compromised - they are discovered stored on systems in the clear - they are discovered being transferred across networks in the clear - membership of a shared user account changes.	Not yet assessed	Not yet assessed.
ISM-2144	Changing credentials: Static credentials used by applications and workloads are changed if: - they are compromised or suspected of being compromised - they are discovered stored on systems in the clear - they are discovered being transferred across networks in the clear.	Not yet assessed	Not yet assessed.
ISM-1955	Changing credentials: Credentials for computer accounts are changed if they are compromised, they are suspected of being compromised or they have not been changed in the past 30 days.	Not yet assessed	Not yet assessed.
ISM-1847	Changing credentials: Credentials for the Kerberos Key Distribution Center’s service account (KRBTGT) are changed twice, allowing for replication to all Microsoft AD DS domain controllers in-between each change, if the domain has been directly compromised, the domain is suspected of being compromised or they have not been changed in the past six months.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1956	Changing credentials: Microsoft AD FS token-signing and encryption certificates are changed twice in quick succession if they are compromised, they are suspected of being compromised or they have not been changed in the past 12 months.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-2145	Revoking credentials: Credentials for user accounts are revoked when they are no longer required.	In place	A workspace admin can suspend a person, which refuses every request they make from that moment, or remove them. There is no automatic deprovisioning from an identity provider (SCIM): when someone leaves, an admin suspends or removes them in Pyron.
ISM-2146	Revoking credentials: Static credentials used by applications and workloads are revoked when they are no longer required.	In place	Integrations and automations act as service accounts, each holding roles like a person. An API key belongs to one service account, is stored only as a hash, can expire and can be revoked at any time, and what is done with it is recorded on the audit trail as that account.
ISM-1597	Protecting credentials: Credentials are obscured as they are entered into systems.	Not yet assessed	Not yet assessed.
ISM-1980	Protecting credentials: Credential hint functionality is not used for systems.	Not yet assessed	Not yet assessed.
ISM-0418	Protecting credentials: Physical credentials are kept separate from systems they are used to authenticate to, except for when performing authentication activities.	Not yet assessed	Not yet assessed.
ISM-1402	Protecting credentials: Credentials stored on systems are protected by a password manager; a hardware security module; or by salting, hashing and stretching them before storage within a database.	In place	A password must meet a minimum length and is refused when it is common, entirely numeric or too like the person's own details, and it is stored only as a salted hash. Integrations and automations act as service accounts, each holding roles like a person. An API key belongs to one service account, is stored only as a hash, can expire and can be revoked at any time, and what is done with it is recorded on the audit trail as that account.
ISM-1957	Protecting credentials: Private keys for Microsoft AD CS certification authority servers are protected by a hardware security module.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1861	Protecting credentials: Local Security Authority protection functionality is enabled.	Not yet assessed	Not yet assessed.
ISM-1686	Protecting credentials: Credential Guard functionality is enabled.	Not yet assessed	Not yet assessed.
ISM-1897	Protecting credentials: Remote Credential Guard functionality is enabled.	Not yet assessed	Not yet assessed.
ISM-1749	Protecting credentials: Cached credentials are limited to one previous logon.	Not yet assessed	Not yet assessed.
ISM-1875	Protecting credentials: Systems are scanned at least monthly to identify any credentials that are being stored in the clear.	Partial	Our code is scanned for secrets on every change, and GitHub refuses a push that contains one. The scanning covers our code, not the systems it runs on.
ISM-2147	Protecting authentication artefacts: Authentication tokens, session cookies and refresh tokens are cryptographically bound to the device on which they were issued.	Not yet assessed	Not yet assessed.
ISM-2148	Protecting authentication artefacts: Active sessions, refresh tokens and other authentication artefacts are revoked when credentials are reset or re-enrolled, when credentials are compromised or suspected of being compromised, when a device no longer meets compliance requirements, or when high-risk sign-in activity is detected.	In place	A person can sign out every other device at once, and a workspace admin can sign everyone out; either stops the access tokens already issued, not only the sessions. Resetting a password does not by itself sign out a person's other sessions.
ISM-0042	System administration processes and procedures: System administration processes, and supporting system administration procedures, are developed, implemented and maintained.	In place	Each operational alert has a written runbook saying what it means, what to check first and how to fix it, and how Pyron is provisioned, released and operated is written down beside its code.
ISM-1211	System administration processes and procedures: System administration activities are performed in accordance with the system’s change and configuration management plan.	In place	The Change Management Policy sets out how every change to Pyron is made, checked, released and recorded, including emergency changes, and it is reviewed every year. Our cloud accounts, network edge and source control are defined in code, changed through pull requests, and scanned for insecure settings (Checkov) on every change.
ISM-1898	Separate privileged operating environments: Secure Admin Workstations are used in the performance of administrative activities.	Not yet assessed	Not yet assessed.
ISM-1380	Separate privileged operating environments: Privileged human users use separate privileged and unprivileged operating environments.	Not yet assessed	Not yet assessed.
ISM-1687	Separate privileged operating environments: Privileged operating environments are not virtualised within unprivileged operating environments.	Not yet assessed	Not yet assessed.
ISM-1688	Separate privileged operating environments: Unprivileged user accounts cannot be used to log on to privileged operating environments.	Not yet assessed	Not yet assessed.
ISM-1689	Separate privileged operating environments: Privileged user accounts (excluding local administrator accounts) cannot be used to log on to unprivileged operating environments.	Not yet assessed	Not yet assessed.
ISM-1958	Separate privileged operating environments: User accounts with DCSync permissions cannot be used to log on to unprivileged operating environments.	Not applicable	Pyron runs no Microsoft Active Directory services.
ISM-1385	Administrative infrastructure: Administrative infrastructure is segregated from the wider network and the internet.	Not yet assessed	Not yet assessed.
ISM-1750	Administrative infrastructure: Administrative infrastructure for critical servers, high-value servers and regular servers is segregated from each other.	Not yet assessed	Not yet assessed.
ISM-1386	Administrative infrastructure: Network management traffic can only originate from administrative infrastructure.	Not yet assessed	Not yet assessed.
ISM-1387	Administrative infrastructure: Administrative activities are conducted through jump servers.	Not yet assessed	Not yet assessed.
ISM-1899	Administrative infrastructure: Network devices that do not belong to administrative infrastructure cannot initiate connections with administrative infrastructure.	Not yet assessed	Not yet assessed.
ISM-2149	Administrative tools: A list of authorised RMM tools and remote access tools is developed, enforced and maintained.	Not yet assessed	Not yet assessed.
ISM-2150	Administrative tools: Network connections for unauthorised RMM tools and remote access tools are blocked at gateways.	Not yet assessed	Not yet assessed.
ISM-1493	Software registers: Software registers for workstations, servers, network devices and networked IT equipment are developed, implemented, maintained and regularly verified.	Partial	Locked dependency files list every library Pyron is built from, at its exact version. No formal software bill of materials is produced from them. This covers the software Pyron is built from, not the devices staff use.
ISM-1643	Software registers: Software registers contain versions and patch histories of applications, drivers, operating systems and firmware.	Not yet assessed	Not yet assessed.
ISM-1143	Patch management processes and procedures: Patch management processes, and supporting patch management procedures, are developed, implemented and maintained.	In place	Every dependency is scanned for known vulnerabilities on each change and every day. A change that adds a high or critical advisory is blocked, and an accepted finding is recorded with its reason and an expiry, so it is looked at again. Our servers run on an image AWS manages (EKS Auto Mode), and each is replaced at least every 7 days with AWS's current image, so operating system updates arrive without waiting on anyone. The Vulnerability Management Policy sets how fast a finding is fixed or accepted with a reason: a critical one within 7 days, a high one within 30, and others at the component's next update. One that is being exploited, or that exposes customer data, is an incident, handled at once.
ISM-0298	Patch management processes and procedures: A centralised and managed approach that maintains the integrity of patches or updates, and confirms that they have been applied successfully, is used to patch or update applications, operating systems, drivers and firmware.	In place	Our servers run on an image AWS manages (EKS Auto Mode), and each is replaced at least every 7 days with AWS's current image, so operating system updates arrive without waiting on anyone. Container images are built by our pipeline from base images pinned to an exact digest, with dependencies installed from lockfiles that pin each one's version and hash, scanned when they are pushed, and stored under tags that cannot be overwritten.
ISM-1876	Mitigating known vulnerabilities: Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.	Not yet assessed	Not yet assessed.
ISM-1690	Mitigating known vulnerabilities: Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.	Not yet assessed	Not yet assessed.
ISM-1691	Mitigating known vulnerabilities: Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release.	Not yet assessed	Not yet assessed.
ISM-1692	Mitigating known vulnerabilities: Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.	Not yet assessed	Not yet assessed.
ISM-1901	Mitigating known vulnerabilities: Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.	Not yet assessed	Not yet assessed.
ISM-1693	Mitigating known vulnerabilities: Patches, updates or other vendor mitigations for vulnerabilities in applications other than office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within one month of release.	Not yet assessed	Not yet assessed.
ISM-1877	Mitigating known vulnerabilities: Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.	Not yet assessed	Not yet assessed.
ISM-1694	Mitigating known vulnerabilities: Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.	Not yet assessed	Not yet assessed.
ISM-1695	Mitigating known vulnerabilities: Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release.	Not yet assessed	Not yet assessed.
ISM-1696	Mitigating known vulnerabilities: Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.	Not yet assessed	Not yet assessed.
ISM-1902	Mitigating known vulnerabilities: Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.	Not yet assessed	Not yet assessed.
ISM-1878	Mitigating known vulnerabilities: Patches, updates or other vendor mitigations for vulnerabilities in operating systems of IT equipment other than workstations, servers and network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.	Not yet assessed	Not yet assessed.
ISM-1751	Mitigating known vulnerabilities: Patches, updates or other vendor mitigations for vulnerabilities in operating systems of IT equipment other than workstations, servers and network devices are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.	Not yet assessed	Not yet assessed.
ISM-1879	Mitigating known vulnerabilities: Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.	Not yet assessed	Not yet assessed.
ISM-1697	Mitigating known vulnerabilities: Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.	Not yet assessed	Not yet assessed.
ISM-1903	Mitigating known vulnerabilities: Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.	Not yet assessed	Not yet assessed.
ISM-1904	Mitigating known vulnerabilities: Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.	Not yet assessed	Not yet assessed.
ISM-1905	Cessation of support: Online services that are no longer supported by vendors are removed.	Not yet assessed	Not yet assessed.
ISM-1704	Cessation of support: Office productivity suites, web browsers and their extensions, email clients, PDF applications, Adobe Flash Player, and security products that are no longer supported by vendors are removed.	Not yet assessed	Not yet assessed.
ISM-0304	Cessation of support: Applications other than office productivity suites, web browsers and their extensions, email clients, PDF applications, Adobe Flash Player, and security products that are no longer supported by vendors are removed.	Not yet assessed	Not yet assessed.
ISM-1501	Cessation of support: Operating systems that are no longer supported by vendors are replaced.	In place	Our servers run on an image AWS manages (EKS Auto Mode), and each is replaced at least every 7 days with AWS's current image, so operating system updates arrive without waiting on anyone.
ISM-1753	Cessation of support: Internet-facing network devices that are no longer supported by vendors are replaced.	Not yet assessed	Not yet assessed.
ISM-1981	Cessation of support: Non-internet-facing network devices that are no longer supported by vendors are replaced.	Not yet assessed	Not yet assessed.
ISM-1982	Cessation of support: Networked IT equipment that is no longer supported by vendors is replaced.	Not yet assessed	Not yet assessed.
ISM-1809	Cessation of support: When applications, operating systems, network devices or networked IT equipment that are no longer supported by vendors cannot be immediately removed or replaced, compensating security controls are implemented until such time that they can be removed or replaced.	Not yet assessed	Not yet assessed.
ISM-1510	Digital preservation policy: A digital preservation policy is developed, implemented and maintained.	Not yet assessed	Not yet assessed.
ISM-1547	Data backup and restoration processes and procedures: Data backup processes, and supporting data backup procedures, are developed, implemented and maintained.	In place	The database is backed up continuously and can be restored to any moment in the last 35 days. It is protected from deletion, a final snapshot is taken if it is ever deleted, and an earlier version of a replaced or deleted file is kept for 30 days.
ISM-1548	Data backup and restoration processes and procedures: Data restoration processes, and supporting data restoration procedures, are developed, implemented and maintained.	Planned	A full restore from backup has not yet been tested. The Business Continuity Policy schedules one every quarter.
ISM-1511	Performing and retaining backups: Backups of data, applications and settings are performed and retained in accordance with business criticality and business continuity requirements.	Partial	The database is backed up continuously and can be restored to any moment in the last 35 days. It is protected from deletion, a final snapshot is taken if it is ever deleted, and an earlier version of a replaced or deleted file is kept for 30 days. The Business Continuity Policy sets out what is backed up, how a failure is handled and who leads recovery, with a recovery point of about five minutes and a restore test every quarter. The recovery time is unknown until the first restore test, which has not yet run, and the plan has not been exercised.
ISM-1810	Performing and retaining backups: Backups of data, applications and settings are synchronised to enable restoration to a common point in time.	Partial	The database is backed up continuously and can be restored to any moment in the last 35 days. It is protected from deletion, a final snapshot is taken if it is ever deleted, and an earlier version of a replaced or deleted file is kept for 30 days. Files keep their earlier versions, but are not restored to the same point in time as the database.
ISM-1811	Performing and retaining backups: Backups of data, applications and settings are retained in a secure and resilient manner.	Partial	The database is backed up continuously and can be restored to any moment in the last 35 days. It is protected from deletion, a final snapshot is taken if it is ever deleted, and an earlier version of a replaced or deleted file is kept for 30 days. The database, its backups and stored files are encrypted with AES-256 under keys held in AWS Key Management Service, which rotate automatically; the secrets behind authenticator apps are encrypted a second time inside the database. Backups are held in Melbourne only, in the same AWS account as production: there is no copy in a second region or account yet.
ISM-1812	Backup access: Unprivileged user accounts cannot access backups belonging to other user accounts.	Not yet assessed	Not yet assessed.
ISM-1813	Backup access: Unprivileged user accounts cannot access their own backups.	Not yet assessed	Not yet assessed.
ISM-1705	Backup access: Privileged user accounts (excluding backup administrator accounts) cannot access backups belonging to other user accounts.	Not yet assessed	Not yet assessed.
ISM-1706	Backup access: Privileged user accounts (excluding backup administrator accounts) cannot access their own backups.	Not yet assessed	Not yet assessed.
ISM-1814	Backup modification and deletion: Unprivileged user accounts are prevented from modifying and deleting backups.	Not yet assessed	Not yet assessed.
ISM-1707	Backup modification and deletion: Privileged user accounts (excluding backup administrator accounts) are prevented from modifying and deleting backups.	Not yet assessed	Not yet assessed.
ISM-1708	Backup modification and deletion: Backup administrator accounts are prevented from modifying and deleting backups during their retention period.	Not yet assessed	Not yet assessed.
ISM-2151	Backup modification and deletion: Backups are stored using a technically enforced immutability mechanism that prevents their modification or deletion for the duration of their retention period.	Not yet assessed	Not yet assessed.
ISM-2152	Backup modification and deletion: Backup infrastructure, including backup servers, repositories and management consoles, is segregated from production environments and uses a separate authentication mechanism for administrative access.	Planned	Backups are held in Melbourne only, in the same AWS account as production: there is no copy in a second region or account yet.
ISM-1515	Testing restoration of backups: Restoration of data, applications and settings from backups to a common point in time is tested as part of disaster recovery exercises.	Planned	A full restore from backup has not yet been tested. The Business Continuity Policy schedules one every quarter.
ISM-0580	Security monitoring policy: A security monitoring policy is developed, implemented and maintained.	In place	Techly's Information Security Policy and the thirteen policies under it, among them Access Control, Acceptable Use, Business Continuity, Cryptography, Logging and Monitoring, Secure Development, Supplier Security and Vulnerability Management, are published in this Trust Centre. Each names its owner and is reviewed every year.
ISM-1405	Centralised event logging facility: A centralised event logging facility is implemented.	In place	Logs, metrics and traces from every part of the service are collected through OpenTelemetry and go to Grafana Cloud in Australia, with credentials and what is said to and by the AI removed first. Alerts watch errors, response times, database capacity, background work, certificates and credentials, each alert has a written runbook, and a watchdog pages if the monitoring itself stops reporting. Activity on our AWS accounts is recorded by AWS CloudTrail into a separate archive account, where it is locked for 12 months.
ISM-1983	Centralised event logging facility: Event logs sent to a centralised event logging facility are sent as soon as possible after they occur.	In place	Logs, metrics and traces from every part of the service are collected through OpenTelemetry and go to Grafana Cloud in Australia, with credentials and what is said to and by the AI removed first. Alerts watch errors, response times, database capacity, background work, certificates and credentials, each alert has a written runbook, and a watchdog pages if the monitoring itself stops reporting.
ISM-1984	Centralised event logging facility: Event logs sent to a centralised event logging facility are encrypted in transit using Australian Signals Directorate (ASD)-approved cryptography.	Not yet assessed	Not yet assessed.
ISM-1985	Centralised event logging facility: Event logs are protected from unauthorised access.	In place	Every change in a workspace is recorded in plain words, whoever made it: a person, an automation, the AI or Support. What people view is recorded too, and so are attempts the permission engine refuses. The trail is kept for 24 months: records are only ever added, never edited, and each is cryptographically linked to the one before it, so tampering would be evident. Activity on our AWS accounts is recorded by AWS CloudTrail into a separate archive account, where it is locked for 12 months.
ISM-1815	Centralised event logging facility: Event logs are protected from unauthorised modification and deletion.	Partial	Every change in a workspace is recorded in plain words, whoever made it: a person, an automation, the AI or Support. What people view is recorded too, and so are attempts the permission engine refuses. The trail is kept for 24 months: records are only ever added, never edited, and each is cryptographically linked to the one before it, so tampering would be evident. Activity on our AWS accounts is recorded by AWS CloudTrail into a separate archive account, where it is locked for 12 months. This covers the audit trail and our cloud activity records; application logs are kept for 30 days in Grafana Cloud.
ISM-0988	Centralised event logging facility: An accurate and consistent time source is used for event logging.	In place	Our servers, the database and the network edge keep the time their providers synchronise, and every log and audit record carries a timestamp with its time zone.
ISM-0585	Event log details: For each event logged, the date and time of the event, the relevant user or process, the relevant filename, the event description, and the information technology equipment involved are captured.	In place	Every change in a workspace is recorded in plain words, whoever made it: a person, an automation, the AI or Support. What people view is recorded too, and so are attempts the permission engine refuses. The trail is kept for 24 months: records are only ever added, never edited, and each is cryptographically linked to the one before it, so tampering would be evident.
ISM-1959	Event log details: To the extent possible, event logs are captured and stored in a consistent and structured format.	In place	Logs, metrics and traces from every part of the service are collected through OpenTelemetry and go to Grafana Cloud in Australia, with credentials and what is said to and by the AI removed first. Alerts watch errors, response times, database capacity, background work, certificates and credentials, each alert has a written runbook, and a watchdog pages if the monitoring itself stops reporting.
ISM-0120	Event log monitoring: Cyber security personnel have access to sufficient tools to facilitate the detection of cyber security events and the identification of cyber security incidents.	Partial	Logs, metrics and traces from every part of the service are collected through OpenTelemetry and go to Grafana Cloud in Australia, with credentials and what is said to and by the AI removed first. Alerts watch errors, response times, database capacity, background work, certificates and credentials, each alert has a written runbook, and a watchdog pages if the monitoring itself stops reporting. A sign-in as an account's root user, use of emergency access, or a change to an organisation policy or to our cloud activity logging pages our on-call engineer; a change to who can reach our AWS accounts, and a new finding of access from outside them, raise an alert. Managed threat detection for our AWS accounts (Amazon GuardDuty), and detection of unusual sign-in patterns in Pyron, are not in place.
ISM-2116	Event log monitoring: Cyber threat intelligence services are used to support the detection of cyber security events and the identification of cyber security incidents.	Partial	Threat intelligence reaches us through the services that carry it: new advisories for our dependencies every day, the threat categories our outbound filter blocks, and Cloudflare's managed firewall rules. Gathering it as a process of its own, including membership of security forums, is not yet documented.
ISM-2117	Event log monitoring: Suitable AI models are used to augment the detection of cyber security events and the identification of cyber security incidents.	Not yet assessed	Not yet assessed.
ISM-1986	Event log monitoring: Event logs from critical servers are analysed in a timely manner to detect cyber security events.	Partial	A sign-in as an account's root user, use of emergency access, or a change to an organisation policy or to our cloud activity logging pages our on-call engineer; a change to who can reach our AWS accounts, and a new finding of access from outside them, raise an alert. Managed threat detection for our AWS accounts (Amazon GuardDuty), and detection of unusual sign-in patterns in Pyron, are not in place. Alerts that need someone page our on-call engineer through All Quiet. On-call is one engineer, with no second line.
ISM-1906	Event log monitoring: Event logs from internet-facing servers are analysed in a timely manner to detect cyber security events.	Partial	A sign-in as an account's root user, use of emergency access, or a change to an organisation policy or to our cloud activity logging pages our on-call engineer; a change to who can reach our AWS accounts, and a new finding of access from outside them, raise an alert. Managed threat detection for our AWS accounts (Amazon GuardDuty), and detection of unusual sign-in patterns in Pyron, are not in place. Alerts that need someone page our on-call engineer through All Quiet. On-call is one engineer, with no second line.
ISM-1907	Event log monitoring: Event logs from non-internet-facing servers are analysed in a timely manner to detect cyber security events.	Partial	A sign-in as an account's root user, use of emergency access, or a change to an organisation policy or to our cloud activity logging pages our on-call engineer; a change to who can reach our AWS accounts, and a new finding of access from outside them, raise an alert. Managed threat detection for our AWS accounts (Amazon GuardDuty), and detection of unusual sign-in patterns in Pyron, are not in place. Alerts that need someone page our on-call engineer through All Quiet. On-call is one engineer, with no second line.
ISM-0109	Event log monitoring: Event logs from workstations are analysed in a timely manner to detect cyber security events.	Planned	The devices staff use are not managed centrally: there is no inventory, enforcement or remote wipe of them.
ISM-1987	Event log monitoring: Event logs from security products are analysed in a timely manner to detect cyber security events.	Not yet assessed	Not yet assessed.
ISM-1960	Event log monitoring: Event logs from internet-facing network devices are analysed in a timely manner to detect cyber security events.	Not yet assessed	Not yet assessed.
ISM-1961	Event log monitoring: Event logs from non-internet-facing network devices are analysed in a timely manner to detect cyber security events.	Not yet assessed	Not yet assessed.
ISM-1228	Event log monitoring: Cyber security events are analysed in a timely manner to identify cyber security incidents.	Partial	Alerts that need someone page our on-call engineer through All Quiet. On-call is one engineer, with no second line. The Incident Management Policy sets out how an incident is found, rated, contained, investigated with its evidence preserved, and learned from, who leads it and when customers are told. Each Critical or High incident gets a written review within 10 business days, and an affected customer may ask for a summary of it. The policy took effect on 25 October 2026, and the yearly walk-through of an incident scenario it requires has not yet been held.
ISM-2153	Threat hunting: Threat hunting activities, informed by current strategic and sector-specific cyber threat intelligence, are conducted at least every three months.	Not yet assessed	Not yet assessed.
ISM-1988	Event log retention: Event logs are retained in a searchable manner for at least 12 months.	Partial	Every change in a workspace is recorded in plain words, whoever made it: a person, an automation, the AI or Support. What people view is recorded too, and so are attempts the permission engine refuses. The trail is kept for 24 months: records are only ever added, never edited, and each is cryptographically linked to the one before it, so tampering would be evident. Activity on our AWS accounts is recorded by AWS CloudTrail into a separate archive account, where it is locked for 12 months. Application logs are kept for 30 days.
ISM-1989	Event log retention: Event logs are retained as per minimum retention requirements for various classes of records as set out by the National Archives of Australia’s Administrative Functions Disposal Authority Express (AFDA Express) Version 2 publication.	Not yet assessed	Not yet assessed.
ISM-1807	Vulnerability scanning: An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activities.	Not yet assessed	Not yet assessed.
ISM-1808	Vulnerability scanning: A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities.	In place	Every dependency is scanned for known vulnerabilities on each change and every day. A change that adds a high or critical advisory is blocked, and an accepted finding is recorded with its reason and an expiry, so it is looked at again.
ISM-1698	Vulnerability scanning: A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online services.	In place	Every dependency is scanned for known vulnerabilities on each change and every day. A change that adds a high or critical advisory is blocked, and an accepted finding is recorded with its reason and an expiry, so it is looked at again.
ISM-1699	Vulnerability scanning: A vulnerability scanner is used at least weekly to identify missing patches or updates for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products.	Not yet assessed	Not yet assessed.
ISM-1700	Vulnerability scanning: A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in applications other than office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products.	Not yet assessed	Not yet assessed.
ISM-1701	Vulnerability scanning: A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices.	Not yet assessed	Not yet assessed.
ISM-1702	Vulnerability scanning: A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices.	Not yet assessed	Not yet assessed.
ISM-1752	Vulnerability scanning: A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of IT equipment other than workstations, servers and network devices.	Not yet assessed	Not yet assessed.
ISM-1703	Vulnerability scanning: A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in drivers.	Not yet assessed	Not yet assessed.
ISM-1900	Vulnerability scanning: A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in firmware.	Not yet assessed	Not yet assessed.
ISM-1921	Vulnerability scanning: The likelihood of system compromise is frequently assessed when working exploits exist for unmitigated vulnerabilities.	Not yet assessed	Not yet assessed.
ISM-2118	Vulnerability assessments and penetration tests: Vulnerability assessments and penetration tests are conducted for systems prior to their deployment, including prior to the deployment of significant changes, and at least every six months thereafter.	Planned	Pyron holds no security certification and has had no independent penetration test.
ISM-2119	Vulnerability assessments and penetration tests: Suitable AI models are used to augment vulnerability assessments and penetration tests.	Not yet assessed	Not yet assessed.
ISM-0400	Development, testing, staging and production environments: Development, testing, staging and production environments are segregated.	In place	Staging and each pull request's preview run apart from production: they use a staging database, never production's, previews run on nodes of their own, and network policies stop staging from ever reaching production. They share production's AWS account and cluster.
ISM-1419	Development, testing, staging and production environments: Development and modification of software only take place in development environments.	Partial	Every change reaches production as a pull request, which merges only when its required checks pass: the test suites, a production build, an API contract check and a dependency scan. The team is small, and a second engineer's approval is not yet required. The owner's account can bypass these rules in an emergency, and GitHub records each bypass. Staging and each pull request's preview run apart from production: they use a staging database, never production's, previews run on nodes of their own, and network policies stop staging from ever reaching production. They share production's AWS account and cluster.
ISM-1420	Development, testing, staging and production environments: Data from production environments is not used in non-production environments unless the non-production environment is secured to at least the same level as the production environment.	Partial	Automated tests run on generated data. A database migration that rewrites rows is rehearsed on a copy of production restored inside our AWS account, which only the rehearsal can reach, and moving a workspace from Techly's earlier platform runs on a working copy that is deleted once the move is checked.
ISM-2023	Authoritative source for software: An authoritative source for software is established and maintained.	In place	Pyron's source code is held in a private GitHub repository. Our GitHub organisation requires two-factor authentication, and secrets are kept out of the code.
ISM-2024	Authoritative source for software: The authoritative source for software is used for all software development activities.	Partial	Pyron's source code is held in a private GitHub repository. Our GitHub organisation requires two-factor authentication, and secrets are kept out of the code. Every change reaches production as a pull request, which merges only when its required checks pass: the test suites, a production build, an API contract check and a dependency scan. The team is small, and a second engineer's approval is not yet required. The owner's account can bypass these rules in an emergency, and GitHub records each bypass.
ISM-1422	Authoritative source for software: Unauthorised access to the authoritative source for software is prevented.	In place	Pyron's source code is held in a private GitHub repository. Our GitHub organisation requires two-factor authentication, and secrets are kept out of the code.
ISM-1816	Authoritative source for software: Unauthorised modification of the authoritative source for software is prevented.	Partial	Pyron's source code is held in a private GitHub repository. Our GitHub organisation requires two-factor authentication, and secrets are kept out of the code. Every change reaches production as a pull request, which merges only when its required checks pass: the test suites, a production build, an API contract check and a dependency scan. The team is small, and a second engineer's approval is not yet required. The owner's account can bypass these rules in an emergency, and GitHub records each bypass.
ISM-2025	Issue tracking: An issue tracking solution is used to link software development tasks to security issues and decisions, change or feature requests, programming issues, or bug fixes.	Not yet assessed	Not yet assessed.
ISM-2120	Secure software development: A secure software development policy is developed, implemented and maintained.	In place	The Change Management Policy sets out how every change to Pyron is made, checked, released and recorded, including emergency changes, and it is reviewed every year. Techly's Information Security Policy and the thirteen policies under it, among them Access Control, Acceptable Use, Business Continuity, Cryptography, Logging and Monitoring, Secure Development, Supplier Security and Vulnerability Management, are published in this Trust Centre. Each names its owner and is reviewed every year.
ISM-2033	Secure software development: All software security requirements are documented, stored securely and maintained throughout the software development life cycle.	Not yet assessed	Not yet assessed.
ISM-2034	Secure software development: Security design decisions are documented and reviewed throughout the software development cycle.	Not yet assessed	Not yet assessed.
ISM-2035	Secure software development: Security roles, responsibilities and knowledge required to support the software development life cycle are identified and documented.	Not yet assessed	Not yet assessed.
ISM-2036	Secure software development: Security responsibilities for software developers are identified and documented.	Not yet assessed	Not yet assessed.
ISM-2121	Secure software development: Software developers that lack sufficient cyber security knowledge and skills required for their projects or tasks are not used.	Not yet assessed	Not yet assessed.
ISM-2037	Secure software development: Software developers that lack sufficient cyber security knowledge and skills required for their projects or tasks undertake suitable training or upskilling on secure software development and programming practices.	Not yet assessed	Not yet assessed.
ISM-2038	Secure software development: A software developer cyber security knowledge and skills register is developed, implemented and maintained.	Not yet assessed	Not yet assessed.
ISM-0401	Secure software development: Secure by Design principles and practices are followed throughout the software development life cycle.	In place	Every change a person, an automation or the AI makes goes through the same path, which asks the permission engine before anything is written. Each workspace's data lives in a database schema of its own, and every request is answered inside the schema of the workspace it was made to. Each workspace has its own environment in our authorisation service, and a sign-in names the workspace it was issued for, so no other workspace accepts it. The database server and the computing cluster are shared.
ISM-1238	Secure software development: Threat modelling is used in support of the software development life cycle.	Planned	Threat models are not yet documented.
ISM-2039	Secure software development: The software threat model is reviewed throughout the software development life cycle to ensure it reflects the as-built software and any changes to the threat environment.	Planned	Threat models are not yet documented.
ISM-2040	Secure software development: Secure programming practices for the chosen programming language are used for software development.	In place	Static analysis runs on every change, including security rules for our code, our container files and our build workflows.
ISM-2041	Secure software development: Memory-safe programming languages, or less preferably memory-safe programming practices, are used for software development.	In place	Pyron is written in Python and TypeScript, which are memory-safe, on the Django and Next.js frameworks.
ISM-2042	Secure software development: Secure by Default principles and practices are followed throughout the software development life cycle, including by ensuring that all built-in security measures are included and enabled in the base product at no extra cost to consumers.	Partial	What a person can see and do comes from their roles and from what is shared with them, and access to a place flows down to everything beneath it. Every operation in Pyron has a permission of its own, the permission engine's default answer is no, and only a role that holds the permission can add people, change roles or change the workspace's settings. Two-step sign-in is optional until a workspace admin makes it required.
ISM-1780	Secure software development: SecDevOps practices are used for software development.	Partial	Static analysis runs on every change, including security rules for our code, our container files and our build workflows. Every dependency is scanned for known vulnerabilities on each change and every day. A change that adds a high or critical advisory is blocked, and an accepted finding is recorded with its reason and an expiry, so it is looked at again. Every change reaches production as a pull request, which merges only when its required checks pass: the test suites, a production build, an API contract check and a dependency scan. The team is small, and a second engineer's approval is not yet required. The owner's account can bypass these rules in an emergency, and GitHub records each bypass.
ISM-2043	Secure software development: Software is architected and structured to support readability and maintainability.	Not yet assessed	Not yet assessed.
ISM-1796	Secure software development: Files containing executable content are digitally signed by a certificate with a verifiable chain of trust as part of software development.	Partial	Container images are built by our pipeline from base images pinned to an exact digest, with dependencies installed from lockfiles that pin each one's version and hash, scanned when they are pushed, and stored under tags that cannot be overwritten. Images are not signed.
ISM-1797	Secure software development: Installers, patches and updates are digitally signed or provided with cryptographic checksums as part of software development.	Partial	Container images are built by our pipeline from base images pinned to an exact digest, with dependencies installed from lockfiles that pin each one's version and hash, scanned when they are pushed, and stored under tags that cannot be overwritten. Images are not signed.
ISM-2044	Secure software development: Software has no default credentials; however, if credentials are required, they are created on first install by the installing organisation.	Not yet assessed	Not yet assessed.
ISM-2045	Secure software development: Application backwards compatibility does not compromise any security measures or features.	Not yet assessed	Not yet assessed.
ISM-2046	Secure software development: Where software allows user impersonation, sensitive data is not logged and appropriate permissions are set.	Not yet assessed	Not yet assessed.
ISM-2047	Secure software development: Where software allows an authentication factor to be reset for a human user, the human user is notified of the reset through a secondary channel.	Not yet assessed	Not yet assessed.
ISM-2048	Secure software development: Where software supports multiple user roles, non-administrative users are prevented from altering their profile permissions or privileges.	In place	What a person can see and do comes from their roles and from what is shared with them, and access to a place flows down to everything beneath it. Every operation in Pyron has a permission of its own, the permission engine's default answer is no, and only a role that holds the permission can add people, change roles or change the workspace's settings.
ISM-2049	Secure software development: When user permissions or credentials are changed, software forces all impacted users to re-authenticate.	Not yet assessed	Not yet assessed.
ISM-2050	Secure software development: When digital signatures are processed by software, they are validated against a certificate trust chain and checked for revocation using a Certificate Revocation List or with the Online Certificate Status Protocol.	Not yet assessed	Not yet assessed.
ISM-2051	Secure software development: Software generates sufficient event logs to support the detection of cyber security events.	In place	Every change in a workspace is recorded in plain words, whoever made it: a person, an automation, the AI or Support. What people view is recorded too, and so are attempts the permission engine refuses. The trail is kept for 24 months: records are only ever added, never edited, and each is cryptographically linked to the one before it, so tampering would be evident. Logs, metrics and traces from every part of the service are collected through OpenTelemetry and go to Grafana Cloud in Australia, with credentials and what is said to and by the AI removed first. Alerts watch errors, response times, database capacity, background work, certificates and credentials, each alert has a written runbook, and a watchdog pages if the monitoring itself stops reporting.
ISM-2052	Secure software development: Event logs produced by software ensure that any sensitive data is protected.	In place	Logs, metrics and traces from every part of the service are collected through OpenTelemetry and go to Grafana Cloud in Australia, with credentials and what is said to and by the AI removed first. Alerts watch errors, response times, database capacity, background work, certificates and credentials, each alert has a written runbook, and a watchdog pages if the monitoring itself stops reporting.
ISM-1798	Secure software development: Secure configuration guidance, in the form of a hardening guide or loosening guide, is produced and made available to consumers as part of software development.	In place	This Trust Centre sets out what Pyron does and what a customer does, action by action, against ASD's Essentials for cloud, and names the owner of each answer to the Cloud Security Alliance's questionnaire.
ISM-2053	Secure software development: End of life procedures for software, including procedures for software removal and the archival or destruction of user accounts and data, are produced and made available to consumers.	In place	People can export a table's records as a spreadsheet. When a subscription ends there is a 30-day export window, then deletion within 90 days; deleting a workspace removes its database schema, its files, its stored secrets and its single sign-on connection, and backups age out on their normal rotation.
ISM-2026	Software artefacts: All software artefacts are scanned for malicious content before being imported into the authoritative source for software.	Not yet assessed	Not yet assessed.
ISM-2027	Software artefacts: All software artefacts are verified by a digital signature, or a secure hash provided over a secure channel, before being imported into the authoritative source for software.	In place	Container images are built by our pipeline from base images pinned to an exact digest, with dependencies installed from lockfiles that pin each one's version and hash, scanned when they are pushed, and stored under tags that cannot be overwritten.
ISM-2028	Software artefacts: All software artefacts are tested to detect known weaknesses using static application security testing (SAST), dynamic application security testing (DAST) or software composition analysis (SCA), depending on the software artefact type, before being imported into the authoritative source for software.	Partial	Static analysis runs on every change, including security rules for our code, our container files and our build workflows. Every dependency is scanned for known vulnerabilities on each change and every day. A change that adds a high or critical advisory is blocked, and an accepted finding is recorded with its reason and an expiry, so it is looked at again. There is no dynamic application security testing.
ISM-2102	Software artefacts: Existing software artefacts in the authoritative source for software are periodically tested to detect known weaknesses using SAST, DAST or SCA, depending on the software artefact type, throughout the software development life cycle.	In place	Every dependency is scanned for known vulnerabilities on each change and every day. A change that adds a high or critical advisory is blocked, and an accepted finding is recorded with its reason and an expiry, so it is looked at again.
ISM-2029	Software artefacts: The authoritative source for software restricts the use and import of third-party libraries and software components to trustworthy sources.	Not yet assessed	Not yet assessed.
ISM-2154	Software artefacts: Software artefact dependencies are pinned to approved versions in source code.	In place	Container images are built by our pipeline from base images pinned to an exact digest, with dependencies installed from lockfiles that pin each one's version and hash, scanned when they are pushed, and stored under tags that cannot be overwritten.
ISM-2030	Software artefacts: Scanning is used during commits to identify plain text or encoded credentials, keys and secrets, which are then blocked from being stored in the authoritative source for software.	In place	Our code is scanned for secrets on every change, and GitHub refuses a push that contains one.
ISM-2031	Build solution: Compilers, interpreters and build tools (including pipelines) that provide security features to improve executable file security are implemented and such security features are used.	Not yet assessed	Not yet assessed.
ISM-2155	Build solution: Software is built using reproducible build practices that enable independent verification that release artefacts were produced from the stated source code.	Not yet assessed	Not yet assessed.
ISM-2032	Build solution: The build solution ensures that all automated testing is completed without warnings, alerts or errors before building software artefacts.	Not yet assessed	Not yet assessed.
ISM-2054	Software bill of materials: If a software bill of materials is available for imported third-party software components, it is used during software development to ensure such software components have no known vulnerabilities.	Not yet assessed	Not yet assessed.
ISM-1730	Software bill of materials: A software bill of materials is produced and made available to consumers of software.	Partial	Locked dependency files list every library Pyron is built from, at its exact version. No formal software bill of materials is produced from them.
ISM-2082	Cryptographic bill of materials: If a cryptographic bill of materials is available for imported third-party software components, it is used during software development to ensure such software components provide support for standardised implementations of ASD-Approved Cryptographic Algorithms.	Not yet assessed	Not yet assessed.
ISM-2083	Cryptographic bill of materials: A cryptographic bill of materials is produced and made available to consumers of software.	Not yet assessed	Not yet assessed.
ISM-2055	Software build provenance: If a software build provenance is available for imported third-party software components, it is used during software development to ensure such software components are built to an appropriate standard.	Not yet assessed	Not yet assessed.
ISM-2056	Software build provenance: A software build provenance is produced and made available to consumers of software.	Not yet assessed	Not yet assessed.
ISM-1818	Network application programming interfaces: Authentication and authorisation of clients is performed when clients call network APIs that facilitate modification of data and are accessible over the internet.	In place	What a person can see and do comes from their roles and from what is shared with them, and access to a place flows down to everything beneath it. Every operation in Pyron has a permission of its own, the permission engine's default answer is no, and only a role that holds the permission can add people, change roles or change the workspace's settings. Every change a person, an automation or the AI makes goes through the same path, which asks the permission engine before anything is written.
ISM-2013	Network application programming interfaces: Authentication and authorisation of clients is performed when clients call network APIs that facilitate modification of data but are not accessible over the internet.	In place	What a person can see and do comes from their roles and from what is shared with them, and access to a place flows down to everything beneath it. Every operation in Pyron has a permission of its own, the permission engine's default answer is no, and only a role that holds the permission can add people, change roles or change the workspace's settings. Every change a person, an automation or the AI makes goes through the same path, which asks the permission engine before anything is written.
ISM-1817	Network application programming interfaces: Authentication and authorisation of clients is performed when clients call network APIs that facilitate access to data not authorised for release into the public domain and are accessible over the internet.	In place	What a person can see and do comes from their roles and from what is shared with them, and access to a place flows down to everything beneath it. Every operation in Pyron has a permission of its own, the permission engine's default answer is no, and only a role that holds the permission can add people, change roles or change the workspace's settings. Integrations and automations act as service accounts, each holding roles like a person. An API key belongs to one service account, is stored only as a hash, can expire and can be revoked at any time, and what is done with it is recorded on the audit trail as that account.
ISM-2014	Network application programming interfaces: Authentication and authorisation of clients is performed when clients call network APIs that facilitate access to data not authorised for release into the public domain but are not accessible over the internet.	In place	What a person can see and do comes from their roles and from what is shared with them, and access to a place flows down to everything beneath it. Every operation in Pyron has a permission of its own, the permission engine's default answer is no, and only a role that holds the permission can add people, change roles or change the workspace's settings. Integrations and automations act as service accounts, each holding roles like a person. An API key belongs to one service account, is stored only as a hash, can expire and can be revoked at any time, and what is done with it is recorded on the audit trail as that account.
ISM-1910	Network application programming interfaces: Network API calls that facilitate modification of data, or access to data not authorised for release into the public domain, and are accessible over the internet, are centrally logged.	In place	Every change in a workspace is recorded in plain words, whoever made it: a person, an automation, the AI or Support. What people view is recorded too, and so are attempts the permission engine refuses. The trail is kept for 24 months: records are only ever added, never edited, and each is cryptographically linked to the one before it, so tampering would be evident.
ISM-2015	Network application programming interfaces: Network API calls that facilitate modification of data, or access to data not authorised for release into the public domain, but are not accessible over the internet, are centrally logged.	In place	Every change in a workspace is recorded in plain words, whoever made it: a person, an automation, the AI or Support. What people view is recorded too, and so are attempts the permission engine refuses. The trail is kept for 24 months: records are only ever added, never edited, and each is cryptographically linked to the one before it, so tampering would be evident.
ISM-1240	Software input handling: Validation and sanitisation are performed on all input received over the internet by software.	In place	Every change's input is validated against the declared contract of the operation that makes it, and a field the contract does not declare is refused. A record's data is validated against its form's schema. Every uploaded file is scanned for malware before anyone can open it, and a file that holds malware is removed.
ISM-2016	Software input handling: Validation and sanitisation are performed on all input received over a local network by software.	In place	Every change's input is validated against the declared contract of the operation that makes it, and a field the contract does not declare is refused. A record's data is validated against its form's schema.
ISM-2057	Software input handling: All input validation rules are documented, implemented in code, and tested using both positive and negative unit tests and integration tests.	Not yet assessed	Not yet assessed.
ISM-2058	Software input handling: Data sources and serialised data inputs are validated before being deserialised.	Not yet assessed	Not yet assessed.
ISM-2059	Software input handling: File uploads or input are restricted to specific file types, with malicious content scanning occurring prior to file access, file execution or file storage.	Not yet assessed	Not yet assessed.
ISM-1275	Software interaction with databases: All queries to databases from software are filtered for legitimate content and correct syntax.	Not yet assessed	Not yet assessed.
ISM-1276	Software interaction with databases: Parameterised queries or stored procedures, instead of dynamically generated queries, are used by software for database interactions.	Not yet assessed	Not yet assessed.
ISM-1278	Software interaction with databases: Software is designed or configured to provide as little error information as possible about the structure of databases.	Not yet assessed	Not yet assessed.
ISM-1536	Software interaction with databases: All queries to databases from software, and any resulting crash or error messages, are centrally logged.	Not yet assessed	Not yet assessed.
ISM-2061	Software security testing: Peer reviews are conducted on all critical and security-related software components.	Partial	Every change reaches production as a pull request, which merges only when its required checks pass: the test suites, a production build, an API contract check and a dependency scan. The team is small, and a second engineer's approval is not yet required. The owner's account can bypass these rules in an emergency, and GitHub records each bypass.
ISM-2060	Software security testing: Code reviews are utilised to ensure software components meets Secure by Design principles and practices as well as secure programming practices.	Partial	Every change reaches production as a pull request, which merges only when its required checks pass: the test suites, a production build, an API contract check and a dependency scan. The team is small, and a second engineer's approval is not yet required. The owner's account can bypass these rules in an emergency, and GitHub records each bypass. Static analysis runs on every change, including security rules for our code, our container files and our build workflows.
ISM-2062	Software security testing: Unit testing and integration testing, covering both positive and negative use cases, are used for software components to ensure code quality and correctness.	Partial	Automated tests that try to reach one workspace's data from another run on every change, as do censuses that hold every operation to its declared permission and every read to its scoping. Every change reaches production as a pull request, which merges only when its required checks pass: the test suites, a production build, an API contract check and a dependency scan. The team is small, and a second engineer's approval is not yet required. The owner's account can bypass these rules in an emergency, and GitHub records each bypass.
ISM-0402	Software security testing: Software is comprehensively tested for vulnerabilities using SAST, DAST and SCA prior to its initial release, any subsequent release, and periodically to help identify any previously unidentified vulnerabilities.	Partial	Static analysis runs on every change, including security rules for our code, our container files and our build workflows. Every dependency is scanned for known vulnerabilities on each change and every day. A change that adds a high or critical advisory is blocked, and an accepted finding is recorded with its reason and an expiry, so it is looked at again. There is no dynamic application security testing.
ISM-2122	Software security testing: Suitable AI models are used to augment software security testing.	Not yet assessed	Not yet assessed.
ISM-1616	Vulnerability disclosure program: A vulnerability disclosure program is implemented to assist with the secure development and maintenance of products and services.	In place	Anyone can report a vulnerability to security@pyron.io, as our security.txt says. A report is acknowledged within 5 business days, and the Website Terms set out what good-faith testing and disclosure are.
ISM-1755	Vulnerability disclosure program: A vulnerability disclosure policy is developed, implemented and maintained.	In place	Anyone can report a vulnerability to security@pyron.io, as our security.txt says. A report is acknowledged within 5 business days, and the Website Terms set out what good-faith testing and disclosure are.
ISM-1756	Vulnerability disclosure program: Vulnerability disclosure processes, and supporting vulnerability disclosure procedures, are developed, implemented and maintained.	In place	Anyone can report a vulnerability to security@pyron.io, as our security.txt says. A report is acknowledged within 5 business days, and the Website Terms set out what good-faith testing and disclosure are.
ISM-1717	Vulnerability disclosure program: A ‘security.txt’ file is hosted for each of an organisation’s internet-facing website domains to assist in the responsible disclosure of vulnerabilities in the organisation’s products and services.	In place	Anyone can report a vulnerability to security@pyron.io, as our security.txt says. A report is acknowledged within 5 business days, and the Website Terms set out what good-faith testing and disclosure are.
ISM-1908	Reporting and resolving vulnerabilities: Vulnerabilities identified in software are publicly disclosed in a responsible and timely manner, including with Common Weakness Enumeration and Common Platform Enumeration information.	Not yet assessed	Not yet assessed.
ISM-1754	Reporting and resolving vulnerabilities: Vulnerabilities identified in software are resolved in a timely manner.	In place	The Vulnerability Management Policy sets how fast a finding is fixed or accepted with a reason: a critical one within 7 days, a high one within 30, and others at the component's next update. One that is being exploited, or that exposes customer data, is an incident, handled at once.
ISM-1909	Reporting and resolving vulnerabilities: In resolving vulnerabilities, root cause analysis is performed and, to the greatest extent possible, entire vulnerability classes are remediated.	Not yet assessed	Not yet assessed.
ISM-1911	Software event logging: Security-relevant usage, error messages and crashes for software are centrally logged.	In place	Logs, metrics and traces from every part of the service are collected through OpenTelemetry and go to Grafana Cloud in Australia, with credentials and what is said to and by the AI removed first. Alerts watch errors, response times, database capacity, background work, certificates and credentials, each alert has a written runbook, and a watchdog pages if the monitoring itself stops reporting. Every change in a workspace is recorded in plain words, whoever made it: a person, an automation, the AI or Support. What people view is recorded too, and so are attempts the permission engine refuses. The trail is kept for 24 months: records are only ever added, never edited, and each is cryptographically linked to the one before it, so tampering would be evident.
ISM-2084	Secure artificial intelligence application development: AI-specific documentation, including AI model cards and AI system cards (or equivalent artefacts), is used to document AI model characteristics, system architectures, use cases and security risks.	Not yet assessed	Not yet assessed.
ISM-2072	Secure artificial intelligence application development: AI models are stored in a non-executable file format that does not allow arbitrary code execution.	Not applicable	Pyron stores no AI model: it calls Amazon Bedrock's hosted models.
ISM-2085	Secure artificial intelligence application development: The exposure of exact AI model confidence scores in API outputs or user interfaces is prevented.	Not yet assessed	Not yet assessed.
ISM-2103	Data collection, retention and use: Organisational data generated, collected or processed by AI applications is not used for training, fine-tuning or improving AI models unless informed and explicit consent has been obtained from data owners in advance.	In place	Pyron AI works with the permissions of the person asking: it sees only what they can see, and its activity is recorded on the audit trail like any other actor's. Customer data is not used to train foundation models.
ISM-2123	Data collection, retention and use: All prompts and outputs associated with chat sessions are securely deleted when chat sessions are removed from AI applications.	Not yet assessed	Not yet assessed.
ISM-2086	Artificial intelligence model poisoning: The source and integrity of AI models, structures and weights are verified.	Not yet assessed	Not yet assessed.
ISM-2087	Artificial intelligence model poisoning: The source and integrity of training data for AI models is verified.	Not applicable	Pyron trains no AI model.
ISM-2088	Artificial intelligence model poisoning: Data validation and verification techniques are used to ensure the reliability and accuracy of training data used by AI models.	Not applicable	Pyron trains no AI model.
ISM-2089	Unbounded consumption: AI model performance metrics are monitored and anomalies are investigated.	Not yet assessed	Not yet assessed.
ISM-2090	Unbounded consumption: Rate limiting is applied to inference queries for AI models.	Partial	In Setup, admins see what the workspace's AI has spent, set monthly AI budgets for the workspace, each role, each person and each automation, and answer requests for more. An automation that uses AI runs as an account an admin chose, and does only what its approved version declares. AI requests are limited by monthly budgets, not by rate.
ISM-2091	Unbounded consumption: Resource limits are enforced for AI models.	In place	In Setup, admins see what the workspace's AI has spent, set monthly AI budgets for the workspace, each role, each person and each automation, and answer requests for more. An automation that uses AI runs as an account an admin chose, and does only what its approved version declares.
ISM-2092	Excessive agency: Access control policies are implemented to enforce fine-grained permissions for AI applications.	In place	Pyron AI works with the permissions of the person asking: it sees only what they can see, and its activity is recorded on the audit trail like any other actor's. Customer data is not used to train foundation models.
ISM-2093	Excessive agency: Role-based access controls are implemented for AI applications to restrict access to sensitive data.	In place	Pyron AI works with the permissions of the person asking: it sees only what they can see, and its activity is recorded on the audit trail like any other actor's. Customer data is not used to train foundation models.
ISM-2156	Excessive agency: Agentic AI applications are restricted to the minimum set of tools, functions and permissions required for their intended purpose.	Not yet assessed	Not yet assessed.
ISM-2157	Excessive agency: Tools invoked by agentic AI applications are subject to both the access controls of the invoking user and agent-specific, task-scoped authorisation, with effective permissions limited to the minimum permitted by both.	Not yet assessed	Not yet assessed.
ISM-2158	Excessive agency: External content retrieved by agentic AI applications is treated as untrusted data throughout processing, is clearly delimited from system instructions, is subject to validation and sanitisation measures applied to other untrusted input, remains untrusted following such processing, and is prevented from modifying or overriding system instructions, security policies, access controls, tool permissions or human approval requirements.	Not yet assessed	Not yet assessed.
ISM-2159	Excessive agency: All tool invocations, external requests and outputs generated by agentic AI applications are centrally logged with sufficient detail to support cyber security incident investigations.	Not yet assessed	Not yet assessed.
ISM-1924	Prompt injection: Generative AI applications evaluate user prompts to detect and mitigate adversarial inputs or suffixes designed to elicit unintended behaviour or assist in the generation of sensitive or harmful content.	In place	Pyron AI runs behind Amazon Bedrock Guardrails, which check what people ask for prompt attacks and harmful content, and check its answers for harmful content and credentials. An intervention steers the AI back on course and is recorded.
ISM-2094	Sensitive data exposure and improper output: Content filtering is implemented by AI applications to detect and block sensitive data exposure and improper output.	In place	Pyron AI runs behind Amazon Bedrock Guardrails, which check what people ask for prompt attacks and harmful content, and check its answers for harmful content and credentials. An intervention steers the AI back on course and is recorded.
ISM-1922	Secure mobile application development: The OWASP Mobile Application Security Verification Standard is used in the development of mobile applications.	Not yet assessed	Not yet assessed.
ISM-1239	Secure web application design and development: Robust web application frameworks are used in the development of web applications.	In place	Pyron is written in Python and TypeScript, which are memory-safe, on the Django and Next.js frameworks.
ISM-0971	Secure web application design and development: The OWASP Application Security Verification Standard is used in the development of web applications.	Not yet assessed	Not yet assessed.
ISM-1849	Secure web application design and development: The OWASP Top 10 Proactive Controls are used in the development of web applications.	Not yet assessed	Not yet assessed.
ISM-1850	Secure web application design and development: The OWASP Top 10 are mitigated in the development of web applications.	Not yet assessed	Not yet assessed.
ISM-2063	Secure web application design and development: If supported, web application session cookies set the HttpOnly flag, Secure flag and the SameSite flag by default.	Not yet assessed	Not yet assessed.
ISM-2064	Secure web application design and development: Web application session cookies contain only digitally signed opaque bearer tokens.	Not yet assessed	Not yet assessed.
ISM-2065	Secure web application design and development: Web application session cookies using opaque bearer tokens that are not digitally signed use non-sequential random identifiers with a minimum of 128 bits of entropy, preferably 256 bits of entropy.	Not yet assessed	Not yet assessed.
ISM-2066	Secure web application design and development: Web application sessions are centrally managed server side.	Not yet assessed	Not yet assessed.
ISM-2067	Secure web application design and development: Web applications that support Single Sign On equally support Single Logout.	Not yet assessed	Not yet assessed.
ISM-1424	Web security policy response headers: Content-Security-Policy, Hypertext Transfer Protocol Strict Transport Security and X-Frame-Options are specified by web server software via security policy in response headers.	Not yet assessed	Not yet assessed.
ISM-1552	Web application interactions: All web application content is offered exclusively using HTTPS.	Partial	Pyron is served only over HTTPS with TLS 1.2 or later, and tells browsers never to use plain HTTP; the database refuses an unencrypted connection, and file storage refuses an unencrypted request. Traffic between our own services inside the cluster is not encrypted.
ISM-1851	Web application programming interfaces: The OWASP API Security Top 10 are mitigated in the development of web APIs.	Not yet assessed	Not yet assessed.
ISM-1241	Web application output encoding: Output encoding is performed on all output produced by web applications.	Not yet assessed	Not yet assessed.
ISM-1269	Functional separation between database servers and web servers: Database servers and web servers are functionally separated.	In place	The database and the application have no public address: requests reach the application only through an encrypted Cloudflare tunnel, and network policies stop staging from ever reaching production.
ISM-1277	Communications between database servers and web servers: Data communicated between database servers and web servers is encrypted using Australian Signals Directorate-approved cryptography.	Not yet assessed	Not yet assessed.
ISM-1270	Network environment: Database servers are placed on a different network segment to workstations.	In place	The database and the application have no public address: requests reach the application only through an encrypted Cloudflare tunnel, and network policies stop staging from ever reaching production.
ISM-1271	Network environment: Network access controls are implemented to restrict database server communications to strictly defined network resources that require access to the database server.	In place	The database and the application have no public address: requests reach the application only through an encrypted Cloudflare tunnel, and network policies stop staging from ever reaching production.
ISM-1272	Network environment: If only local access to a database is required, networking functionality of database management system applications is disabled or directed to listen solely to the localhost interface.	Not yet assessed	Not yet assessed.
ISM-1273	Segregation of development, testing, staging and production database servers: Database servers for development, testing, staging and production environments are segregated.	In place	Staging and each pull request's preview run apart from production: they use a staging database, never production's, previews run on nodes of their own, and network policies stop staging from ever reaching production. They share production's AWS account and cluster.
ISM-1243	Database register: A database register is developed, implemented, maintained and regularly verified.	Not yet assessed	Not yet assessed.
ISM-1256	Protecting databases: File-based access controls are applied to database files.	Not yet assessed	Not yet assessed.
ISM-0393	Protecting database contents: Databases and their contents are classified based on the sensitivity or classification of data that they contain.	In place	Information is classified Public, Internal, Confidential or Restricted, with handling rules for each. Everything a customer keeps in Pyron is Restricted: stored only in Pyron's production systems and with the providers our Privacy Statement names, and never copied to an email, a chat or a ticket.
ISM-1255	Protecting database contents: Database users’ ability to access, insert, modify and remove database contents is restricted based on their duties or functions.	Partial	Our engineers sign in to AWS through IAM Identity Center, in sessions that expire, and the production database accepts only short-lived sign-in tokens, never a stored password. Administrator access is standing rather than raised for each task.
ISM-1268	Protecting database contents: The need-to-know principle is enforced for database contents through the application of minimum privileges, database views, database roles and data tokenisation.	In place	What a person can see and do comes from their roles and from what is shared with them, and access to a place flows down to everything beneath it. Every operation in Pyron has a permission of its own, the permission engine's default answer is no, and only a role that holds the permission can add people, change roles or change the workspace's settings. Each workspace's data lives in a database schema of its own, and every request is answered inside the schema of the workspace it was made to. Each workspace has its own environment in our authorisation service, and a sign-in names the workspace it was issued for, so no other workspace accepts it. The database server and the computing cluster are shared.
ISM-1274	Segregation of development, testing, staging and production databases: Database contents from production environments are not used in non-production environments unless the non-production environment is secured to at least the same level as the production environment.	Partial	Automated tests run on generated data. A database migration that rewrites rows is rehearsed on a copy of production restored inside our AWS account, which only the rehearsal can reach, and moving a workspace from Techly's earlier platform runs on a working copy that is deleted once the move is checked.
ISM-1537	Database event logging: Security-relevant events for databases are centrally logged, including: - access or modification of particularly important content - addition of new users, especially privileged users - changes to user roles or privileges - attempts to elevate user privileges - queries containing comments - queries containing multiple embedded queries - database and query alerts or failures - database structure changes - database administrator actions - use of executable commands - database logons and logoffs.	Not yet assessed	Not yet assessed.
ISM-0264	Email usage policy: An email usage policy is developed, implemented and maintained.	Not yet assessed	Not yet assessed.
ISM-0267	Webmail services: Access to non-approved webmail services is blocked.	Not yet assessed	Not yet assessed.
ISM-0270	Protective markings for emails: Protective markings are applied to emails and reflect the highest sensitivity or classification of the subject, body and attachments.	Not yet assessed	Not yet assessed.
ISM-0271	Protective marking tools: Protective marking tools do not automatically insert protective markings into emails.	Not yet assessed	Not yet assessed.
ISM-0272	Protective marking tools: Protective marking tools do not allow the selection of protective markings that a system has not been authorised to process, store or communicate.	Not yet assessed	Not yet assessed.
ISM-1089	Protective marking tools: When replying to or forwarding emails, protective marking tools do not allow the selection of protective markings lower than previously used.	Not yet assessed	Not yet assessed.
ISM-0565	Handling emails with inappropriate, invalid or missing protective markings: Email servers are configured to block, log and report emails with inappropriate protective markings.	Not yet assessed	Not yet assessed.
ISM-1023	Handling emails with inappropriate, invalid or missing protective markings: The intended recipients of blocked inbound emails, and the senders of blocked outbound emails, are notified.	Not yet assessed	Not yet assessed.
ISM-0569	Centralised email gateways: Emails are routed via centralised email gateways.	Not yet assessed	Not yet assessed.
ISM-0571	Centralised email gateways: When users send or receive emails, an authenticated and encrypted channel is used to route emails via their organisation’s centralised email gateways.	Not yet assessed	Not yet assessed.
ISM-0570	Email gateway maintenance activities: Where backup or alternative email gateways are in place, they are maintained at the same standard as the primary email gateway.	Not yet assessed	Not yet assessed.
ISM-0567	Open relay email servers: Email servers only relay emails destined for or originating from their domains (including subdomains).	Not yet assessed	Not yet assessed.
ISM-0572	Email server transport encryption: Opportunistic TLS encryption is enabled on email servers that make incoming or outgoing email connections over public network infrastructure.	Not yet assessed	Not yet assessed.
ISM-1589	Email server transport encryption: MTA-STS is enabled to prevent the unencrypted transfer of emails between email servers.	Not yet assessed	Not yet assessed.
ISM-0574	Sender Policy Framework: SPF is used to specify authorised email servers (or lack thereof) for an organisation’s domains (including subdomains).	Partial	Email Pyron sends from pyron.io is signed with DKIM, and its sending domain is named in an SPF record and aligns with it. This covers pyron.io, the domain Pyron sends from.
ISM-1183	Sender Policy Framework: A hard fail SPF record is used when specifying authorised email servers (or lack thereof) for an organisation’s domains (including subdomains).	Planned	pyron.io's SPF record soft-fails, and its DMARC policy asks receivers to report mail that fails, not yet to quarantine or reject it.
ISM-1151	Sender Policy Framework: SPF is used to verify the authenticity of incoming emails.	Not yet assessed	Not yet assessed.
ISM-0861	DomainKeys Identified Mail: DKIM signing is enabled on emails originating from an organisation’s domains (including subdomains).	Partial	Email Pyron sends from pyron.io is signed with DKIM, and its sending domain is named in an SPF record and aligns with it. This covers pyron.io, the domain Pyron sends from.
ISM-1026	DomainKeys Identified Mail: DKIM signatures on incoming emails are verified.	Not yet assessed	Not yet assessed.
ISM-1027	DomainKeys Identified Mail: Email distribution list applications used by external senders is configured such that it does not break the validity of the sender’s DKIM signature.	Not yet assessed	Not yet assessed.
ISM-1540	Domain-based Message Authentication, Reporting and Conformance: DMARC records are configured for an organisation’s domains (including subdomains) such that emails are rejected if they do not pass DMARC checks.	Planned	pyron.io's SPF record soft-fails, and its DMARC policy asks receivers to report mail that fails, not yet to quarantine or reject it.
ISM-1799	Domain-based Message Authentication, Reporting and Conformance: Incoming emails are rejected if they do not pass DMARC checks.	Not yet assessed	Not yet assessed.
ISM-1234	Email content filtering: Email content filtering is implemented to filter potentially harmful content in email bodies and attachments.	Not yet assessed	Not yet assessed.
ISM-1502	Blocking suspicious emails: Emails arriving via an external connection where the email source address uses an internal domain, or internal subdomain, are blocked at the email gateway.	Not yet assessed	Not yet assessed.
ISM-1024	Notifications of undeliverable emails: Notifications of undeliverable emails are only sent to senders that can be verified via SPF or other trusted means.	Not yet assessed	Not yet assessed.
ISM-0518	Network documentation: Network documentation is developed, implemented and maintained.	In place	Our cloud accounts, network edge and source control are defined in code, changed through pull requests, and scanned for insecure settings (Checkov) on every change.
ISM-0516	Network documentation: Network documentation includes high-level network diagrams showing all connections into networks and logical network diagrams showing all critical servers, high-value servers, network devices and network security appliances.	Not yet assessed	Not yet assessed.
ISM-1912	Network documentation: Network documentation includes device settings for all critical servers, high-value servers, network devices and network security appliances.	Not yet assessed	Not yet assessed.
ISM-1178	Network documentation: Network documentation provided to a third party, or published in public tender documentation, only contains details necessary for other parties to undertake contractual services.	Not yet assessed	Not yet assessed.
ISM-1181	Network segmentation and segregation: Networks are segregated into multiple network zones according to the criticality of servers, services and data.	In place	The database and the application have no public address: requests reach the application only through an encrypted Cloudflare tunnel, and network policies stop staging from ever reaching production.
ISM-1577	Network segmentation and segregation: An organisation’s networks are segregated from their service providers’ networks.	Not yet assessed	Not yet assessed.
ISM-1532	Using virtual local area networks: VLANs are not used to separate network traffic between an organisation’s networks and public network infrastructure.	Not yet assessed	Not yet assessed.
ISM-0529	Using virtual local area networks: VLANs are not used to separate network traffic between networks belonging to different security domains.	Not yet assessed	Not yet assessed.
ISM-0530	Using virtual local area networks: Network devices managing VLANs are administered from the most trusted security domain.	Not yet assessed	Not yet assessed.
ISM-0535	Using virtual local area networks: Network devices managing VLANs belonging to different security domains do not share VLAN trunks.	Not yet assessed	Not yet assessed.
ISM-1364	Using virtual local area networks: Network devices managing VLANs terminate VLANs belonging to different security domains on separate physical network interfaces.	Not yet assessed	Not yet assessed.
ISM-2068	Functional separation between networked devices and the internet: Internet connectivity for networked devices is strictly limited to those that require access.	Not yet assessed	Not yet assessed.
ISM-1863	Networked management interfaces: Networked management interfaces for IT equipment are not directly exposed to the internet.	Not yet assessed	Not yet assessed.
ISM-2160	Networked management interfaces: Networked management interfaces for IT equipment are only accessible from a dedicated management network that is segregated from the wider network and the internet.	Not yet assessed	Not yet assessed.
ISM-0385	Functional separation between servers: Servers maintain effective functional separation from each other.	Not yet assessed	Not yet assessed.
ISM-1479	Functional separation between servers: Servers minimise communications with other servers at the network and file system level.	Not yet assessed	Not yet assessed.
ISM-1781	Network encryption: All data communicated over network infrastructure is encrypted using ASD-approved cryptography.	Partial	Pyron is served only over HTTPS with TLS 1.2 or later, and tells browsers never to use plain HTTP; the database refuses an unencrypted connection, and file storage refuses an unencrypted request. Traffic between our own services inside the cluster is not encrypted.
ISM-1186	Using Internet Protocol version 6: IPv6 capable network security appliances are used on IPv6 and dual-stack networks.	Not yet assessed	Not yet assessed.
ISM-1428	Using Internet Protocol version 6: Unless explicitly required, IPv6 tunnelling is disabled on all network devices.	Not yet assessed	Not yet assessed.
ISM-1429	Using Internet Protocol version 6: IPv6 tunnelling is blocked by network security appliances at externally connected network boundaries.	Not yet assessed	Not yet assessed.
ISM-1430	Using Internet Protocol version 6: Dynamically assigned IPv6 addresses are configured with Dynamic Host Configuration Protocol version 6 in a stateful manner with lease data stored in a centralised event logging facility.	Not yet assessed	Not yet assessed.
ISM-0520	Network access controls: Network access controls are implemented on networks to prevent the connection of unauthorised network devices and networked IT equipment.	Not yet assessed	Not yet assessed.
ISM-1182	Network access controls: Network access controls are implemented to limit the flow of network traffic within and between network segments to only that required for business purposes.	Not yet assessed	Not yet assessed.
ISM-1321	802.1X authentication and key exchange: 802.1X with EAP-TLS is used for mutual authentication and key exchange; with all other EAP methods disabled on supplicants and authentication servers.	Not yet assessed	Not yet assessed.
ISM-1711	802.1X authentication and key exchange: User identity confidentiality is used if available with EAP-TLS implementations.	Not yet assessed	Not yet assessed.
ISM-1322	Evaluation of 802.1X implementations: Evaluated supplicants, authenticators and authentication servers are used for 802.1X authentication implementations.	Not yet assessed	Not yet assessed.
ISM-1323	Generating and issuing X.509 certificates for authentication: X.509 certificates are required for devices and human users authenticating to networks using 802.1X.	Not yet assessed	Not yet assessed.
ISM-1324	Generating and issuing X.509 certificates for authentication: X.509 certificates are generated using an evaluated certificate authority or hardware security module.	Not yet assessed	Not yet assessed.
ISM-1327	Generating and issuing X.509 certificates for authentication: X.509 certificates are protected by logical and physical access controls and encryption, with those issued to human users requiring authentication before use.	Not yet assessed	Not yet assessed.
ISM-1454	Remote Authentication Dial-In User Service authentication: Communications between authenticators and a RADIUS server are encapsulated with an additional layer of encryption using RADIUS over Internet Protocol Security or RADIUS over Transport Layer Security.	Not yet assessed	Not yet assessed.
ISM-1006	Network management traffic: Security measures are implemented to prevent unauthorised access to network management traffic.	Not yet assessed	Not yet assessed.
ISM-1962	Using the Server Message Block protocol: SMB version 1 is not used on networks.	Not yet assessed	Not yet assessed.
ISM-1311	Using the Simple Network Management Protocol: SNMP version 1 and SNMP version 2 are not used on networks.	Not yet assessed	Not yet assessed.
ISM-1312	Using the Simple Network Management Protocol: All default SNMP community strings on network devices are changed and write access is disabled.	Not yet assessed	Not yet assessed.
ISM-1028	Using network-based intrusion detection and prevention systems: A NIDS or NIPS is deployed in gateways between an organisation’s networks and other networks they do not manage.	Not yet assessed	Not yet assessed.
ISM-1030	Using network-based intrusion detection and prevention systems: A NIDS or NIPS is located immediately inside the outermost firewall for gateways and configured to generate event logs and alerts for network traffic that contravenes any rule in a firewall ruleset.	Not yet assessed	Not yet assessed.
ISM-1627	Blocking anonymity network traffic: Inbound network connections from anonymity networks are blocked.	Not yet assessed	Not yet assessed.
ISM-1628	Blocking anonymity network traffic: Outbound network connections to anonymity networks are blocked.	Not yet assessed	Not yet assessed.
ISM-2017	Encrypted Domain Name System Services: DNS traffic is encrypted by clients and servers using ASD-approved cryptography.	Not yet assessed	Not yet assessed.
ISM-1782	Protective Domain Name System Services: A protective DNS service is used to block access to known malicious domain names.	In place	Traffic leaving our servers passes through Cloudflare Gateway, which blocks known malware, phishing and command-and-control destinations and logs every destination, without decrypting traffic. If Gateway is unavailable, traffic continues without that filter rather than stopping: a risk we have accepted, so that an outage at the filter does not stop customers' automations.
ISM-1800	Network device integrity: Network devices are flashed with trusted firmware before they are used for the first time.	Not yet assessed	Not yet assessed.
ISM-2161	Network device integrity: The integrity of network device firmware and running configurations is verified against an approved known-good baseline following patching, on detection of anomalous behaviour and at least monthly.	Not yet assessed	Not yet assessed.
ISM-1304	Network device hardening: Default user accounts or credentials for network devices, including for any pre-configured user accounts, are changed, disabled or removed during initial setup.	Not yet assessed	Not yet assessed.
ISM-2162	Network device hardening: Unneeded components, services and functionality of network devices are disabled or removed.	Not yet assessed	Not yet assessed.
ISM-0534	Disabling unused physical ports on network devices: Unused physical ports on network devices are disabled.	Not yet assessed	Not yet assessed.
ISM-1801	Regularly restarting network devices: Network devices are restarted at least monthly.	Not yet assessed	Not yet assessed.
ISM-1963	Network device event logging: Security-relevant events for internet-facing network devices are centrally logged.	Not yet assessed	Not yet assessed.
ISM-1964	Network device event logging: Security-relevant events for non-internet-facing network devices are centrally logged.	Not yet assessed	Not yet assessed.
ISM-2163	Media Access Control Security: When using MACsec, confidentiality protection mode is enabled using GCM-AES-128, GCM-AES-256, GCM-AES-XPN-128 or GCM-AES-XPN-256, preferably GCM-AES-256 or GCM-AES-XPN-256.	Not yet assessed	Not yet assessed.
ISM-2164	Media Access Control Security: A connectivity association lifetime of less than 24 hours (86400 seconds) is used for MACsec connections.	Not yet assessed	Not yet assessed.
ISM-2165	Media Access Control Security: When using EAP-TLS, each device performs a fresh EAP-TLS authentication each time a new Connectivity Association Key is required.	Not yet assessed	Not yet assessed.
ISM-2166	Media Access Control Security: A secure association lifetime of less than four hours (14400 seconds) is used for MACsec connections.	Not yet assessed	Not yet assessed.
ISM-2167	Media Access Control Security: The use of a Pre-Shared Key as a fallback authentication method for MACsec is disabled.	Not yet assessed	Not yet assessed.
ISM-1314	Choosing wireless devices: All wireless devices are Wi-Fi Alliance certified.	Not yet assessed	Not yet assessed.
ISM-0536	Public wireless networks: Public wireless networks provided for public use are segregated from all other organisation networks.	Not yet assessed	Not yet assessed.
ISM-1315	Administrative interfaces for wireless access points: The administrative interface on wireless access points is disabled for wireless network connections.	Not yet assessed	Not yet assessed.
ISM-1710	Default settings: Settings for wireless access points are hardened.	Not yet assessed	Not yet assessed.
ISM-1316	Default settings: Default SSIDs of wireless access points are changed.	Not yet assessed	Not yet assessed.
ISM-1317	Default settings: SSIDs of non-public wireless networks are not readily associated with an organisation, the location of their premises or the functionality of wireless networks.	Not yet assessed	Not yet assessed.
ISM-1318	Default settings: SSID broadcasting is not disabled on wireless access points.	Not yet assessed	Not yet assessed.
ISM-1320	Media Access Control address filtering: MAC address filtering is not used to restrict which devices can connect to wireless networks.	Not yet assessed	Not yet assessed.
ISM-1319	Static addressing: Static addressing is not used for assigning IP addresses on wireless networks.	Not yet assessed	Not yet assessed.
ISM-1332	Confidentiality and integrity of wireless network traffic: WPA3-Enterprise 192-bit mode is used to protect the confidentiality and integrity of all wireless network traffic.	Not yet assessed	Not yet assessed.
ISM-1330	Caching 802.1X authentication outcomes: The PMK caching period is not set to greater than 1440 minutes (24 hours).	Not yet assessed	Not yet assessed.
ISM-1712	Fast Basic Service Set Transition: The use of FT (802.11r) is disabled unless authenticator-to-authenticator communications are secured by an ASD-Approved Cryptographic Protocol.	Not yet assessed	Not yet assessed.
ISM-1334	Interference between wireless networks: Wireless networks implement sufficient frequency separation from other wireless networks.	Not yet assessed	Not yet assessed.
ISM-1335	Protecting management frames on wireless networks: Wireless access points enable the use of the 802.11w amendment to protect management frames.	Not yet assessed	Not yet assessed.
ISM-1338	Wireless network footprint: Instead of deploying a small number of wireless access points that broadcast on high power, a greater number of wireless access points that use less broadcast power are deployed to achieve the desired footprint for wireless networks.	Not yet assessed	Not yet assessed.
ISM-1437	Cloud-based hosting of online services: Cloud service providers are used for hosting online services.	In place	Pyron runs on AWS and Cloudflare, with no data centre or server room of its own. The physical and environmental security of the facilities it runs in, including their power, cooling, cabling and the disposal of their storage media, is theirs, under their own independent certifications.
ISM-1579	Capacity and availability planning and monitoring for online services: Cloud service providers’ ability to scale resources dynamically in response to genuine spikes in demand is discussed and verified as part of capacity and availability planning for online services.	In place	Alerts watch the database's storage, processor, memory and connections, and the cluster adds and removes servers automatically as the work scheduled on it changes.
ISM-1580	Capacity and availability planning and monitoring for online services: Where a high availability requirement exists for online services, the services are architected to automatically transition between availability zones.	Partial	The application runs on servers in two availability zones, with the path that answers requests spread across both. The production database runs in a single availability zone, with no standby, and we make no uptime commitment.
ISM-1581	Capacity and availability planning and monitoring for online services: Continuous real-time monitoring of the capacity and availability of online services is performed.	In place	Logs, metrics and traces from every part of the service are collected through OpenTelemetry and go to Grafana Cloud in Australia, with credentials and what is said to and by the AI removed first. Alerts watch errors, response times, database capacity, background work, certificates and credentials, each alert has a written runbook, and a watchdog pages if the monitoring itself stops reporting. Alerts watch the database's storage, processor, memory and connections, and the cluster adds and removes servers automatically as the work scheduled on it changes.
ISM-1438	Using content delivery networks: Where a high availability requirement exists for website hosting, CDNs that cache websites are used.	In place	Cloudflare's managed firewall rules, including the OWASP Core Ruleset, run in front of Pyron, and requests to its API are rate-limited there.
ISM-1439	Using content delivery networks: If using CDNs, disclosing the IP addresses of web servers under an organisation’s control (referred to as origin servers) is avoided and access to the origin servers is restricted to the CDNs and authorised management networks.	In place	The database and the application have no public address: requests reach the application only through an encrypted Cloudflare tunnel, and network policies stop staging from ever reaching production.
ISM-1431	Denial-of-service attack mitigation strategies: Denial-of-service attack mitigation strategies are discussed with cloud service providers, specifically: - their capacity to withstand denial-of-service attacks - costs likely to be incurred as a result of denial-of-service attacks - availability monitoring and thresholds for notification of denial-of-service attacks - thresholds for turning off any online services or functionality during denial-of-service attacks - pre-approved actions that can be undertaken during denial-of-service attacks - any arrangements with upstream service providers to block malicious network traffic as far upstream as possible.	Not yet assessed	Not yet assessed.
ISM-1436	Denial-of-service attack mitigation strategies: Critical online services are segregated from other online services that are more likely to be targeted as part of denial-of-service attacks.	Not yet assessed	Not yet assessed.
ISM-1432	Denial-of-service attack mitigation strategies: Domain names for online services are protected via registrar locking and confirming that domain registration details are correct.	Not yet assessed	Not yet assessed.
ISM-0507	Cryptographic key management processes and procedures: Cryptographic key management processes, and supporting cryptographic key management procedures, are developed, implemented and maintained.	In place	A key moves through AWS Key Management Service's own states, enabled, disabled and scheduled for deletion after a waiting period, and every change to a key is made in infrastructure code and recorded by AWS CloudTrail. The Cryptography Policy sets who holds the keys, and that a key suspected to be compromised is rotated and the data it protected re-encrypted.
ISM-0455	Data recovery: Where practical, cryptographic equipment, applications and libraries provide a means of data recovery to allow for circumstances where the encryption key is unavailable due to loss, damage or failure.	Not yet assessed	Not yet assessed.
ISM-0462	Handling encrypted IT equipment and media: When a user authenticates to the encryption functionality of IT equipment or media, it is treated in accordance with its original sensitivity or classification until the user deauthenticates from the encryption functionality.	Not yet assessed	Not yet assessed.
ISM-0501	Transporting cryptographic equipment: Keyed cryptographic equipment is transported based on the sensitivity or classification of its keying material.	Not yet assessed	Not yet assessed.
ISM-0142	Reporting cryptographic-related cyber security incidents: The compromise or suspected compromise of cryptographic equipment or associated keying material is reported to the chief information security officer, or one of their delegates, as soon as possible after it occurs.	Not yet assessed	Not yet assessed.
ISM-1091	Reporting cryptographic-related cyber security incidents: Keying material is changed when compromised or suspected of being compromised.	Partial	A key moves through AWS Key Management Service's own states, enabled, disabled and scheduled for deletion after a waiting period, and every change to a key is made in infrastructure code and recorded by AWS CloudTrail. The Cryptography Policy sets who holds the keys, and that a key suspected to be compromised is rotated and the data it protected re-encrypted. The Incident Management Policy sets out how an incident is found, rated, contained, investigated with its evidence preserved, and learned from, who leads it and when customers are told. Each Critical or High incident gets a written review within 10 business days, and an affected customer may ask for a summary of it. The policy took effect on 25 October 2026, and the yearly walk-through of an incident scenario it requires has not yet been held.
ISM-1080	Using cryptographic algorithms: An AACA or high assurance cryptographic algorithm is used when encrypting data at rest.	Not yet assessed	Not yet assessed.
ISM-0471	Using cryptographic algorithms: Only AACAs or high assurance cryptographic algorithms are used by cryptographic equipment, applications and libraries.	Not yet assessed	Not yet assessed.
ISM-0994	Asymmetric cryptographic algorithms: ECDH is used in preference to DH.	Not yet assessed	Not yet assessed.
ISM-0472	Using Diffie-Hellman: When using DH for agreeing on encryption session keys, a modulus of at least 2048 bits is used, preferably 3072 bits.	Not yet assessed	Not yet assessed.
ISM-1629	Using Diffie-Hellman: When using DH for agreeing on encryption session keys, a modulus and associated parameters are selected according to NIST SP 800-56A Rev. 3.	Not yet assessed	Not yet assessed.
ISM-1446	Using Elliptic Curve Cryptography: When using elliptic curve cryptography, a suitable curve from NIST SP 800-186 is used.	Not yet assessed	Not yet assessed.
ISM-0474	Using Elliptic Curve Diffie-Hellman: When using ECDH for agreeing on encryption session keys, a base point order and key size of at least 224 bits is used, preferably the NIST P-384 curve.	Not yet assessed	Not yet assessed.
ISM-0475	Using the Elliptic Curve Digital Signature Algorithm: When using ECDSA for digital signatures, a base point order and key size of at least 224 bits is used, preferably the P-384 curve.	Not yet assessed	Not yet assessed.
ISM-1990	Using post-quantum cryptographic algorithms: When using ML-DSA and ML-KEM, as per FIPS 204 and FIPS 203 respectively, adherence to pre-requisite FIPS 140-3 validation is preferred.	Not yet assessed	Not yet assessed.
ISM-1991	Using the Module-Lattice-Based Digital Signature Algorithm: When using ML-DSA for digital signatures, ML-DSA-65 or ML-DSA-87 is used, preferably ML-DSA-87.	Not yet assessed	Not yet assessed.
ISM-1992	Using the Module-Lattice-Based Digital Signature Algorithm: When using ML-DSA for digital signatures, the hedged variant is used whenever possible.	Not yet assessed	Not yet assessed.
ISM-1993	Using the Module-Lattice-Based Digital Signature Algorithm: Pre-hashed variants of ML-DSA-65 and ML-DSA-87 are only used when the performance of default variants is unacceptable.	Not yet assessed	Not yet assessed.
ISM-1994	Using the Module-Lattice-Based Digital Signature Algorithm: When the pre-hashed variants of ML-DSA-65 and ML-DSA-87 are used, at least SHA-384 and SHA-512 respectively are used for pre-hashing.	Not yet assessed	Not yet assessed.
ISM-1995	Using the Module-Lattice-Based Key Encapsulation Mechanism: When using ML-KEM for encapsulating encryption session keys (and similar keys), ML-KEM-768 or ML-KEM-1024 is used, preferably ML-KEM-1024.	Not yet assessed	Not yet assessed.
ISM-0476	Using Rivest-Shamir-Adleman: When using RSA for digital signatures, and transporting encryption session keys (and similar keys), a modulus of at least 2048 bits is used, preferably 3072 bits.	Not yet assessed	Not yet assessed.
ISM-0477	Using Rivest-Shamir-Adleman: When using RSA for digital signatures, and for transporting encryption session keys (and similar keys), a different key pair is used for digital signatures and transporting encryption session keys.	Not yet assessed	Not yet assessed.
ISM-1766	Using Secure Hashing Algorithms: When using SHA-2 for hashing, an output size of at least 224 bits is used, preferably SHA-384 or SHA-512.	Not yet assessed	Not yet assessed.
ISM-1769	Using symmetric cryptographic algorithms: When using AES for encryption, AES-128, AES-192 or AES-256 is used, preferably AES-256.	Not yet assessed	Not yet assessed.
ISM-0479	Using symmetric cryptographic algorithms: Symmetric cryptographic algorithms are not used in Electronic Codebook Mode.	Not yet assessed	Not yet assessed.
ISM-2073	Transitioning to post-quantum cryptography: A post-quantum cryptography transition plan is developed, implemented and maintained.	Not yet assessed	Not yet assessed.
ISM-1917	Transitioning to post-quantum cryptography: The development and procurement of new cryptographic equipment, applications and libraries ensures support for the use of ML-DSA-87, ML-KEM-1024, SHA-384, SHA-512 and AES-256 by no later than 2030.	Not yet assessed	Not yet assessed.
ISM-1996	Post-quantum traditional hybrid schemes: When a post-quantum traditional hybrid scheme is used, either the post-quantum cryptographic algorithm, the traditional cryptographic algorithm or both are AACAs.	Not yet assessed	Not yet assessed.
ISM-0469	Using cryptographic protocols: An AACP or high assurance cryptographic protocol is used when encrypting data in transit.	Not yet assessed	Not yet assessed.
ISM-0481	Using cryptographic protocols: Only AACPs or high assurance cryptographic protocols are used by cryptographic equipment, applications and libraries.	Not yet assessed	Not yet assessed.
ISM-0494	Mode of operation: Tunnel mode is used for IPsec connections; however, if using transport mode, an IP tunnel is used.	Not yet assessed	Not yet assessed.
ISM-0496	Protocol selection: The ESP protocol is used for authentication and encryption of IPsec connections.	Not yet assessed	Not yet assessed.
ISM-1233	Key exchange: IKE version 2 is used for key exchange when establishing IPsec connections.	Not yet assessed	Not yet assessed.
ISM-1771	Encryption algorithms: AES is used for encrypting IPsec connections, preferably ENCR_AES_GCM_16.	Not yet assessed	Not yet assessed.
ISM-1772	Pseudorandom function: PRF_HMAC_SHA2_256, PRF_HMAC_SHA2_384 or PRF_HMAC_SHA2_512 is used for IPsec connections, preferably PRF_HMAC_SHA2_512.	Not yet assessed	Not yet assessed.
ISM-0998	Integrity algorithms: AUTH_HMAC_SHA2_256_128, AUTH_HMAC_SHA2_384_192, AUTH_HMAC_SHA2_512_256 or NONE (only with AES-GCM) is used for authenticating IPsec connections, preferably NONE.	Not yet assessed	Not yet assessed.
ISM-0999	Diffie-Hellman groups: DH or ECDH is used for key establishment of IPsec connections, preferably 384-bit random ECP group, 3072-bit MODP Group or 4096-bit MODP Group.	Not yet assessed	Not yet assessed.
ISM-0498	Security association lifetimes: A security association lifetime of less than four hours (14400 seconds) is used for IPsec connections.	Not yet assessed	Not yet assessed.
ISM-1000	Perfect Forward Secrecy: PFS is used for IPsec connections.	Not yet assessed	Not yet assessed.
ISM-1506	Configuring Secure Shell: The use of SSH version 1 is disabled for SSH connections.	Not yet assessed	Not yet assessed.
ISM-0484	Configuring Secure Shell: The SSH daemon is configured to: - only listen on the required interfaces (ListenAddress xxx.xxx.xxx.xxx) - have a suitable login banner (Banner x) - have a login authentication timeout of no more than 60 seconds (LoginGraceTime 60) - disable host-based authentication (HostbasedAuthentication no) - disable rhosts-based authentication (IgnoreRhosts yes) - disable the ability to log in directly as root (PermitRootLogin no) - disable empty passwords (PermitEmptyPasswords no) - disable connection forwarding (AllowTCPForwarding no) - disable gateway ports (GatewayPorts no) - disable X11 forwarding (X11Forwarding no).	Not yet assessed	Not yet assessed.
ISM-0485	Authentication mechanisms: Public key-based authentication is used for SSH connections.	Not yet assessed	Not yet assessed.
ISM-1449	Authentication mechanisms: SSH private keys are protected with a password or a key encryption key.	Not yet assessed	Not yet assessed.
ISM-0487	Automated remote access: When using logins without a password for SSH connections, the following are disabled: - access from IP addresses that do not require access - port forwarding - agent credential forwarding - X11 forwarding - console access.	Not yet assessed	Not yet assessed.
ISM-0488	Automated remote access: If using remote access without the use of a password for SSH connections, the ‘forced command’ option is used to specify what command is executed and parameter checking is enabled.	Not yet assessed	Not yet assessed.
ISM-0489	SSH-agent: When SSH-agent or similar key caching applications are used, cached private keys have a maximum lifetime of four hours and, where applicable, screen locks are used on workstations and servers.	Not yet assessed	Not yet assessed.
ISM-0490	Configuring Secure/Multipurpose Internet Mail Extensions: Versions of S/MIME earlier than S/MIME version 3.0 are not used for S/MIME connections.	Not yet assessed	Not yet assessed.
ISM-1139	Configuring Transport Layer Security: Only the latest version of TLS is used for TLS connections.	Partial	Pyron is served only over HTTPS with TLS 1.2 or later, and tells browsers never to use plain HTTP; the database refuses an unencrypted connection, and file storage refuses an unencrypted request. Traffic between our own services inside the cluster is not encrypted. TLS 1.2 is still accepted beside TLS 1.3.
ISM-1369	Configuring Transport Layer Security: AES-GCM is used for encryption of TLS connections.	Not yet assessed	Not yet assessed.
ISM-1370	Configuring Transport Layer Security: Only server-initiated secure renegotiation is used for TLS connections.	Not yet assessed	Not yet assessed.
ISM-1372	Configuring Transport Layer Security: The ephemeral variant of DH or ECDH is used for key establishment of TLS connections.	Not yet assessed	Not yet assessed.
ISM-1373	Configuring Transport Layer Security: Anonymous DH is not used for TLS connections.	Not yet assessed	Not yet assessed.
ISM-1374	Configuring Transport Layer Security: SHA-2-based certificates are used for TLS connections.	Not yet assessed	Not yet assessed.
ISM-1375	Configuring Transport Layer Security: SHA-2 is used for the Hash-based Message Authentication Code (HMAC) and pseudorandom function (PRF) for TLS connections.	Not yet assessed	Not yet assessed.
ISM-1553	Configuring Transport Layer Security: TLS compression is disabled for TLS connections.	Not yet assessed	Not yet assessed.
ISM-1453	Configuring Transport Layer Security: Perfect Forward Secrecy (PFS) is used for TLS connections.	Not yet assessed	Not yet assessed.
ISM-0628	Implementing gateways: Gateways are implemented between networks belonging to different security domains.	Not yet assessed	Not yet assessed.
ISM-0637	Implementing gateways: Gateways implement a demilitarised zone if external parties require access to an organisation’s services.	Not yet assessed	Not yet assessed.
ISM-0631	Implementing gateways: Gateways only allow explicitly authorised data flows.	Not yet assessed	Not yet assessed.
ISM-1192	Implementing gateways: Gateways inspect and filter data flows at the transport and above network layers.	Not yet assessed	Not yet assessed.
ISM-1427	Implementing gateways: Gateways perform ingress traffic filtering to detect and prevent IP source address spoofing.	Not yet assessed	Not yet assessed.
ISM-1520	System administrators for gateways: System administrators for gateways undergo appropriate employment screening, and where necessary hold an appropriate security clearance, based on the sensitivity or classification of gateways.	Not yet assessed	Not yet assessed.
ISM-0611	System administrators for gateways: System administrators for gateways are assigned the minimum privileges required to perform their duties.	Not yet assessed	Not yet assessed.
ISM-0616	System administrators for gateways: Separation of duties is implemented in performing administrative activities for gateways.	Not yet assessed	Not yet assessed.
ISM-0612	System administrators for gateways: System administrators for gateways are formally trained on the operation and management of gateways.	Not yet assessed	Not yet assessed.
ISM-1774	System administration of gateways: Gateways are managed via a secure path isolated from all connected networks.	Not yet assessed	Not yet assessed.
ISM-0629	System administration of gateways: For gateways between networks belonging to different security domains, any shared components are managed by system administrators for the higher security domain or by system administrators from a mutually agreed upon third party.	Not yet assessed	Not yet assessed.
ISM-0619	Authenticating to networks accessed via gateways: Users authenticate to other networks accessed via gateways.	Not yet assessed	Not yet assessed.
ISM-0622	Authenticating to networks accessed via gateways: IT equipment authenticates to other networks accessed via gateways.	Not yet assessed	Not yet assessed.
ISM-1783	Border Gateway Protocol routing security: Public IP addresses controlled by, or used by, an organisation are signed by valid ROA records.	Not yet assessed	Not yet assessed.
ISM-2018	Border Gateway Protocol routing security: Routes for RPKI-registered IP addresses that are advertised from invalid Autonomous Systems, or that are longer than allowed, are rejected or deprioritised by routers that exchange routes via BGP.	Not yet assessed	Not yet assessed.
ISM-0634	Gateway event logging: Security-relevant events for gateways are centrally logged, including: - data packets and data flows permitted through gateways - data packets and data flows attempting to leave gateways - real-time alerts for attempted intrusions.	Not yet assessed	Not yet assessed.
ISM-1037	Assessment of gateways: Gateways undergo testing following configuration changes, and at regular intervals no more than six months apart, to validate that they conform to expected security configurations.	Not yet assessed	Not yet assessed.
ISM-0100	Assessment of gateways: Non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET gateways undergo an IRAP assessment, using the latest release of the ISM available prior to the beginning of the IRAP assessment (or a subsequent release), at least every 24 months.	Not yet assessed	Not yet assessed.
ISM-1528	Using firewalls: Evaluated firewalls are used between an organisation’s networks and public network infrastructure.	Not yet assessed	Not yet assessed.
ISM-0639	Using firewalls: Evaluated firewalls are used between networks belonging to different security domains.	Not yet assessed	Not yet assessed.
ISM-1862	Using web application firewalls: If using a WAF, disclosing the IP addresses of web servers under an organisation’s control (referred to as origin servers) is avoided and access to the origin servers is restricted to the WAF and authorised management networks.	In place	The database and the application have no public address: requests reach the application only through an encrypted Cloudflare tunnel, and network policies stop staging from ever reaching production.
ISM-0643	Using diodes: Evaluated diodes are used for controlling the data flow of unidirectional gateways between an organisation’s networks and public network infrastructure.	Not yet assessed	Not yet assessed.
ISM-1157	Using diodes: Evaluated diodes are used for controlling the data flow of unidirectional gateways between networks.	Not yet assessed	Not yet assessed.
ISM-0260	Using web proxies: All web access, including that by internal servers, is conducted through web proxies.	Not yet assessed	Not yet assessed.
ISM-0261	Web proxy event logging: The following details are centrally logged for websites accessed via web proxies: - web address - date and time - user - amount of data uploaded and downloaded - internal and external IP addresses.	Not yet assessed	Not yet assessed.
ISM-0963	Using web content filters: Web content filtering is implemented to filter potentially harmful web-based content.	In place	Traffic leaving our servers passes through Cloudflare Gateway, which blocks known malware, phishing and command-and-control destinations and logs every destination, without decrypting traffic. If Gateway is unavailable, traffic continues without that filter rather than stopping: a risk we have accepted, so that an outage at the filter does not stop customers' automations.
ISM-0961	Using web content filters: Client-side active content is restricted by web content filters to an organisation-approved list of domain names.	Not yet assessed	Not yet assessed.
ISM-1237	Using web content filters: Web content filtering is applied to outbound web traffic where appropriate.	In place	Traffic leaving our servers passes through Cloudflare Gateway, which blocks known malware, phishing and command-and-control destinations and logs every destination, without decrypting traffic. If Gateway is unavailable, traffic continues without that filter rather than stopping: a risk we have accepted, so that an outage at the filter does not stop customers' automations.
ISM-0263	Transport Layer Security filtering: TLS traffic communicated through gateways is decrypted and inspected.	Partial	Traffic leaving our servers passes through Cloudflare Gateway, which blocks known malware, phishing and command-and-control destinations and logs every destination, without decrypting traffic. If Gateway is unavailable, traffic continues without that filter rather than stopping: a risk we have accepted, so that an outage at the filter does not stop customers' automations. Outbound TLS traffic is not decrypted for inspection.
ISM-0958	Allowing and blocking access to domain names: An organisation-approved list of domain names, or list of website categories, is implemented for all Hypertext Transfer Protocol and Hypertext Transfer Protocol Secure traffic communicated through gateways.	Not yet assessed	Not yet assessed.
ISM-1236	Allowing and blocking access to domain names: Malicious domain names, dynamic domain names and domain names that can be registered anonymously for free are blocked by web content filters.	Partial	Traffic leaving our servers passes through Cloudflare Gateway, which blocks known malware, phishing and command-and-control destinations and logs every destination, without decrypting traffic. If Gateway is unavailable, traffic continues without that filter rather than stopping: a risk we have accepted, so that an outage at the filter does not stop customers' automations. Newly registered and newly seen domain names are logged rather than blocked, because a customer's own service can be new.
ISM-1171	Allowing and blocking access to domain names: Attempts to access websites through their IP addresses instead of their domain names are blocked by web content filters.	Not yet assessed	Not yet assessed.
ISM-0659	Performing content filtering: Files imported or exported via gateways or CDSs undergo content filtering checks.	In place	Every uploaded file is scanned for malware before anyone can open it, and a file that holds malware is removed.
ISM-0651	Performing content filtering: Files identified by content filtering checks as malicious, or that cannot be inspected, are blocked.	Not yet assessed	Not yet assessed.
ISM-0652	Performing content filtering: Files identified by content filtering checks as suspicious are quarantined until reviewed and subsequently approved or not approved for release.	Not yet assessed	Not yet assessed.
ISM-1293	Encrypted files: Encrypted files imported or exported via gateways or CDSs are decrypted to undergo content filtering checks.	Not yet assessed	Not yet assessed.
ISM-1289	Archive files: Archive files imported or exported via gateways or CDSs are unpacked to undergo content filtering checks.	Not yet assessed	Not yet assessed.
ISM-1290	Archive files: Archive files are unpacked in a controlled manner to ensure content filter performance or availability is not adversely affected.	Not yet assessed	Not yet assessed.
ISM-1288	Antivirus scanning: Files imported or exported via gateways or CDSs undergo antivirus scanning using multiple different scanning engines.	Not yet assessed	Not yet assessed.
ISM-1389	Automated dynamic analysis: Executable files imported via gateways or CDSs are automatically executed in a sandbox to detect any suspicious behaviour.	Not yet assessed	Not yet assessed.
ISM-0649	Allowing specific content types: Files imported or exported via gateways or CDSs are filtered for allowed file types.	Not yet assessed	Not yet assessed.
ISM-1284	Content validation: Files imported or exported via gateways or CDSs undergo content validation.	Not yet assessed	Not yet assessed.
ISM-1965	Content checking: Files imported or exported via gateways or CDSs undergo content checking.	Not yet assessed	Not yet assessed.
ISM-1286	Content conversion: Files imported or exported via gateways or CDSs undergo content conversion.	Not yet assessed	Not yet assessed.
ISM-1287	Content sanitisation: Files imported or exported via gateways or CDSs undergo content sanitisation.	Not yet assessed	Not yet assessed.
ISM-0677	Validating file integrity: Files imported or exported via gateways or CDSs that have a digital signature or cryptographic checksum are validated.	Not yet assessed	Not yet assessed.
ISM-0591	Using peripheral switches: Evaluated peripheral switches are used when sharing peripherals between systems.	Not yet assessed	Not yet assessed.
ISM-0663	Data transfer processes and procedures: Data transfer processes, and supporting data transfer procedures, are developed, implemented and maintained.	Not yet assessed	Not yet assessed.
ISM-0661	Accountability for data transfers: Human users transferring data to and from systems are held accountable for data transfers they perform.	In place	Every change in a workspace is recorded in plain words, whoever made it: a person, an automation, the AI or Support. What people view is recorded too, and so are attempts the permission engine refuses. The trail is kept for 24 months: records are only ever added, never edited, and each is cryptographically linked to the one before it, so tampering would be evident.
ISM-0657	Manual import of data: When manually importing data to systems, the data is scanned for malicious and active content.	In place	Every uploaded file is scanned for malware before anyone can open it, and a file that holds malware is removed.
ISM-1778	Manual import of data: When manually importing data to systems, all data that fails security checks is quarantined until reviewed and subsequently approved or not approved for release.	Not yet assessed	Not yet assessed.
ISM-1187	Manual export of data: When manually exporting data from systems, the data is checked for unsuitable protective markings.	Not yet assessed	Not yet assessed.
ISM-1779	Manual export of data: When manually exporting data from systems, all data that fails security checks is quarantined until reviewed and subsequently approved or not approved for release.	Not yet assessed	Not yet assessed.
ISM-1586	Monitoring data import and export: Data transfer logs are used to record all data imports and exports from systems.	Not yet assessed	Not yet assessed.
ISM-1294	Monitoring data import and export: Data transfer logs for systems are partially verified at least monthly.	Not yet assessed	Not yet assessed.